topic Re: Service security with HTTP basic authentication in ArcGIS Enterprise Questions

Service security with HTTP basic authentication

albertvalls — Mon, 18 Jun 2012 07:55:39 GMT

Is it possible to configure AGS 10.1 to use http basic authentication to secure services???

We have set up the security to "ArcGIS Server Built-in" at:
    http://localhost:6080/arcgis/manager/security.html
but after securing a service, seems that the only way to access it is with tokens.

Case 1: http://localhost:6080/arcgis/admin/security/config with:
    -Authentication tier: GIS_SERVER
    -Authentication mode: ARCGIS_TOKEN
    RESULT: A WMS query to one of this services returns an error code 499, both accessing it directly to port 6080 or with java web adaptor at 8080, or with iis adaptor.

Case 2: http://localhost:6080/arcgis/admin/security/config with:
    -Authentication tier: WEB_ADAPTOR
    -Authentication mode: WEB_ADAPTOR_AUTHENTICATION
    RESULT: A WMS query to one of this services returns an error code 403, both accessing it directly to port 6080 or with java web adaptor at 8080, or with iis adaptor.

Is still possible to secure services with http basic authentication like it was on 10 or 9.3.1 ???
If I set authentication to WEB_ADAPTOR, should I do some extra configurations at iis adaptor or java adaptor???

thanks,

Re: Service security with HTTP basic authentication

CarlosLacerda — Fri, 24 Oct 2014 19:40:35 GMT

Hi Albert, I have a question that is exactly the same as you describre here.

I´m trying exact the same as you. Secure a service and use HTTP Basic Auth as mechanism, I already passed by the same cenarios that you describe above. Have you solved this issue ?

thank you,

Carlos

Re: Service security with HTTP basic authentication

ChrisAdams — Wed, 17 Dec 2014 16:44:13 GMT

ArcGIS Server 10.1+ does work with basic authentication. I have just tested this and works fine. Remember to put in domain\username when prompted for credentials. However, please be aware that the credentials are encoded with Base64 encoding which is essentially sending the passwords in plain text. You should always perform this method of authentication over HTTPS.