nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

FV 3.0 Disable Secure Service Login

SimonRoss_User

I've already posted this to an existing post (http://forums.arcgis.com/threads/54640-FV-3.0-and-Login) but thought I'd open separately so there's no confusion.

Just started working with FV 3.0 and having some issues with the new login popup for secured services.

Our existing applications (FV 2.5) are secured via an ASP form control. Credentials for the secure services are built into the proxy page. Currently with the new secure services login this causes a separate challenge for authentication. Ideally I'd just like to disable the new secure services challenge but can't seem to make this happen in the flexviewer source code. I've tried removing the IdentityManager.instance.enabled = true but this makes no difference. I still get the popup appear. Any ideas on how to customize the viewer to remove this?
Thanks

Finde mehr Beiträge mit dem Tag

Accepted answers

HeatherGonzago

Hi Simon,
Could you try one thing for me please? It looks like there may be a slight typo in the source that may be causing the issue with proxies not being honored for layers.

Go to line 495 of MapManager.mxml and change

From:
layerObject.proxyURL = m_configData.proxyUrl;

To:
layerObject.proxyUrl = m_configData.proxyUrl;

Could you please try this out and let me know if this takes care of the problem? If not, then there may be something more that we are missing.

Thanks again,
Heather

All comments

JosephAccardi

No worries Simon. Thanks for your help.

Take care,
Joe

SimonRoss_User

Joe,

The programming is really pretty straightforward - literally editing 3 lines and the ESRI documentation for getting the development environment setup is pretty good. Of course you do need Flashbuilder - I don't believe there's an open-source equivalent of any kind. Normally in the spirit of GIS community I'd be willing to share a copy of our updated compiled viewer but as you work for a competitor I have to draw the line in case it comes back to haunt me. Best of luck with getting up and running
Cheers

Simon

JosephAccardi

Thanks for all your info Simon. It�??s a shame that I cannot make this simple edit in the code to make the proxy page work. I may need to make the jump to the uncomplied version. The complied FV has too many limitations, but my application is pretty much built and I�??m not sure how much additional effort it will take to convert it to an uncomplied-FV app. In the meantime, I hope they will update the complied FV code with this fix, but until then it looks like all complied-FV users cannot use proxy pages.

SimonRoss_User

Unfortunately Joe - you will need to compile a custom flex viewer from the source code with the changes documented above. If you want to use the Edit Widget you may also need to make the change on the forum I linked ot further up. They're very small changes in the code but there is no other workaround right now

JosephAccardi

Simon, after working on the Proxy Page all afternoon, I can't get it to pass the token automatically and not prompt the user for credentials after the user has logged into the site. I�??ve attached config and both proxy files. If you have a chance, could you please let me know if you see anything obviously wrong with my set up? The user that I am using in the proxy.config file has permissions to access one of the secured services in the folder listed in the �??serverurl�?? link. I�??m using our external url as the domain which points to our internal server. Also the host name is the name of the internal server, correct?

I may be having the same problem you did which lead you to start this thread. I noticed that you fixed the problem by editing an mxml file. I used the complied FV app to create my site if that makes any difference.

Thanks,
Joe

Proxy_Config.zip

SimonRoss_User

Great question! I don't know the answer as we haven't tested that yet on our 10.1 testing server but definitely somethign we'll be interested in. Please post up how you get on with that
cheers

Simon

JosephAccardi

Simon, this is an excellent breakdown. Thank you very much. I am much more comfortable applying a proxy page to my application now. I (hopefully) have one last question for you. One of my secured services is a feature service with Editor Tracking enabled. One of the issues I've been having is that the 'Created User' attribute is not being generated since my services are not secure. Once I secure my services and use the proxy page, will the username I use in the proxy config file be the name that will be generated when features are created by all users? No worries if you're not sure. I will apply the proxy and see what happens. Thanks again for all your help.

SimonRoss_User

Joseph, what basically happens when the proxy is working is this:
1. User goes to the viewer web page and is prompted for their login credentials (in your case windows but type really doesn't matter)
2. When their credentials are accepted the viewer opens and loads the services and map configuration as listed in config.xml
3. Let's say you have MapServiceA in your viewer which is a secured service (in your config.xml you have specified the location of the proxy page in the httpproxy tag and selected useproxy="true" in the layer xml tag)
4. The application makes a request to the proxy page to access MapServiceA (it does not transfer any user credentials)
5. The proxy page checks if the requested url can be accessed from that site (proxy.config url setting)
6. In order to successfully make the request it needs a token for the service - it uses the username and password in the proxy.config to do this. Therefore you only need ONE set of user credentials in the proxy.config - these can be from a different identity store from the application login.
7. If the user credentials are ok it generates a token to successfully access the secured service

So you don't need to worry about multiple user logins in the proxy.config. This page can only be accessed after login to your application so the user has already proved their credentials

JosephAccardi

Thank you Simon. I am using 10.1. I would assume that the username and password would have to be the same in IIS and in the AGS Built-in Store because the user is prompted to log into the application with his/her IIS local domain credentials. Once the user passes the IIS authentication, I would assume AGS Built-in Store would not recognize the credentials if they were different and prompt the user to supply an additional set of credentials in order to view the secured service(s) that he/she has permissions to. This is all speculation at this point since I have not set up the proxy page yet. I'm going to apply it today and see what happens.

Quick question about the proxy config code. I have about 15-18 users of my FV 3.0 application. How do I enter in multiple usernames and passwords into the code?

Thank you again for your help with this.

Joe

SimonRoss_User

Joseph - it sounds like you may be using ArcGIS Server 10.1 as you refer to the built in identity store. If you are I'm not sure exactly how this works at 10.1 but I presume it's very similar.

Earlier in this forum you'll see I attached a file proxy.zip. This contains both the ashx file (default from ESRI) and the proxy.config.

As shown in this proxy.config example

<serverUrl url="https://MYDOMAIN/ArcGIS/rest/services" //This works at the root level but can also be set to individual  folders or services if preferred               
               matchAll="true" //This indicates that all sub-folders/services from the url above can be accessed if the credentials match - set this to false if the url is set to a specific service only
        dynamicToken="true" //This indicates that it will create the token at runtime based on the username and password
        userName="MYUSER" //valid username with access to the service(s) required - does not need to be the same as the application login - need to be an identity that can access the service
        password="MYPASSWORD" //password for this username
               host="MYHOSTNAME">
</serverUrl>

JosephAccardi

Setup instructions are in the main API help here

http://help.arcgis.com/en/webapi/flex/help/index.html#/Using_the_proxy_page/017p0000000v000000/

After that you just need to make sure the proxy is referenced in your config.xml as described here

http://resources.arcgis.com/en/help/flex-viewer/concepts/Index.html#/Using_a_proxy_page/01m30000000w000000/

Simon, your application is authenticated through IIS (basic, digest, etc.), but your web services are secured using ArcGIS Server Manager built in identity store (not through domain or LDAP), correct? If so, do you have users and roles assigned to each service? I'm going to add a proxy page as you suggested but I'm alittle confused about how a user is authenticated through IIS and also provided permissions to consume secured web services from a signal login. All my users and roles are set on the local server account, I'm just not sure if I have to replicate it out to the built in identity store. Thanks for your help with this.

SimonRoss_User

All - I have opened a new thread for a related issue with the secure services dialog popping up unexpectedly with the edit widget. Please follow progress here

http://forums.arcgis.com/threads/61828-Opening-Edit-Widget-causes-secure-service-challenge

SimonRoss_User

Simon, No, I don't have any particular reason for not using a proxy page. Can you point me in the direction of where I can find the walkthrough of the setup process? I did a search in the help section and I couldn't find it.

Thanks

Setup instructions are in the main API help here

http://help.arcgis.com/en/webapi/flex/help/index.html#/Using_the_proxy_page/017p0000000v000000/

After that you just need to make sure the proxy is referenced in your config.xml as described here

http://resources.arcgis.com/en/help/flex-viewer/concepts/index.html#/Using_a_proxy_page/01m30000000w000000/

JosephAccardi

Joseph,

Is there any particular reason you cannot set up a proxy page - it's a very straightforward process to do and the best way to keep the user credentials for the services hidden. The help files give a great walkthrough of the setup process - takes about 10 minutes!

Simon, No, I don't have any particular reason for not using a proxy page. Can you point me in the direction of where I can find the walkthrough of the setup process? I did a search in the help section and I couldn't find it.

Thanks

DasaPaddock

Also, the IdentityManager will not prompt the user for credentials if the server is not configured to use token based security.

HeatherGonzago

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

Normally you are prompted for the credential which generate the token needed to unlock the services. The user/pass information is
configured and stored by the administrator via Manager.

If you do not want your users to have to log in to access specific services, you may be able to control which users/roles have access
to what services through other means like Integrated Windows Authentication or even using a custom Security provider.

The first option works with the user/roles that are managed directly in MS Windows Active Directory server. This way you can take advantage
of the accounts already on your network. You would need to set up the permissions to your services based on these accounts. There is a
tutorial on this at http://resources.arcgis.com/en/help/main/10.1/index.html#/Securing_web_services_with_Integrated_Windows_Authentication/015400000517000000.

I would suggest taking a look at the 10.1 security section on the online resources Help section. They have a pretty good description of the
different options you can choose.

You may also want to ask some of these security-type questions on the main ArcGIS Server 10.1 -Windows or General discussion forum as well.

HTH,

SimonRoss_User

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

Joseph,

Is there any particular reason you cannot set up a proxy page - it's a very straightforward process to do and the best way to keep the user credentials for the services hidden. The help files give a great walkthrough of the setup process - takes about 10 minutes!

JosephAccardi

Hi Simon,
What you are trying to do is pretty common. Just to make sure that we have it correct:

1) You are accessing your Flex Viewer app via a asp login, I'm assuming you are using IIS authentication to access this?
2) You then are trying to work with some secure services. You do NOT want your users prompted for credential info correct?
3) You have a proxy page configured to point to these services with the servername and info passed in via the proxy config?
4) If all this is correct, the info in the proxy should provide the credential info without having to be prompted by the Identify Manager.

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

HeatherGonzago

Heather - that did the job! A couple of queries around that though - I ran that change on a version of the viewer code where I'd already made the additional references to IdentityManager.instance.enabled = false as documented previously in this discussion. If I understand correctly those modifications should no longer be required if it's picking up the proxy info correctly. Is that right? Secondly presumably this will be corrected in a future release of the compiled viewer?

Thanks for all your help
Best Regards

Simon

Excellent, I'm glad to hear it. As for your questions...You should not need those previous modifications you made. Go ahead and remove it and see how it goes. And for the second question, yes this has been marked as a bug and should be fixed shortly. I would keep an eye on GitHub where we keep the source and you can check for any recent check-ins.

Thanks for helping us troubleshoot this.

SimonRoss_User

Heather - that did the job! A couple of queries around that though - I ran that change on a version of the viewer code where I'd already made the additional references to IdentityManager.instance.enabled = false as documented previously in this discussion. If I understand correctly those modifications should no longer be required if it's picking up the proxy info correctly. Is that right? Secondly presumably this will be corrected in a future release of the compiled viewer?

Thanks for all your help
Best Regards

Simon

HeatherGonzago

SimonRoss_User

Thanks Heather - Happy 4th of July

HeatherGonzago

Hi Simon,
Just wanted to keep you updated. I'm still looking into this. Hopefully should have something soon.

Thanks

HeatherGonzago

Heather - here are the files. One other thing, which you may have guessed anyway, all access to our server is via SSL

Hi Simon,
Thanks. Let me get something set up on this end and see what I can figure out. I'll be in touch.

Heather

SimonRoss_User

Heather - here are the files. One other thing, which you may have guessed anyway, all access to our server is via SSL

Proxy.zip

HeatherGonzago

Heather,

Thanks for your response. We're already using the updated proxy.ashx page and been using it without issue with Flex Viewer 2.5. As you suggested I created a basic sample app and this accessed the secure service via the proxy credentials without issue. In answer to the detailed questions in your first post
1/ Yes
2/ Yes
3/ Yes - see previous post for setup of proxy.config
4/ I wish this were true!

Thanks a lot

Hi Simon,
Thanks for the update. This helps narrow things down. So it does sound like the proxy is working as it should using the updated proxy file since you can do it without any problems directly in an API sample. Let me see if we can try and repro it on our end here. If possible, could you attach the proxy.zip you are using (including the ashx and config files)?

Thanks.

SimonRoss_User

Heather,

Thanks for your response. We're already using the updated proxy.ashx page and been using it without issue with Flex Viewer 2.5. As you suggested I created a basic sample app and this accessed the secure service via the proxy credentials without issue. In answer to the detailed questions in your first post
1/ Yes
2/ Yes
3/ Yes - see previous post for setup of proxy.config
4/ I wish this were true!

Thanks a lot

HeatherGonzago

Hi Simon,
After looking at this further, I remembered others having issues (not just in the Flex API) using the proxy page with dynamic tokens. The actual proxy.ashx file needed to be updated to allow this. Could you try using this updated proxy page instead? See if it makes any difference. Let us know how this goes as this should be updated as well in any documentation.

Thanks,
Heather

DynamicTokenProxy.zip

HeatherGonzago

Hi Simon,
What you are trying to do is pretty common. Just to make sure that we have it correct:

1) You are accessing your Flex Viewer app via a asp login, I'm assuming you are using IIS authentication to access this?
2) You then are trying to work with some secure services. You do NOT want your users prompted for credential info correct?
3) You have a proxy page configured to point to these services with the servername and info passed in via the proxy config?
4) If all this is correct, the info in the proxy should provide the credential info without having to be prompted by the Identify Manager.

This makes me wonder if there is something else going on with the proxy configuration. In order to try and narrow this down, let's take the Flex Viewer completely out of the equation as it just adds more variables when troubleshooting.

Could you please try using something as basic as a sample web API sample and see if you can access your layers in that. I'm not sure exactly what type of layers you are working with but there are plenty of simple samples that you could copy/paste and change out the layer URL to that of yours. In addition to this, just make sure that you are also pointing to your proxy config file in the code. You would do this by setting the proxyURL property to the location of your proxy.ashx file.

For example

<esri:ArcGISDynamicMapServiceLayer url="https://ServerName/ArcGIS/rest/services/Secure/USASecured/MapServer" proxyURL="proxy.ashx" />

SimonRoss_User

File is attached

config.zip

Nimm an der Unterhaltung teil

Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registriere ein kostenloses Konto.

Schnellzugriffe

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.