topic Re: store credentials in AGOL, access in Collector in ArcGIS Collector Questions

store credentials in AGOL, access in Collector

danbecker — Thu, 15 Jan 2015 21:52:27 GMT

Very simple question, I would like to know if anyone has success taking a webmap offline in Collect that contains a feature service with stored credentials?

1. publish a feature service on your 10.2.2+ server, make sure to enable Sync in the feature service capabilities.

2. secure it with "traditional" GIS-tier authentication (ArcGIS Server built-in username/password) that uses tokens

3. Login to your organizational ArcGIS.com account

4. In 1 of the folders under "my content", click add item / from the web

5. Enter the REST endpoint URL to your feature service, then hit Tab key

6. Enter valid credentials to access the service

7. make sure to select "Store credentials with service item. Do not prompt for authentication"

8. Enter name, tags, ect... then Add Item

9. If login box pops up, enter valid service credentials again.

10. Add this item to a new webmap and save webmap as TEST

11. Share both the feature service item and webmap with a group or your orginization

12. Login to your organization using Collector for ArcGIS

13. click the cloud download button on the TEST webmap you saved in step #10

During the map download in Collector, do you get an error? My testing says YES.

Why? Because you have credentials stored with the item you added to ArcGIS Online.

Follow exact same workflow, but this time, on step #7 select "Do not store credentials with service item. Prompt for authentication everytime."

During the map download in Collector, do you get an error? My testing says NO. Because credentials are not stored with the feature service item.

Re: store credentials in AGOL, access in Collector

RussRoberts — Thu, 15 Jan 2015 22:14:57 GMT

Are you seeing this on iOS or Android? Have you looked at the server debug logs to see if anything is showing up there?

Thanks

Russ

Re: store credentials in AGOL, access in Collector

danbecker — Thu, 15 Jan 2015 22:25:49 GMT

nothing in arcgis server logs.

Yes, this is happening on both iOS and android collector apps.

Going a step backward, there is a way to "test" if the secured service will work in Collector, prior to adding the service item to a webmap.

In the above workflow, right after step #9, you will be at the item details page, that summarizes the service item you just added to ArcGIS Online. At the top of the page, just to the right of the thumbnail image, click on the "Feature Service" hyperlink.

If you get Error 403 you do not have permission, then this feature service layer WILL NOT be downloadable in Collector. Conversely, if you are properly redirected to the Feature Service REST endpoint page, then the service layer WILL be downloadable in Collector.

Again, the behavior of the Error 403 page, and subsequently not being able to download the layer in Collector are BOTH related to storing credentials with the layer when adding it to ArcGIS Online.

This bug, or lack of documentation is causing us issues. All field crews have to remember, both their ArcGIS Server AND ArcGIS Online credentials. Not to mention the fact you're continually typing in credentials every time you try and access the secured service.

Re: store credentials in AGOL, access in Collector

RussRoberts — Thu, 15 Jan 2015 22:58:49 GMT

I tested this out with my 10.2.2 server with Collector Android 10.2.7 using the owner of the item to download the layer and then an account of a user that has access to the item through a group and both were able to download the service with no errors.

When you are adding the layer as a proxied item in AGOL you need to use the top level of the service and not the individual layer level. This is what it should look like:

http://servername.esri.com/arcgis/rest/securedfsname/FeatureServer

If you create the proxied item with the URL for the individual layer like /FeatureServer/0 when any app tries to access the Create Replica capability the app cannot gain access because the proxied item only exposes the layer level of the service to app and not the top level.

Russ

Re: store credentials in AGOL, access in Collector

danbecker — Fri, 16 Jan 2015 00:02:08 GMT

So you added a secured feat. Service and stored credentials, then downloaded map in collector?

Can you msg me, I will give you my rest URL and credentials to try.

I have been trying with the top level URL, copied directly from browser.

I also reprpduced the feature service link displaying 403 error when I used esri's sample server6, but since that service wasn't sync enabled couldn't test collector download.

Re: store credentials in AGOL, access in Collector

RussRoberts — Fri, 16 Jan 2015 16:54:44 GMT

sent you a GeoNet msg.

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 19:35:07 GMT

We are dealing with this exact issue. What was the correct solution Russell Roberts

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 19:41:49 GMT

unfortunately, I can still report that we are continuing to have this problem after the Collector 10.3 update.

I was told by an ESRI tech. that the problem was that our SSL cert installed on our GIS Server was NOT in the list of trusted CA's on the AGOL server. The tech. gave me the names of 2 SSL providers that he knew were trusted, so we purchased a SSL cert. from one of them and installed it.

The new SSL cert. and 10.3 release of collector did not solve the problem.

I called/emailed ESRI tech. support and asked that the case be re-opened for eval. and am awaiting their response.

I added a feat. service with credentials stored --> result in failed to download map in Collector.

I added the same feat. service with NO stored credentials --> result in successful map download in Collector.

Both server and Collector are version 10.3

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 19:45:28 GMT

Is your server federated with Portal?

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 19:48:57 GMT

No federated server.

We secure our services using using ArcGIS Server built-in users/roles.

We do not use Portal for ArcGIS. We are using ArcGIS Online Organization account as our portal.

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 19:52:00 GMT

Have you explored adding tokens you generate to the service URL?

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 19:56:29 GMT

no, mainly due to security risk. The token would expire anyway, prompting for re-auth via credentials box, which would be the same as not storing credentials.

It would be easiest to install on-premis portal and federate our server, but then we'd have to buy 20+ named user accounts as federating renders the unlimited usernames possible on server...useless.

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 20:47:54 GMT

unless you have workgroup level licenses then you are bound to 10 Portal users even if you wanna buy them.

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 21:12:47 GMT

Do you require HTTPS for all AGOL traffic? Not trying to pry just trying to figure this out

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 21:18:04 GMT

we have server standard workgroup

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 21:20:44 GMT

yes.

arcgis server administrator page: protocol - HTTPS only

Re: store credentials in AGOL, access in Collector

DanielSmith — Wed, 15 Apr 2015 22:21:01 GMT

and in AGOL too? just trying to figure out if its a security chain issue by chance.

Seems to be an issue with how AGOL is requesting the tokens. agree?

If i may, what did Russell Roberts have to say outside of the thread? Just trying to get all the info i can about the issue to communicate it to my higher ups.

Re: store credentials in AGOL, access in Collector

RussRoberts — Wed, 15 Apr 2015 22:35:43 GMT

If you are trying to take a layer offline coming from your internal server with embedded credentials you need to have the URL for the service at the top level and not for the individual layer. Sample: Points/FeatureServer is what should be used - not Points/FeatureServer/0. If you have the second option being used in the item then the app cannot call create replica and it will fail to download.

Hope this helps you out.

Russ

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 22:44:26 GMT

Yes, I've been correctly adding the services in AGOL. I always add them without /0 regardless of if I store credentials or not.

If no credentials stored the replica is successfully created and all is well. Stored credentials doesn't work.

Re: store credentials in AGOL, access in Collector

danbecker — Wed, 15 Apr 2015 22:48:31 GMT

I think AGOL can req. Tokens fine, it works when creds. Aren't stored.

I think its cert. Related or in the way AGOL used or accesses the creds.

Do you by chance have a wildcard cert? I.e. *.yourdomain.com in the CN field??