topic Re: Token Security on an ArcGIS Server (Javascript) in ArcGIS JavaScript Maps SDK Questions

Token Security on an ArcGIS Server (Javascript)

GrahamWhelan — Wed, 29 Jun 2011 08:26:40 GMT

Hello

I have a javascript application that connects to an ArcGIS server and does some functionality with the feature services. Today we added token based security to the rest end point which means I can no longer access it without the appropriate login details.

Can anyone provide a code example in javascript or point me in the direction of an example, of how to get a token using login details and store it/use it for a defined period of time. I cant find anything on the resource center.

Thanks in advance.

Graham

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Sat, 11 Dec 2021 16:19:05 GMT

you can use a proxy page. Here you can set your period of time ect.

I have attached an example of proxy modified for call dynamic token in proxy page
In method gettokens you can change your rules


public string GetToken(string uri)
    {
        foreach (ServerUrl su in serverUrls)
        {
            if (su.MatchAll && uri.StartsWith(su.Url, StringComparison.InvariantCultureIgnoreCase) && su.DynamicToken)
            {
                // Code to dynamically get the token
                string tokenService = string.Format("https://{0}/arcgis/tokens?request=getToken&username={1}&password={2}&expiration=30", su.Host, su.UserName, su.Password);
                string token;
                
                
                // This script is added to force the application to certify the SSL script (if for example you have a self certificate on server)
                System.Net.ServicePointManager.ServerCertificateValidationCallback += delegate(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certificate, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
                {
                    return true;
                };
                
                
                
                System.Net.WebRequest tokenRequest = System.Net.WebRequest.Create(tokenService);
                System.Net.WebResponse tokenResponse = tokenRequest.GetResponse();
                System.IO.Stream responseStream = tokenResponse.GetResponseStream();
                System.IO.StreamReader readStream = new System.IO.StreamReader(responseStream);
                token = readStream.ReadToEnd();

                return token;
            }
            else if (su.MatchAll && uri.StartsWith(su.Url, StringComparison.InvariantCultureIgnoreCase)) 
            {
                return su.Token;
            }
            else
            {
                if (String.Compare(uri, su.Url, StringComparison.InvariantCultureIgnoreCase) == 0)
                    return su.Token;
            }
        }

        if (mustMatch)
            throw new InvalidOperationException();

        return string.Empty;
    }

Re: Token Security on an ArcGIS Server (Javascript)

GrahamWhelan — Sat, 11 Dec 2021 16:19:08 GMT

Hi Domenico

Thanks for the response. I tried your code and a few other similar examples but i keep getting a 403 error when the proxy tries to access the service.

For the config im using

    
<serverUrl url ="https://212.147.136.135/ArcGIS/rest/services/DoEHLG/ACTIVITIES/FeatureServer"
               matchAll="true"
               dynamicToken="true"
               host="https://localhost/imds/"
               userName="USERNAME"
               password="PASSWORD">
    </serverUrl>

I'm obviously doing something wrong somewhere is the config code correct?

A snippet from the htm.

esriConfig.defaults.io.alwaysUseProxy = true;

featureLayer = new esri.layers.FeatureLayer("https://212.147.136.135/ArcGIS/rest/services/DoEHLG/ACTIVITIES/FeatureServer/0", {
                    mode: esri.layers.FeatureLayer.MODE_SNAPSHOT,
                    outFields: ["*"],
                    id: "featureLayer"
                });

And this is the error that appears after the request is denied/times out

  
Error: Unable to load proxy.ashx?https://212.147.136.135/ArcGIS/rest/services/DoEHLG/ACTIVITIES/FeatureServer/0/query status:403
http://serverapi.arcgisonline.com/jsapi/arcgis/?v=2.3
Line 14

Thanks again

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Sat, 11 Dec 2021 16:19:11 GMT

remove the web.config. I have attached for error.... You need only proxy.ashx and proxy.config.

Have you service token on https? tokenService = string.Format("https://...

In property host of proxy.config you set "localhost" and not "https://localhost/imds/" : if you see in gettoken string tokenService = string.Format("https://{0}/arcgis/tokens? ... -> {0} is hostname (Server where there is token service).

Have you in mapping of the application proxy ashx enabled? (you can see http://msdn.microsoft.com/en-us/library/bya7fh0a.aspx)

Extra info:
-If your instance is <> 'arcgis' change here in method gettoken the name. string tokenService = string.Format("https://{0}/<nameofinstanceags>/tokens?

-if you have certificate from third parties (verisign, geotrust, geosign, godaddy ect.) you also can remove this block of code because is yet in trust list:

 // This script is added to force the application to certify the SSL script (if for example you have a self certificate on server)
                System.Net.ServicePointManager.ServerCertificateValidationCallback += delegate(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certificate, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
                {
                    return true;
                };

or set your check for accept certificate in this delegate. In this case with return true accept the certificate.

Re: Token Security on an ArcGIS Server (Javascript)

GrahamWhelan — Fri, 01 Jul 2011 14:38:14 GMT

That worked great. Thanks a lot for your help Domenico.

Re: Token Security on an ArcGIS Server (Javascript)

VIKRANTKRISHNA — Thu, 16 Feb 2012 18:56:58 GMT

I am having the same issue, where trying to access the rest service page through proxy.ashx is getting error out saying error 403 Access denied to the proxy page

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Sun, 19 Feb 2012 09:25:28 GMT

vikrant, can you give me further details?

Re: Token Security on an ArcGIS Server (Javascript)

VIKRANTKRISHNA — Tue, 21 Feb 2012 13:37:26 GMT

Hi Domenico,
When ever I am trying to go to rest service through the proxy page and with https connection, its giving 403 error. For example my syntax is

https://wsbv7/proxy/proxy.ashx?https://wsbv7/WebGIS/rest/services

its will give me the error, but when I try http (non ssl) connection, it does not return any error. The problem going to be is that when we try to get token for the service, we have to use the https connection, which doesn't work.

Any thoughts?

Thanks,

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Sat, 11 Dec 2021 16:19:14 GMT

in proxy.config have you set:

  <serverUrl url ="https://wsbv7/WebGIS/rest/services..."

Perahps you have

<serverUrl url ="http://wsbv7/WebGIS/rest/services..."

Re: Token Security on an ArcGIS Server (Javascript)

VIKRANTKRISHNA — Tue, 21 Feb 2012 17:03:33 GMT

I tired that to, but that doesn't work either.

after adding the given line on config file , I tried this
http://wsbv7/proxy/proxy.ashx?https://wsbv7/WebGIS/tokens?request=getToken&username=Vikrant&password=vik

this again gives 403 error. I am not sure if this is related to our IIS settings or something in our server.

Even trying to access secured service on esri server (given on esri token based security demo sample), through proxy page using the given username and password (rick and rick@esri) doesn't work either.

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Tue, 21 Feb 2012 17:18:06 GMT

Open in visual studio the application where there is your proxy and you try go in debug

Re: Token Security on an ArcGIS Server (Javascript)

VIKRANTKRISHNA — Tue, 21 Feb 2012 17:35:31 GMT

I got an error when I debug the proxy.ashx

error message screenshot is attached.

Re: Token Security on an ArcGIS Server (Javascript)

nicogis — Thu, 23 Feb 2012 05:58:47 GMT

when you go in debug you provide a url after http://.../proxy.ashx -> http://.../proxy.ashx?http://yourrequest

Re: Token Security on an ArcGIS Server (Javascript)

BrettGreenfield__DNR_ — Thu, 30 Aug 2012 14:51:49 GMT

I got an error when I debug the proxy.ashx

error message screenshot is attached.

Were you ever able to solve this issue? I get the same thing when I try to access http://localhost/proxy/proxy.ashx, and anytime I try to access a service through the proxy page I get an error 403.

Re: Token Security on an ArcGIS Server (Javascript)

JohnGravois — Thu, 30 Aug 2012 15:39:14 GMT

are you working with the sample ASP.NET proxy from the Javascript resource center? if you haven't already, please try setting the global flag "mustMatch" to false to see whether you can forward traffic to a standard webpage directly from the browser.

ie:
http://localhost/proxy/proxy.ashx?http://esri.com

Re: Token Security on an ArcGIS Server (Javascript)

BrettGreenfield__DNR_ — Thu, 30 Aug 2012 16:35:49 GMT

Yep - that's the one I'm using. I tried setting mustMatch to false and I'm still unable to connect to anything.

When I try to connect directly to localhost/proxy/proxy.ashx I get the same error page that vikrant327 posted. I tried turning debugging on and it gave me the error message in the attached screenshot.

[ATTACH=CONFIG]17381[/ATTACH]

I'm guessing I'm just doing something stupid here!

Re: Token Security on an ArcGIS Server (Javascript)

JohnGravois — Thu, 30 Aug 2012 16:38:18 GMT

its normal to see an error when you try to access the proxy without attempting to forward a url, but you should definitely be able to forward traffic if you aren't restricting sites.

did you convert the proxy folder to an application in IIS?

Re: Token Security on an ArcGIS Server (Javascript)

BrettGreenfield__DNR_ — Thu, 30 Aug 2012 16:46:39 GMT

I did, and just to be sure I tried doing so again. One thing I'm noticing this time, when I click Convert to Application and try the "Test Settings" button, I get an error that says "Invalid Application Path", even though the physical path is pointing directly to C:\inetpub\wwwroot\proxy.

I apologize if these are dumb questions - I'm really out of my element working with this stuff!

Re: Token Security on an ArcGIS Server (Javascript)

JohnGravois — Thu, 30 Aug 2012 17:00:00 GMT

i just did a quick test and it seems that an "invalid application path" error when converting an application is normal for working proxies as well.

in IIS manager, do you have handler mappings for .ashx files?

Re: Token Security on an ArcGIS Server (Javascript)

BrettGreenfield__DNR_ — Thu, 30 Aug 2012 17:14:37 GMT

I have three of them - SimpleHandlerFactory - Integrated; SimpleHandlerFactory-ISAPI-2.0; and SimpleHandlerFactory-ISAPI-2.0-64.