idea Remove "Share with Everyone" requirement when publishing WFS and WMS in ArcGIS Enterprise Ideas

Remove "Share with Everyone" requirement when publishing WFS and WMS

AndrewStearns1 — Thu, 25 Jul 2019 18:57:18 GMT

We have a need to publish some Features and Maps as Web Feature Services (WFS) and Web Map Services (WMS). Currently there is a requirement when publishing WFS that it has to be shared will all. We never publish and share to all due to data security concerns.

https://enterprise.arcgis.com/en/portal/latest/use/publish-wfs.htm

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

KoryKramer — Sat, 03 Aug 2019 12:52:11 GMT

Have you looked at Securing WFS Services?

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

KoryKramer — Mon, 05 Aug 2019 17:32:56 GMT

We've marked this Idea as Reviewed but I wanted to provide some further background after looking into this further.

There had been a bug logged for this previously: https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDA5NTkzOQ== See the Additional Information section there.

So it looks like we're waiting for the OGC spec to support OAuth2.

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

AndrewStearns1 — Mon, 05 Aug 2019 18:17:52 GMT

Thanks for the follow up and links Kory!

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

Geoeki — Wed, 28 Oct 2020 10:02:35 GMT

Any news on this Kory Kramer‌? Did OGC implemented OAuth2 support by now? Thanks!

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

KoryKramer — Wed, 28 Oct 2020 19:21:27 GMT

This is what I see when I look at the support issue linked to above. See the Additional Information section.

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

Marc_Graham — Tue, 26 Nov 2024 00:17:50 GMT

Hi @KoryKramer ,

According to this bug: https://support.esri.com/en-us/bug/secured-open-geospatial-consortium-ogc-services-from-ar-bug-000095939 security for OGC services is available.

The ability to secure OGC services is present within ArcGIS Enterprise. Refer to, https://enterprise.arcgis.com/en/server/latest/publish-services/windows/ogc-support-in-arcgis-server.htm#GUID-6F8F0594-02D0-4962-B8C3-945CE13635E7.

However it appears to be limited and not include SAML/OpenID as per https://enterprise.arcgis.com/en/server/11.3/publish-services/windows/ogc-support-in-arcgis-server.htm#GUID-6F8F0594-02D0-4962-B8C3-945CE13635E7 :

Services that are expected to be accessed through OGC interfaces should be secured using HTTP Basic, HTTP Digest, or Integrated Windows Authentication.

Additionally, in a fresh 11.3 ArcGIS Enterprise deployment, signed in as the primary site administrator I get a 499 error on the Sample World Cities WMS and OGC Feature layers as described here: https://support.esri.com/en-us/knowledge-base/error-499-error-occurred-while-processing-request-000017300

This is resolved when sharing all the layers publicly.

Can you please confirm the exact sharing/security settings that work with OGC layers. In addition please enhance the error reporting to explain if a layer needs to be shared in a specific way to work, so the user doesn't have to google html response codes.

Thanks, Marc

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

JeffSmith — Fri, 06 Dec 2024 00:00:55 GMT

Hi @Marc_Graham,

A couple of thoughts on this. If you want to secure an OGC layer, the recommended way is to publish it to an ArcGIS Server that is not federated with a Portal. In addition, this ArcGIS Server needs to be configured with web-tier authentication (Basic, Digest, IWA, or client-certificate auth). When an OGC client tries to access the layer, they will be prompted to enter credentials (or provide a client certificate) prior to gaining access. This should work.

The problem with other configurations (Server federated with Portal or Server configured with non-web-tier authentication) is it utilizes token-based authentication and most OGC clients do not know how to handle that. The 499 response code that is returned when trying to access a secured OGC layer is only understood by ArcGIS clients. There is not a comparable response code that I'm aware of that indicates to an OGC client that an OAuth2 access token needs to be generated and used to access the OGC layer.

There are a few OGC clients that can handle generating and sending an access token (QGIS and FME are two I can think of), but it is not part of the OGC spec so I don't think there are many others. This is why we document that OGC layers need to be open and shared with everyone or secured with web-tier authentication to be accessible.

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

Marc_Graham — Fri, 06 Dec 2024 00:05:34 GMT

Hi @JeffSmith ,

Thanks for that additional insight.

Perhaps in this documentation

you could specifically call out that the server should not be federated with Portal.

Thanks,
Marc

Re: Remove "Share with Everyone" requirement when publishing WFS and WMS

JeffSmith — Fri, 06 Dec 2024 00:41:40 GMT

@Marc_Graham - That's a good suggestion. I'll try to get that updated.