IdentityManager: keep user signed in after browser refresh

Question

Hi, I have developed an application that shows a WebMap from ArcGIS portal by using the ArcGIS JS API. I implemented authentication flow by using the IdentityManager. I'm able to get the token and register it and the secured resource then loads correctly. However, when I refresh the page in browser the registered token/credential is not available anymore. Is there a way to keep the sign in status as long as the token is valid? Or is it so that I need to store the access token (and possibly other needed details) my self in client side and then just validate the token before request to JS API and register it again? What is the recommended way to do this? Regards, Eemeli identityManager.checkSignInStatus( portalUrl + "/sharing" ).then( function ( credential ) { // User is already authenticated. identityManager.registerToken( { token: credential.token, server: portalUrl } ); resolve( true ); } ).catch( function( error ) { // User not authenticated, login the user. identityManager.getCredential( portalUrl + "/sharing" ).then( function ( credential ) { // Register the token after authentication. // The token is valid 60 min by default. identityManager.registerToken( { token: credential.token, server: portalUrl + "/sharing/rest", expires: credential.expires, ssl: credential.ssl, userId: credential.userId } ); resolve( true ); } ); } );‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

RaulJimenez1 · Answer

I had the same issue and I solved it like this https://codepen.io/hhkaos/pen/VwKQjLJ?editors=1000 [codepen.io]

The different between the ArcGIS Online sample and ArcGIS Enterprise was that portalURL in the OAuthInfo class expects a different URL than the identityManager methods like getCredential or checkSignInStatus.

So it would be something like this:

* oAuthInfo.portalURL= "https://yourdomain/arcgis"
* identityManager.getCredential("https://yourdomain/arcgis/sharing")
* identityManager.checkSignInStatus("https://yourdomain/arcgis/sharing")

I hope this helps to the next one having this issue.

Cheers!,
Raul

CoMAGOL_ADMINISTRATOR · Answer

Late reply... but helpful if anyone else comes across this.

My understanding is that if you don't use IdentityManager OAuth flow you're left to your own devices to store and re-register the token. Underneath your `IdentityManager.registerToken` call, store the response in localStorage. Then on page load, grab the token out of localStorage, and register it again via `IdentityManager.registerToken`.

How to request a refresh token when a call returns 403 forbidden? That's another story I'm currently investigating. I'll report back if I figure it out.