hard code token based on referrer

Question

we have a client that uses a secured sharepoint site. 
They want to include a link to gis.ourJSapp.com from their secured sharepoint site.

So, anyone that comes to gis.ourJSapp.com from the sharepoint site has privs to access the app; they don't want to have to login again, which is the case right now.

Could anyone shed light on some server side code/concepts that would detect http referrer, then either hard-code token or not?

I've read through this thread and it's close...
http://forums.arcgis.com/threads/73298-Possible-to-hard-code-credentials

maybe a .php script before the current proxy.ashx?

JohnGravois · Answer

nice work! thanks for taking the time to outline the approach.

danbecker · Answer

Hopefully this helps someone in the future...

ended up using the 1st method; checking the referrer. If any referrer exists and the user doesn't have a good existing cred in storage, an esri.request is made to pass referrer to the proxy for handling. If all checks pass, return a token, which then gets stored as cred.

here's the js
var cred = "esri_jsapi_id_manager_data";
function init() {
 loadCredentials(); //see if cred. already exists for this session

esri.config.defaults.io.proxyUrl = "proxy.php";
 esri.config.defaults.io.alwaysUseProxy = false;

var process = function(ref) {

var def = new dojo.Deferred();

if (ref != "" && esri.id.credentials.length == 0) {

var refToken = esri.request({
    url : "https://gis.ourdomain/arcgis/", //any url that's proxied in proxy
    content : {
     ref : ref
    },
    handleAs : "json"
   });

function success(res) {
    var idObject, idJson;
    if (res.token != 'noToken') {
     var serverInfo = {
      "server" : "https://gis.ourdomain.com",
      "tokenServiceUrl" : "https://gis.ourdomain.com/arcgis/tokens/",
      "currentVersion" : 10.11
     };

var securedServices = [];
                                        //i guess this doesn't have to be a complete list
     securedServices.push("https://gis.ourdomain.com/arcgis/folder/MapServer/0");
     var creationTime = (new Date).getTime();
     var idString = dojo.toJson({
      "serverInfos" : [serverInfo],
      "credentials" : [{
       "userId" : 'auser', //user that was hard coded
       "server" : serverInfo.server,
       "token" : res.token,
       "expires" : res.expires,
       "ssl" : false,
       "creationTime" : creationTime,
       "resources" : securedServices
      }]
     });
     if (supports_local_storage()) {
      // use local storage
      window.localStorage.setItem(cred, idString);
      idJson = window.localStorage.getItem(cred);

} else {
      // use a cookie
      dojo.cookie(cred, idString, {
       expires : 1
      });
      idJson = dojo.cookie(cred);
     }
     if (idJson && idJson != "null" && idJson.length > 4) {
                                                //load the credential
      idObject = dojo.fromJson(idJson);
      esri.id.initialize(idObject);
     }
     def.callback("loaded");
    } 
                                else {
     def.callback("not loaded"); //proxy didn't return token for 1 reason or other
    }
   }

refToken.then(success);

} 
                else {
   def.callback("not loaded"); //no referrer or already logged in
  }
  return def;
 }

var ref = document.referrer;

process(ref).then(function(response) {
  //continue adding layers, ect...
 })
}

heres the pertinent parts of the proxy.php
$targetUrl = $_SERVER['QUERY_STRING'];
$parts = preg_split("/\?/", $targetUrl);
$targetPath = $parts[0];
  
$qStringArr = array();
parse_str($parts[1],$qStringArr);

// open the curl session
$session = curl_init();

if(array_key_exists('ref', $qStringArr) && $qStringArr['ref'] != ''){
   //esri.request call with referrer
   if($qStringArr['ref'] == 'https://theReferrer.com/imLookingFor.html'){
    $data = array(
   'username' => 'auser',
   'password' => 'auserpassword',
   'client' => 'ip', //for dev only, switch to http referr on production
   'ip' => '123.123.22.41',
   'expiration' => '60',
   'f' => 'json'
  );
  $postData = http_build_query($data);
  $targetUrl = "https://gis.ourdomain/arcgis/tokens/generateToken";
 }
 else{//referrer didnt match, return junk response
  echo json_encode(array('token'=>'noToken'));
  exit;
 }
}
else{
        //continue w/ normal proxy call
   $postData = file_get_contents("php://input");  
}
//omitted cURL options array
$response = curl_exec($session);
echo $response;

danbecker · Answer

all of the above auto assigning a token based on referrer is because we do not have control of the sharepoint site containing the link.

Another idea is to supply the client with a simple $.ajax call to obtain a token before leaving the sharepoint site, then include it in a query string to the JS app, which would then assign a credential using the ?token= from the qs. If the token's invalid, identityManager would challenge for username/pw.

users requesting the JS app not originating from the sharepoint site would obiv. not have a token in the qs.

this better then the referrer method?