automatic re-authentication after 60 minutes does not re-request user roles

TorNielsen — Wed, 27 Mar 2024 12:37:19 GMT

We have installed AGS Server with SecMgr NEXT un-federated.

We do now have a complete prototype (AGS + SecMgr NEXT SOI + UserInfoService + LDAP emulator) up running and working.

By chance (leaving AGS map services open in a Chrome browser (user logged on via HTTP Basic - no activity) for hours) we observed via our logs the following behavior:

Start a Chrome TAB with a secured map service. (no AGS-token)
HTTP Basic authentication is triggered.

This involves two LDAP requests:
1. Is user a valid user?
2. Get user’s entitlement roles.

Subsequently, the user gets to see the main map service page.
The user then activated the “ArcGIS Online Map Viewer”
This triggers a second HTTP Basic authentication.
Finally, the user is presented with the map view and he/she can now freely manipulate the map with no additional authentication requests.
The user completes his map view tasks but leaves the map viewer open!
After ~60 minutes AGS server re-authenticates automatically via LDAP! However, AGS does not re-request the user’s roles! (The user’s roles could have changed anytime within the previous 60 minutes))
After another ~60 minutes the very same pattern is repeated.

This behavior raises two issues:

A user can basically stay logged on forever (or until AGS gets restarted).
Changes to the user’s entitlements will never be detected as long as he/she remains logged on.

topic automatic re-authentication after 60 minutes does not re-request user roles in ArcGIS Enterprise Questions

automatic re-authentication after 60 minutes does not re-request user roles