nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

token based security and 10.1 printing gp service

Drew

Has anyone successfully produced a print when using a secured service?

I am getting the following error..


Error executing tool.: Layer "ArcGISDynamicMapServiceLayer405": Unable to connect to map server at    [...Web map URL with token written here......] Failed to execute (ExportWebMap). Failed to execute (Export Web Map)

Is there something I need to configure?

Drew

Find more posts tagged with

Accepted answers

All comments

LanceGosby

The bug that Drew mentioned applies to me. We are on 10.1. Here is what I've got and how I got around it.

I have a map service and a custom print service within a secured folder. I am able to print the map if I print the entire dynamic map service. I can even set the visibleLayers property to hide some layers. As soon as I try to print an individual feature layer from this map, it doesn't work. I have tried the exact same thing on an unsecured map service and it works as expected.

I wanted to print an individual feature layer so I could set the selectionObjectIds property in my webmap JSON to highlight a particular feature. As a work around, I added a graphics layer to the webmap JSON. I grabbed the selected feature's geometry and used that to define the graphics layer.

We can't upgrade beyond 10.1 just yet. Hopefully this helps someone.

NigelDsouza

This helped thanks .

DrewDowling

Here is the esri source code

Esri/resource-proxy · GitHub

download your preferred language and then install as a web app on oyur web server.

Next play around with the proxy.config settings until they are right for your environment. e.g.

<ProxyConfig allowedReferers="*"
             mustMatch="false">
    <serverUrls>
        <!--<serverUrl url="http://services.arcgisonline.com"
                   matchAll="true"/>-->
    
      <serverUrl url="http://MyWebServer:6080/arcgis/rest/services"

        username="MyID"
        password="MyPass"
        rateLimit="600"
        rateLimitPeriod="60"
        matchAll="true">
      </serverUrl>
    </serverUrls>
</ProxyConfig>

You might need to/probably should lock down what is available through the proxy. There are instructions on how to do this in the readme.txt

XiaowenHuang

I have the exact same issue with print task in javascript API. Could you let me know how do you setup proxy for print service? Thanks!

DrewDowling

Hi Drew,

What do you mean by : "using a proxy page instead of using a token directly "?
I use a proxy too in order to avoid typing the user & password but I cannot print any map with secured layers.
Have you succeeded?

Thanks,
Miri

I set up a proxy page using the esri proxy page code sample found on github. I then added both the print service and the secured map service to my flex app making sure to point the .Proxy property of each service to the proxy page I had just set up. This enabled me to remove the .Token property from the map service. When I did this the print task worked.

FYI more info on the bug here

MiriEshel

Hi Drew,

What do you mean by : "using a proxy page instead of using a token directly "?
I use a proxy too in order to avoid typing the user & password but I cannot print any map with secured layers.
Have you succeeded?

Thanks,
Miri

DrewDowling

AM
savaadaisu

Thanks for you input. I eventually went with using a proxy page instead of using a token directly and this solved my problems. Hope this helps others.

UldisGitendorfs

Hi!
I know there are some months gone since the last answer, but I would like to give my five cents in this.
ArcGIS 10.2.1 printing secure services everything is just like in Help - http://resources.arcgis.com/en/help/main/10.1/index.html#//0154000005q3000000
but some things to mention is - when creating connection in ArcCatalog you should write ArcGIS Server url to web adaptor not that with the 6080 port. Of course if you are using Web adaptor.
And one other thing - PrintService should run in Synchronous mode and for WebApp the url for print task should be taken from rest directory.

All I mentioned above were those thingies giving errors in my project.

DrewDowling

Adding my experience with this in case it helps anyone or anyone knows of a workaround

running ArcGIS Server 10.1
Flexview app using a secured dynamic service.
Unsecured print service

When a long lived token for the dynamic layer is added to the flex viewer config.xml the print service does not work. Error message is: Error executing tool.: Layer "Map Features": Unable to connect to map server at http://<server>:6080/arcgis/rest/services/Secured/FIRM/MapServer?token=KrGwxThrMRtL-K9O6kCnJggy1qSe3EAdyTCMtIxsPFxto6eSj..........

When no token is added to the config file and a user is forced to log in when the app loads then printing occurs normally.

HeatherGonzago

After further testing, the problem with printing secure feature layers (NOT the dynamic service itself) from a secured print task appears to also occur in 10.2. This has been logged as NIM094431.

Thanks.

weeyeo

I found out if you try to print Feature Layer on 10.1, it won't print it too. So upgrade to 10.2 will help solve this problem? My temporary solution is removed Feature Layer before send it to print.

Thank you.

HeatherGonzago

Not sure if the problem is only occuring when trying to print the individual feature layer from the print task? If so, than that does appear to be an issue with 10.1. I cannot reproduce it using 10.2. It is not specific to Flex but rather on the server-end itself.

DasaPaddock

I am not using long term token and just asked ESRI support for this problem.
You mentioned this on your previous post "If this is not an option for you, you could call PrintParameters.toJSON() and then remove the token from the url in the JSON. You'd then need to use a Geoprocessor to call your print service with the modified JSON"

Can you show me how do you get the code to work on print task widget? I would like to give this a try too.

Really appreciate your help.

Thanks.

If you're using short term tokens, like the ones generated by IdentityManager, then you don't need to remove them from the URLs in the print JSON. Short term tokens are not restricted to an IP or referer so they should work when passed through the print service.

weeyeo

I am not using long term token and just asked ESRI support for this problem.
You mentioned this on your previous post "If this is not an option for you, you could call PrintParameters.toJSON() and then remove the token from the url in the JSON. You'd then need to use a Geoprocessor to call your print service with the modified JSON"

Can you show me how do you get the code to work on print task widget? I would like to give this a try too.

Really appreciate your help.

Thanks.

DasaPaddock

Thanks for replying my thread. At least I am not the only one having this problem now. Would you please keep me update if you able to get it to works. I really appreciated that. Do you think have to do anything on the proxy file too? I run all my secured map services on 10.1 and everything is working find except the printTask. I also run a esri high-quality printing simple code (https://developers.arcgis.com/en/flex/sample-code/printtask.htm) then change url & secure gp sevices to my own services and get the same message. Really spending alot of time on it and didn't find any documents or ways from ESRI team. Just wonder is it a PrintTask bug on 10.1 or not many people using this function at all?

Are you using long term tokens (tokens that are restricted to an ip or referer)? If not, then you probably need a different solution. You may need to work with Esri Support.

DasaPaddock

- send via HTTP and POST using the REST API because there is no PrintParamaters.fromJSON yet 🙂

You can use a Geoprocessor for this step. That's actually what the PrintTask uses:

_gp.execute(printParameters.toJSON(), responder);

MayJeff

Samething on ArcGIS Flex viewer and Application builder on Print Widget.

weeyeo

Thanks for replying my thread. At least I am not the only one having this problem now. Would you please keep me update if you able to get it to works. I really appreciated that. Do you think have to do anything on the proxy file too? I run all my secured map services on 10.1 and everything is working find except the printTask. I also run a esri high-quality printing simple code (https://developers.arcgis.com/en/flex/sample-code/printtask.htm) then change url & secure gp sevices to my own services and get the same message. Really spending alot of time on it and didn't find any documents or ways from ESRI team. Just wonder is it a PrintTask bug on 10.1 or not many people using this function at all?

MayJeff

Drew

Can you show me how do you write a code to perform this task? I had created a new secured print service for my gp service. Thank you.

wyoe -> It's funny your asking this because I am finally just returning to the issue. I tried a few months back but I dropped it because bigger things fell onto my plate.

Just yesterday I came back and started work on it again (due to a urgent need)

Anyways.. its not the most simple process. I am finding It only works when the service references port 6080 and not port 80 and the service has no token..

So my plan is ..... (not yet implemented)

- convert PrintParameters to JSON
- find and replace all ?token= ABC
- find and replace domain.com with domain:6080.com
- send via HTTP and POST using the REST API because there is no PrintParamaters.fromJSON yet 🙂

This is my plan, it might change if i find issues.

Drew

weeyeo

Can you show me how do you write a code to perform this task? I had created a new secured print service for my gp service. Thank you.

Howeitzer_1-1634649869370.png

DasaPaddock

When the print service makes its request to the url with the token, it doesn't send a referer header. Can you use a short term token that's not restricted to ip or referer?

That's how the tokens are generated by the IdentityManager.

If this is not an option for you, you could call PrintParameters.toJSON() and then remove the token from the url in the JSON. You'd then need to use a Geoprocessor to call your print service with the modified JSON. You'd also need to follow these instructions to set up your print service with the credentials for the secure service.
http://resources.arcgis.com/en/help/main/10.1/#/Printing_maps_that_contain_secured_services/0154000005q3000000/

Drew

How is the token being generated? Is it restricted by referer or ip address?

It is restricted by HTTP Referer.

DasaPaddock

How is the token being generated? Is it restricted by referer or ip address?

Drew

* BUMP *

I am trying to use the print task and am getting the quoted error when using a secured service.
Has anyone successfully printed a secured service?

Drew

Has anyone successfully produced a print when using a secured service?

I am getting the following error..
Error executing tool.: Layer "ArcGISDynamicMapServiceLayer405": Unable to connect to map server at    [...Web map URL with token written here......] Failed to execute (ExportWebMap). Failed to execute (Export Web Map)
Is there something I need to configure?

Drew

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.