How to share a hosted feature service with an application on ArcGIS Online?

Question

According to the ESRI REST API documentation on authentication, a registered application can log in to AGOL via an App ID and App Secret and will then have access to the data that has been shared with it.

Applications that target end users who are unknown to the ArcGIS platform use app logins to connect to the platform. In this case, the application must use both an APPID (OAuth 2 client_id) and an APPSECRET (OAuth 2 client_secret). You are responsible for building the application in a way that keeps the APPSECRET secret, including from malicious users who download and inspect the iOS or Android application or view the source of the JavaScript application using developer tools. A malicious application that has access to the application's credentials (APPID and APPSECRET) can access billable services on ArcGIS, which will be billed to the application. For most JavaScript, iOS, and Android applications, this implies that the app must have a server side application component that keeps the application credentials secure and performs work on behalf of the app.

The server side application component that has access to the application's credentials can obtain a token using a single request. The OAuth 2 grant type is set to client_credentials. The actual POST request is made to the portal's OAuth 2 token endpoint.

For arcgis.com:

https://www.arcgis.com/sharing/oauth2/token

Parameters:

client_id=APPID&
client_secret=APPSECRET&
grant_type=client_credentials

Successful authentication directly returns a JSON response containing the access token that allows the application to work with resources that are accessible to the application (that is, have been shared with the application). Use of the client_secret as previously described is mandatory.

In the section above they specifically mention "resources...that have been shared with the application". I have not found anywhere in any documentation how to actually share resources with an application. How do I share a hosted feature service with a registered app so that my app can access secured services without my users logging in?

Answer 1

It's a good question. I was listening to an Esri presentation about marketplace and oauth2 yesterday and they kept talking about one step vs two Step authorization. See two step here https://developers.arcgis.com/en/authentication/user-ios-etc.html

One step authorization being for javascript, flex apps that will expire shortly, and you don't get a refresh token. Two step being for mobile apps (or I think desktop or server apps also) where you get the refresh token and don't want to have frequent logins. When the access token expires, you can keep getting new ones with the refresh token theoretically forever and wouldn't have to login after the first time. Of course, this is a security risk if you are saving this, say as a cookie for a javascript app.

Long way around to your question, but if you don't find any more information about the interesting phrase "resources...that have been shared with the application", I wonder if it really is more about users, and not apps, having access to resources?

A mobile, server (think php server side) or desktop application can use the two step authorization with a user account, get the refresh token, save it securely and keep refreshing the access token as needed. Under this scenario, other non AGOL users would not have to login to AGOL through your app, but can access AGOL resources through your app with the one named user account that is perpetually logged in.

As an aside, I'm not sure they would let an app of this sort into their marketplace because it doesn't involve individual user having to login to AGOL. Everything I'm hearing revolves around this phrase "named user account". Esri wants to sell subscriptions to AGOL and they want people to have an account and login with it -- which makes some have conniptions, but it's just their business model.

Answer 2

A registered app has read-only access to the content which is owned by the owner of the application, but it does not have access to content shared with the owner.

additionally, it is not possible to "share" content with the registered app itself.

if you would like to include content in your app which is only shared with a specific group, you could either present an OAuth challenge to end user so that they have an opportunity to identify themselves, allow an IdentityManager challenge to bubble up after the application has loaded, or authenticate on the users behalf by storing a hardcoded token/credentials in a server side proxy used to fetch the private resources.

Answer 3

I have created sample app showing how to get the ArcGIS Online token without the Android SDK - http://github.com/osedok/AGOLAuth

Please remember to set valid CLIENT_ID in ArcGISOAuth activity before running the sample.

The code is a slightly modified version provided by Dan O'Neill in here: https://geonet.esri.com/thread/81062