IdentityManager gets bad tokens

BrianRassier

We're using IdentityManager to access secure ArcGIS Online services.  About 50% of the time this works as expected:
a) We access the service
b) A "499 Token Required" response is obtained
c) IdentityManager triggers a token request
d) The token is appended on the original request
e) Service access is granted

However, the other 50% of the time we get a series of "403 You do not have permissions to use this resource" errors.  These happen in response to step d) above.  Then a new token is requested, and we continue looping through this process until we successfully get to the service.

Occasinally it takes 2-4 token requests before we finally get access to the service.  The troublesome part is, sometimes we seem to get in a loop that never ends.  We've seen 20-30 failed requests before we kill our app.  This has happened a few times today alone.

Anyone seen this?  Any insight into why it's happening?

DominiqueBroux

Without setting the referrer, there are always 2 token requests when obtaining a token.  The first fails saying Referrer must be specified.  Then IdentityManager must recognize that and it adds Client=requestip, which gets the token.

That's normal. If there is no default referer, we first try to generate a token without any option i.e a short lived token. But arcgis.com doesn't support short lived token yet. So we catch the error and try to generate a token for the current IP.

However, it does fail 25-50% of the time on that second request too.

Interesting. I never observed this case. Might be due to your firewall config and an arcgis.Com change I never noticed.
Anyway, it's a good practice to use a referer with OnPremise and OnLine portals in order to avoid issues.

With the referrer set, we only get 1 token request, because the first request has client=referrer and referrer=arcgis.com in the request. I tried 20+ times and I never got the failure I've been seeing, so this seems very promising.

Great 🙂

What is the recommended value for referrer since this isn't a web-based application we're using? I didn't get a solid feel for that based on the API documentation.

With the WPF API (unlike Silverlight and WinPhone API) you can use the referrer you want (e.g your application name).
Once a token has been generated for a specific referer, the Identity Manager will automatically add the referrer as header of the requests that need the token (you should be able to observe that with fiddler).

Hope this helps.