topic Re: password protected WMS-service in ArcGIS API for Silverlight Questions

password protected WMS-service

ArneDahlman — Tue, 22 Feb 2011 09:55:00 GMT

We need to add a password protected WMS-service.
Any one know if this is possible?

I don't find anything on this in the API-documentation. Also, there is no 'Token' property in WmsLayer class.

Re: password protected WMS-service

DanielWalton — Tue, 22 Feb 2011 13:25:43 GMT

You'll probably have to download the source code for the WmsLayer from CodePlex and add the security features yourself.

Re: password protected WMS-service

ArneDahlman — Thu, 24 Feb 2011 07:13:24 GMT

Thank you for the suggestion. We will consider this as the last way to solve the problem.

Does anyone know if it's possible to get arund this problem by republish the service via ArcGisServer?
I mean, make a mxd, add the WMS as a layer, publish it on ArcGisServer.

If anyone from ESRI is following this:
I am working for a Swedish agency.
A number of Swedish agencies and authorities have an agreement of geodata exchange, in accordance with the EC-directive, Inspire. OGC standards, I belive, is a key strategy.
So I think this issue will soon be wery important.

Re: password protected WMS-service

DanielWalton — Thu, 24 Feb 2011 11:36:33 GMT

Actually adapting the WmsLayer class would probably be easier than some other (more elegant) solutions. I doubt that republishing via MXD will work, since that would effectively disable the security on the WMS (I'm not sure about this, though). There are a number of ways to accomplish what you're asking for, but I think the best way would be to use a single authorization and authentication method to access both the WMS and ArcGis data.

One possible way to to this is to create a proxy handler for the WMS which would handle the security requirements, and secure access to this proxy with your normal method.

We (the forum users) could help with some suggestions if you could post some information about how the WMS is secured (simple password sent in each request, token-based, etc.) and how your Silverlight viewer and ArcGis data are secured.

Re: password protected WMS-service

DaveRabrun — Sat, 11 Dec 2021 23:28:04 GMT

I'm currently dealing with a similar situation. I'm attempting to access a secured wms layer.

I tried the below:


private void  LayerWithCredentials(ESRI.ArcGIS.Client.Toolkit.DataSources.WmsLayer layer)

{

    WebClient wmsRequest= new WebClient();

    wmsRequest.DownloadStringCompleted += (sender, args) =>

    {

        map.Layers.Insert(0, layer);

    };

    ICredentials creds = new NetworkCredential("username", "password");

    wmsRequest.Credentials = creds;

    wmsRequest.UseDefaultCredentials = true;

    wmsRequest.DownloadStringAsync(new Uri(layer.Url));

}

but the credentials aren't passed through.

Re: password protected WMS-service

JenniferNery — Sun, 12 Dec 2021 16:36:15 GMT

You need to supply Credentials to the WMS layer before it gets initialized or added to the map control.

          <esri:WmsLayer ID="AGSWMSLayer" 
                     Credentials="{StaticResource MyCredentials}"                               
                     Url="http://secured/MapServer/WMSServer"          
                     Initialized="WmsLayer_Initialized"/>

How do you secure the WMS service? Do you have Anonymous Authentication Disabled and either Basic or Windows Authentication Enabled? Also, can you check with Fiddler, if the web request to WMS server is followed by a 401-challenge?

Re: password protected WMS-service

ArneDahlman — Tue, 01 Mar 2011 11:02:13 GMT

Hi, thanks for the responses.

I don't see the Credentials property in the WmsLayer class.
I use version 2.1.0.446 of ESRI.ArcGIS.Client.Toolkit.DataSources.
Jennifer, what version are you using?

I ran a GetCapapilities request through my browser and checked the requests in fiddler and got the following sequence:

1. GetCapabilities request -> 407 Response
Here I get prompted for user and password.

2. GetCapabilities request -> 407 Response

3. GetCapabilities request -> 401 Response

4. GetCapabilities request -> 200 Response (and my result)
In this last request i se "Authorization: Basic" in the header.

Is this what you mean by a "401-challenge"?

The Silverlight viewer i develop is an internal application for local users on the lan only.
So far, there is no security on the local Services.
The WMS-service is on the internet, and is hosted by another athority.

Re: password protected WMS-service

DaveRabrun — Sat, 11 Dec 2021 23:28:07 GMT

In the source code there is an #if directive that blocks the credentials propery for Silverlight. So I'm guessing they were only intending it to work with WPF.

#if !SILVERLIGHT
        private System.Net.ICredentials credentials;
        /// <summary>
        /// Gets or sets the network credentials that are sent to the host and used to authenticate the request.
        /// </summary>
        /// <value>The credentials used for authentication.</value>
        public System.Net.ICredentials Credentials
        {
            get { return credentials; }
            set
            {
                if (credentials != value)
                {
                    credentials = value;
                    OnPropertyChanged("Credentials");
                }
            }
        }
#endif

Re: password protected WMS-service

JenniferNery — Tue, 01 Mar 2011 15:44:07 GMT

Yes, that is correct. Credentials property is only for WPF because client authentication is handled by the browser in Silverlight.

Do you use a Proxy? I think you need to include the username and password in the proxy.config

    

<serverItem url="http://kml-samples.googlecode.com/svn/trunk"
matchAll="true" domain="mydomain" username="myusername" password="mypassword" />

Also when you define Authentication on the Proxy website, make sure that Anonymous Authentication is Disabled and either Basic or Windows Authentication enabled.

Re: password protected WMS-service

ArneDahlman — Wed, 02 Mar 2011 13:47:42 GMT

I guess you mean something like the SLProxyPage from the documentation.

I tried to use the SLProxyPage from the documentation, http://help.arcgis.com/en/webapi/silverlight/help/SLProxyPage.zip

I can't get it to work. I have tried both using it directly from visual studio and also deploying it as a web site on our IIS.
If I configure it for basic authentication, I get prompted for user/password, but this is only for our IIS, not the server hosting the WMS-service.
The proxy.config seems to be ignored in this case.

Maybe SLProxyPage only supports token-based authentication?

I have read the documentation
http://help.arcgis.com/en/webapi/silverlight/help/index.html#/Secure_services/016600000022000000/

and I belive that it's the section "HTTP/Windows authentication" that applies here.

Then the solution seems to be to develop a new IHttpHandler or pherhaps to modify SLProxyPage.

Any other ideas?

Re: password protected WMS-service

JenniferNery — Wed, 02 Mar 2011 18:53:45 GMT

Yup that SLProxyPage. You can modify this item with your server URL and credentials you need to authenticate against.

<serverItem url="http://net931/ArcGIS/rest/services"
matchAll="true" domain="net931" username="rex" password="rex" />

Drop the ProxyPage folder to your C:\inetpub\wwwroot

In your IIS Manager, you can convert this folder to application and under IIS Authentication, disable Anonymous Authentication and enable either Basic or Windows Authentication.

Re: password protected WMS-service

ArneDahlman — Thu, 03 Mar 2011 07:48:02 GMT

Thanks for your reply.

I think there might be some misunderstanding here.

I have a Silverlight application hosted on server A.
From this application I want to use a WMS-service hosted on server B. Server B is on the Internet.
I don't have access to server B, other than the user/password for this service.

I tried to deploy SLProxyPage on server A, with the settings you suggest.
When I run my application I get prompted for user/password (here I used Basic Authentication in IIS-manager). The only user/password that seems to be accepted here, is one for server A. Then after a while I get a 500 response (using fiddler).
If I instead configure IIS to use Integrated Windows Authentication, I don't get prompted for user/password, but the result is the same (500 response).

So I think that this will only work if SLProxyPage is deployed on server B.
Can this be correct?

Re: password protected WMS-service

ArneDahlman — Fri, 04 Mar 2011 09:19:59 GMT

OK, now I think I solved this.

I made some code changes in SLProxyPage.

There where three main problems:
1. Only working with ArcGIS server typeof URLs.
2. No support for internet proxy
3. Failed to download images with no content-length in response.

After I have completed the changes and run some tests. I'll add the modified SLProxyPage to this thread, in case some one is interested.

Re: password protected WMS-service

JenniferNery — Fri, 04 Mar 2011 16:17:51 GMT

That is good to know. I'm interested to see the updates you made to SLProxyPage too. 🙂

Re: password protected WMS-service

ArneDahlman — Tue, 08 Mar 2011 08:14:59 GMT

Here is the code.

It's possible to configure internetproxy in proxy.config
If no proxy is configured default is used.

The url handling can be improved further, (Search for "url_401 = url.Substring(0, url.IndexOf("Server") + 6)")