I'm looking for some advice / experience in ArcGIS Server security with a Windows domain. Normally in this situation I would do some prototyping but I don't have access to a domain.
I'm planning to create ArcGIS map services that are restricted by roles stored in a domain. These map services will be used by a map page in a custom .NET application. Both the application and ArcGIS Server will run on the same domain and potentially in the same IIS site (e.g. Default Web Site).
The .NET application will immediately require Windows authentication, so I know that IE users will pass through seamlessly but other browsers will prompt for a login. It's not clear to me if non-IE users will also be prompted for a login when first accessing a restricted map service.
- Q1: In the above configuration (same domain, same IIS site) would non-IE users get prompted a second time to access a restricted map service (e.g.
http://domain_name/ArcGIS/.../service_name
), or would the credentials they provided forhttp://domain_name/application/
be used for ArcGIS? - Q2: Would this change if a different IIS site (but still the same domain) was used for ArcGIS Server and the .NET application?
Another (perhaps simpler) option I'm considering is having my map page's server-side code generate a security token on load by making a request to the ArcGIS token service with expiry time calculated as # hours until 17:30. This token would be passed to the client in JavaScript. In this approach only a single account needs access to the map service. The security token contains
the user's name, expiration time and other information (source)
- Q3 does this 'other information' include anything that restricts the token to the IP or user-agent of the requestor - anything that will stop my server creating it on behalf of my client?
EDIT from further research it seems that a token can be explicitly bound to a given IP (provided when creating it) or to a referrer. In this case Q3 is answered 'no'
Any thoughts on these three questions would be super welcome. Thanks
A long-lived token can be obtained from the Token server, and this token may be included in the client-side page. The token is then included in the request for the service
resources.arcgis.com/content/enterprisegis/10.0/web_security I have no requirement for server certificates (intenal network), although I might consider client certificates for explicit access control if all other options fail – tomfumb Sep 14 '12 at 20:37