Adding Map Service to WAB

[StevenCathcart]

I published a map service from ArcMap to my company's Server. I added this service to AGOL account. Next, I created a web map in AGOL that displays the symbolized map service. However, when I choose this web map in the App Builder, it does not display. The App Builder will load for a few seconds, then display only the basemap.

I've been able to successfully use a feature service in this way (add it to a Web Map and reference the web map in the App Builder), but I can't seem to do this for a map service. Is this possible with Map Services, or is this only for feature services?

[PaulDavidson1]

Robert:

I have a very similar issue to Steven.

I'm surprised more folks don't....

Our data is confidential and needs to remain behind our firewalls.

I have added our REST endpoints as map layers to my content.

And created an AGOL webmap that displays the data fine.

I've shared it with certain internal groups and with the organization as a whole.

The data is not running on a secure server because it was not setup that way originally

(I've inherited the setups....)  ArcServer 10.1

The web map works fine. No identity login needed because it's open in our intranet.

When I pull the webmap into WAB, like Steven, I only see the AGOL basemap.  The Layer List is empty.

This must have something to do with the firewall setup and WAB not understanding that it's inside the firewall with permission.

For example, when I work from home, if I pull up the webmap and forget to VPN in first, I see nothing on the map but the AGOL layers, like in WAB here at work.  But when I VPN in, then the layers appear.

Which of course is exactly what I expect

I guess I should try running this from home via VPN and see if that somehow fools it into working...

I am currently working on getting the LocalLayer widget working....

[AdamJoseph1]

you can install cartview to serve out webmap id behind your firewall without having to leave your local network

here is the tutorial Cartoview webmapid

[RaynerHoward]

Robert,

So if I have map services secured using ArcGIS Server security, there is no way to have them show up in Web AppBuilder at all?  No way to prompt the user for the AGS credentials using an Identity Manager window popup?

[RobertScheitlin__GISP]

Rayner,

   No you can use secure services in WAB.

I have services that are secured using ArcGIS Server security and when I add them to a web map they work fine after the Identity Manager popups up to to challenge for user name and password.

[RaynerHoward]

Robert,

The Identity Manager doesn't pop up to challenge me for my AGS username and password from within Web AppBuilder.  It does when I access the same web map from within AGOL but not from WAB.  I haven't installed the developer edition of Web AppBuilder - everything is pretty much fresh out of the box at his point.  Any advice as to how to get this Identity Manager popup window working?  Not sure if this has anything to do with it, but I recently got an SSL Certificate and 'installed' it as recommended by ESRI.

Thanks very much for your help.

[RaynerHoward]

Robert,

Sorry, meant to say that the Identity Manger prompts me for my AGS username/password when I'm viewing the web map from within portal (running on my AGS Server).  But it doesn't prompt me from within WAB.

I'm sharing the web map from within portal, then clicking "Make a Web Application".  It's shared to everyone.  Then I click the Web AppBuilder tab.  It doesn't load any of my secured AGS map services while authoring the Web app, or after I save it and try to access it.

[RobertScheitlin__GISP]

Rayner,

   So there are some setting in your AGOL org account to check.

Go to your AGOL account and choose the "My Organization" tab and then edit settings and security tab.

What is your " Allow access to the organization through HTTPS only." and "Allow anonymous access to your organization's website" set to?

[MichaelRobb]

not sure why that would have anything to do with it but perhaps you can explain.

I have come across the same issue where I'd grab a zip WAB built item, throw it in IIS, all works great when using the EXTERNAL https URL from within the server, the Identity window pops up when a Secure service is hit, fill in the credentials and on your way, exactly as expected.

BUT when you hit IIS externally on a separate machine (https)... the map never prompts the user for credentials, it waits... then loads without the secure services.

Organization SSL only is checked.

I never found a fix.  Suspect is REDIRECTS are required to maintain HTTPS throughout external transaction or a combination of various configurations / settings / proxy.

[JunshanLiu]

I think maybe this is caused by distrustful certificate. Please check whether the https request is over a proxy.

If it's over proxy, this may be caused by your IIS server doesn't trust the external web server's certificate. You need to configure your IIS server to make it trust the certificate.

If it's not over proxy, this may be caused by your browser doesn't trust the external web server's certificate. You need to open the external URL directly in your web browser with https URL and make your browser trust the certificate.

Hope this helps.

[MichaelRobb]

Hi there!

I do not think it is 'distrustful' certs due to the following: (but not 100% sure yet...)

I can manually log into a 'distrusted' tab to arcgis server, obtain token, then the web application builder sees the secure services when accessing external.  the cert is only a validation, you can still allow the browser to continue. I am not worried about that part or concerned.

so, since the browser obtained the token from arcgis server, the WEB MAP in portal works as expected... allowing the Identity dialog to appear because of the secure mapping service.

the Web APP does NOT!  (note the difference, web MAP and web APP)

This is all BEFORE even downloading the 'code' from portal of the web APP to add to IIS.

This works: I CAN add ActiveDirectory users to the ArcGIS Server using 'windows authentication', then enable windows Auth in IIS, then rather than the pretty dialog, it uses the browser sign in popup... but IT really didnt like creating Users for the server itself, when it could be contained in ArcGIS Server alone (built-in).

I am in the process of applying for a EV Cert (which is a pain I must say...)

JavaScript API talks about this here: ags_secureservices.html | Guide | ArcGIS API for JavaScript

'To use the Identity Manager simply add the esri/IdentityManager module to your application.'  Is this missing from web app builder?

OR... am i just missing 'something'

I cant be the only one adding secure services to a WAB application, extracting and adding to IIS.

Note: I DO NOT want to use Portal OAuth to mitigate. 

The attachment is a WEB MAP, external, using 'distrustful'... and there it is! Exactly what I want and expect ... but never shows up in Web App Builder... web app builder has Empty Layer list and never challenges.  Thus, the application put in IIS also has empty layer list.

No proxy.

What is Interesting is that I am not able to add a secure service to ArcGIS Online Web Map either, unless i obtain the token from ArcGIS Server in a separate tab (so the browser now has it... at which point I would get the prompt as seen above in Online Web Map but the credentials would fail.

what does this mean? 

should I not have 6443 https enabled on server?   Not through web adaptor 443?

the mandate is to have https all around.  Perhaps it IS the cert...

Fiddler is not offering much for troubleshooting...