topic Re: Register ArcGIS Server token with IdentityManager in ArcGIS JavaScript Maps SDK Questions

Register ArcGIS Server token with IdentityManager

deleted-user-RAnWn8DDSd1P — Tue, 13 Jan 2015 21:54:59 GMT

We have a protected ArcGIS Online webmap which references some of our protected ArcGIS Server services on-premise. I'm trying to bypass both challenges for credentials with IdentityManager. Server-side I fetch an oauth2 token from ArcGIS Online with client_id and client_secret and a token from our on-premise ArcGIS Server with username and password. I've been successful using the following to register the oauth2 token:

var agolToken = {

'server': 'http://www.arcgis.com/sharing/rest',

'userId': 'user',

'token': '<fetched ArcGIS Online oauth2 access_token>',

'ssl': true,

'expires': <fetched ArcGIS Online oauth2 expires_in>

};

esriIdentityManager.registerToken(agolToken);

esriArcgisUtils.createMap('<protected ArcGIS Online webmap id>',...

How do I register the ArcGIS Server token with IdentityManager such that every subsequent request, tile or otherwise, will append the token?

I was able to interrupt some requests with esri.setRequestPreCallback and add the token to ioArgs.url, but the tile requests do not seem to filter through there.

Re: Register ArcGIS Server token with IdentityManager

DavidBlanchard — Sat, 11 Dec 2021 13:58:52 GMT

Unfortunately, there isn't an easy way to just pass a token and let JavaScript do the rest of the work. The Identity Manager is meant to process the authentication.

You need to use the initialize method of the Identity Manager, passing it the Identity Manager properties which look like:

{
    "serverInfos": [
        {
            "server": "https://myserver.com",
            "tokenServiceUrl": "https://myserver.com/arcgis/tokens/",
            "adminTokenServiceUrl": "https://myserver.com/arcgis/admin/generateToken",
            "shortLivedTokenValidity": 60,
            "currentVersion": 10.3,
            "hasServer": true
        }
    ],
    "oAuthInfos": [],
    "credentials": [
        {
            "userId": "username",
            "server": "https://avl.esri.ca:8013",
            "token": "e1jf-6cd-a2whk5_3h4ZWKnCxd1LyVy_eMLsuvxxPd3.",
            "expires": 1421264556065,
            "validity": 60,
            "ssl": false,
            "creationTime": 1421260956120,
            "scope": "server",
            "resources": [
                "https://myserver.com/arcgis/rest/services"
            ]
        }
    ]
}

This object can be tricky to build, but most of the info can be obtained from the token request and combining it with the information available from the server information query: http://myserver.com/arcgis/rest/info?f=json

Re: Register ArcGIS Server token with IdentityManager

JeffPace — Sat, 11 Dec 2021 13:58:54 GMT

we do this with tokens

var idObject ={};
                                idObject.serverInfos= [serverInfo];
                                var credentials={};
                                credentials.userId = "util";
                                credentials.server = window.location.protocol+'//'+window.location.hostname+'/arcgis03';
                                credentials.token = tokenInfo.token;
                                credentials.expires = expirationTime;
                                credentials.ssl = false;
                                credentials.scope = "server";
                                credentials.validity = 720;
                                credentials.creationTime = creationTime;
                                
                                
                                idObject.credentials = [credentials];
                               //credential object is correct
                                esri.id.initialize(idObject);
                                esri.id.tokenValidity=720;

Re: Register ArcGIS Server token with IdentityManager

deleted-user-RAnWn8DDSd1P — Wed, 14 Jan 2015 20:04:44 GMT

Indeed combining server info and credentials and using esri.id.initialize() worked! Much appreciated Jeff and David

Re: Register ArcGIS Server token with IdentityManager

deleted-user-RAnWn8DDSd1P — Thu, 15 Jan 2015 15:08:38 GMT

So, I just noticed that after the ArcGIS Server token goes invalid, the console just errors "Invalid Token". In the documentation for IdentityManager there's mention of a timer that automatically refreshes the token. Can this be done automatically with a particular setting in the credential object?

Re: Register ArcGIS Server token with IdentityManager

JeffPace — Sat, 11 Dec 2021 13:58:57 GMT

setInterval(lang.hitch(this, function () {
                                    var def = esri.id.generateToken(serverInfo, {"username": "util", "password": "<>"});


                                def.addCallback(lang.hitch(this, function (tokenInfo) {
                                   
  //var idBase = new IdentityManagerBase();
        //get token creation time in epoch
                                var creationTime = (new Date).getTime();
                                                //calculate the token expiration based on short lived token validity
                                var expirationTime = creationTime + (serverInfo.shortLivedTokenValidity * 60000);
                              // alert(creationTime+":"+expirationTime)
                                                //create array of secured services
                                // create a new javascript Date object based on the timestamp
                                // multiplied by 1000 so that the argument is in milliseconds, not seconds
                                         
                                 
                                var idObject ={};
                                idObject.serverInfos= [serverInfo];
                                var credentials={};
                                credentials.userId = "util";
                                credentials.server = window.location.protocol+'//'+window.location.hostname+'/arcgis03';
                                credentials.token = tokenInfo.token;
                                credentials.expires = expirationTime;
                                credentials.ssl = false;
                                credentials.scope = "server";
                                credentials.validity = 720;
                                credentials.creationTime = creationTime;
                               
                               
                                idObject.credentials = [credentials];
                              //credential object is correct
                                esri.id.initialize(idObject);
                                esri.id.tokenValidity=720;

                                }));
                               }, 3000000));

Re: Register ArcGIS Server token with IdentityManager

deleted-user-RAnWn8DDSd1P — Thu, 15 Jan 2015 17:08:58 GMT

I fetch the token server-side so username/password is not discoverable on the client. The way the documentation reads I thought that given there was currently valid token, IdentityManager could use it to fetch a new one when the period was nearing its end. I could just set a meta refresh less than the token validity period I suppose.

Re: Register ArcGIS Server token with IdentityManager

KellyHutchins — Thu, 15 Jan 2015 17:50:22 GMT

Have you thought about setting up and using a proxy? It will handle getting and refreshing the token for you. The proxy source and instructions for setting up the proxy can be found here: Esri/resource-proxy · GitHub

Re: Register ArcGIS Server token with IdentityManager

JonMorris2 — Thu, 20 Aug 2015 15:34:30 GMT

So, having called initialize, a token is supposed to be appended to every service call? That isn't happening for me.

I've tried various ways of calling initialize and it seems to work ok, but when I load a map service in the next line, I get a credential popup.

mapLayer0 = new ArcGISDynamicMapServiceLayer(serviceURL);

The developer console shows Error: Token Required, with the call stack leading way down into init.js.

Re: Register ArcGIS Server token with IdentityManager

BhavinSanghani — Wed, 25 Jan 2017 20:28:36 GMT

Hi Aaron,

Did this approach work for you further? I implemented following way but IdentityManager tries to refresh token periodically.

I have an enterprise application where I have 600+ screens. In that only 4-5 gis screens. Whenever I connect secure gis map service from gis screen then:

- Generate token from server side and pass it to client side

- Initialize credentials and serverInfos in IdentityManager.initialize() method.

- Start the task with lesser than shortLivedTokenValidity (available at http://<arcgisserver>/rest/info resource) and re-initialize identity manager with the new token.

- This works fine and loads the map.

- Once I leave the GIS screen then I need to stop the task that I initiated as it has no use.

- At this point there is an issue. IdentityManager is monitoring based for token expiry. Once it's expired then it tries to refresh the token. Since it doesn't find credentials (as password is not passed to client side), it opens up the popup.

- Let's say if I destroy the credentials while leaving (using esriId.destroyCredentials()) and revisit the GIS screen then also it opens up the popup because it has been initialized with esri.id.

Did you fall in the same situation? How could you resolve it? Wondering if I can destroy esri.id somehow while leaving the GIS screen. Tried to do esri.id = null but no success. Still the popup opens up when I revisit the screen.

jeff.pace / khutchins-esristaff / dblanchardesri-ca-esridist - any suggestions? I cannot work with proxy as I need to set credentials for each user.

Re: Register ArcGIS Server token with IdentityManager

DavidBlanchard — Sat, 11 Dec 2021 13:59:00 GMT

Hi Bhavin,

I would suggest generating a token with a longer life if you can. This is by far the easiest way to go about keeping a custom "session" active.

However, if you absolutely must keep the solution running beyond the lifespan of a token that you manually added, then read-on. Please note however that this is a hack and is not supported. I make no warranty of fitness or completeness of any kind, express or implied; proceed at your own risk.

The first thing to understand is that the token is stored in multiple places, all of which are maintained by the Identity Manager. Tokens are stored in the Identity Manager for new layers, and is stored in each layer for use in new queries. This is in addition to any tasks (e.g. QueryTask) that you have setup. If you want to continue using the map after the token has expired, you will need to supply a new token to these objects. Otherwise, attempting to update any existing layers or add a new layer will cause a login popup to show up.

Secondly, the Identity Manager will automatically attempt to refresh your token once it expires through a timer.

The code below applies to the 2.x API.

Updating the Identity Manager's Token

You can access the token, expires, and creationTime properties of your credentials to update them. An example is shown below:

//Loop through the credentials array
IdentityManager.credentials.forEach(function(creds, i) {
  //Look for the server whos credentials you want to update
  if (creds.server === myServer) {
    //Update the credentials
    //(result would be your token object previously obtained)
    IdentityManager.credentials[i].token = result.token;
    IdentityManager.credentials[i].expires = result.expires;
    IdentityManager.credentials[i].creationTime = result.creationTime;
  }
});‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Cancel the automated refresh of the credentials

Each credential item in the Identity Manager has a timeout which will trigger a token refresh upon expiration. Below is an example of how to cancel this timer.

//Loop through the credentials array
IdentityManager.credentials.forEach(function(creds, i) {
  //Ensure the credentials are for my server
  if (creds.server === myServer) {
    //Cancel the timer
    clearTimeout(creds._refreshTimer);
  }
});‍‍‍‍‍‍‍‍

Update tokens in layers

Updating the Identity Manager does not update the layers (and tasks), so you have to do that manually.

//Retrieve the layer object
var layer = map.getLayer("myLayerID");

//Update the layer's credentials
//(result is the previously obtained token)
layer.credential.token = result.token;
layer.credentials.expires = result.expires;
layer.credentials.creationTime = result.creationTime;‍‍‍‍‍‍‍‍

Re: Register ArcGIS Server token with IdentityManager

BhavinSanghani — Fri, 27 Jan 2017 21:38:08 GMT

Hi David,

Thanks for the detailed explanation on this. I tested the code you suggested under "Cancel the automated refresh of the credentials" and it worked for my flow!

Re: Register ArcGIS Server token with IdentityManager

AdrianMarsden — Thu, 25 Apr 2019 14:59:44 GMT

Sorry for hijacking thread, but I'm trying to do what David said would be the better option "generating a token with a longer life if you can" - I want to only ask the users for ID once, ever, well, in practice once a decade (see https://community.esri.com/thread/225898-identity-manager-ask-once-a-decade-for-username)

I have put a very long "expires" in, and my "IdString" that gets sent to the Identity Manager is

{"serverInfos":[{"server":"https://mymaps.com/arcgis","tokenServiceUrl":"https:/maymaps.com/arcgis/tokens/","adminTokenServiceUrl":"https://mymaps.com/arcgis/admin/generateToken","shortLivedTokenValidity":10080,"currentVersion":10.31,"hasServer":true}],"oAuthInfos":[],"credentials":[{"userId":"myname","server":"https://mymaps.com/arcgis","token":"BOiXMC8EfP36sEMIOXs18HwjcEnRy0n1qPeIA4ukkuo.","expires":1735689600000,"validity":5256000,"ssl":false,"creationTime":1556203552770,"scope":"server","resources":["https://mymaps.com/arcgis/rest/services/LIVEinternal/EH_tasks/MapServer"]}]}‍

But it still "forgets" by the next day.

Any ideas?

Cheers

ACM