topic Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application? in ArcGIS Online Questions

What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

AlexMahrou — Wed, 04 Feb 2015 23:10:00 GMT

I can't find a solid document on this, and Esri support was just trying to fill in the gaps....

I have an application that I configured through our web appbuilder for arcgis on our organization site. I have since downloaded the code and pasted the requisite json from the web app into the config.json on my web server at https://mywebserver/webapp

my proxy is located here: https://mywebserver/DotNet/proxy.ashx

I have registered the application and have a clientid, and secret on agol.

clientid: clientid123

appsecret: appsecret123

I can successfully browse to the application at https://mywebserver/webapp without the proxy and get prompted to enter my agol creds and it works. I just would like to remove the agol popup and enforce my own iis security. To do this I need a proper configuration in my proxy and in my json.config. Can someone use the variables that I quoted above and tell me what my <ProxyConfig> tags in my proxy.config file, and what my "httpProxy" section should look like in my config.json?

I think that's all I need. 😉

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

AlexMahrou — Thu, 05 Feb 2015 18:29:47 GMT

BUMP

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

ZhifangWang — Fri, 06 Feb 2015 03:35:05 GMT

Hi Alex,

The reason why you can see the agol popup(oAuth2 authentication dialog indeed) is because your webmap or some layers in the webmap is not shared to public. Otherwise no authentication dialog will appear.

To remove the oAuth2 authentication dialog, it means on every request to private resources in your deployed app(private webmap or private layers in webmap) have to come along with a valid token. This can be done by putting a proxy which has valid token in it in front of your deployed app, as long as the end users visit the deployed app through the proxy(indeed end users will not know the real url of the app), then no security challenge will occur to end user.

To achieve your goals, you need do following things:

In your proxy file, write server code to process all requests to the private resources. Specifically, identify all requests that need token, and concatenate valid token to those requests.
In your proxy file, write server code to refresh the token if it’s expired.
Put your own IIS security challenge before the proxy, which also needs some code.

By the way, you've mentioned proxy.config and <ProxyConfig> tags, I assume you're using the sample proxy file from esri’s github. This proxy file is just too simple for you to achieve above goals, more server code is needed.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

AlexMahrou — Fri, 06 Feb 2015 15:36:18 GMT

Zhifang,

My only need is to remove the first popup for the agol map item authentication. There are no subsequent popups as this resides on my web server within my domain and I am using web auth tier security for the services referenced within.

I am in disagreement that there is much code needed server side. Otherwise why would you be able to register an application so easily with Esri? All I need to know is the json code to put in the end of my applications config.json and the proxy.config settings that will utilize the following variables:

clientid, appsecret, url: https://mywebserver/webapp

My proxy is located here: https://mywebserver/DotNet/proxy.ashx

I've provided the variables, I wonder if someone knows the answer...

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

ZhifangWang — Tue, 10 Feb 2015 07:26:06 GMT

Hi Alex,

Registering an app in ArcGIS Online or Portal is mainly for oAuth2 authentication purpose, as soon as you got the Client ID and Client Secret, you have to exchange a valid token for your private resources by yourself. ArcGIS Online Authentication | ArcGIS for Developers

How the "proxy" part in config.json file works can be found here: Use proxy—Web AppBuilder for ArcGIS | ArcGIS. For your scenario, I think you have to write some server code in your proxy file to identify the requests to private resources and append valid token (it's your responsibility to get a valid token, also needs server code) to those requests at least. In "proxy" part of config.json file, you may want to set some rules to reduce the unnecessary request passing to your proxy.

Hope this helps.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

AlexMahrou — Tue, 10 Feb 2015 21:26:41 GMT

Thank you Zhifang, but my services are using Web Tier authentication (Not GIS Tier with Tokens), as I have mentioned in the first post. The application sits on my web server. Thus the only thing that I would need to remove is the ArcGIS item popup. I have looked at the use proxy link that you have provided. I was just curious what the code in the proxy config would look like given my variables. I guess you don't know that. 😉

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

KellyHutchins — Sat, 14 Feb 2015 02:46:32 GMT

Alex,

Are you using the .NET proxy from github? If so you'll find info on the various options for configuring your proxy in the readme.

resource-proxy/README.md at master · Esri/resource-proxy · GitHub

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

RyanStrain — Tue, 03 Mar 2015 17:19:20 GMT

I would also like a little more clarity on the tags required in the config.json and proxy if someone can provide it? Possibly an example of each showing application level authentication?

This is what I'm using and it's probably not correct-

proxy-

<serverUrl url="http://adacountyitgis.maps.arcgis.com/"

oauth2Endpoint="https://www.arcgis.com/sharing/oauth2"

clientId="*****************"

clientSecret="***********************************"

rateLimit="600"

rateLimitPeriod="60"

matchAll="true">

</serverUrl>

json-

"wabVersion":"1.1","isWebTier":false,"httpProxy":{"useProxy":true,"alwaysUseProxy":false,"url":"http://arcg.is/1vh66cC","rules":[{

"urlPrefix": "http://adacountyitgis.maps.arcgis.com/",

"proxyUrl": "http://mywebserver/proxy4/proxy.ashx"

}]},"appId":"************************"}

If anyone could tell me what is missing, what should be removed or changed, it would be appreciated.

Thanks,

Ryan

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MatthewCarey — Fri, 29 May 2015 20:52:30 GMT

Alex, I share your frustration, it seems like it should be fairly simple.

Would someone be able to answer whether the scenario below is possible, and if so, how with the minimum of fuss? (my apologies for the lousy presentation).

I have already achieved it *except* that a sign-in screen is popping up, and if all users are being forced to sign in, I might as well just send them straight to ArcGIS Online!

Btw the web server is not public-facing.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

AlexMahrou — Mon, 08 Jun 2015 20:23:48 GMT

Okay, my reply is long overdue. But I have reached resolution!

I attempted to follow the documentation for the DotNet proxy on GitHub by inspecting examples and also followed the instructions here : on the "Manage Apps" section on the docs.arcgis.com site

In actuality there are three workflows that I've found. Items one and two will necessitate a proxy if you are to utilize AGOL items and wish to employ your web server's security. Item three will not require a proxy, but might require you to keep the Web Appbuilder version in sync with the Github LocalLayer Widget. I also believe that item three will not have any 1's and 0's going to agol either during client sessions.

AGOL Web Appbuilder (download your code after configuration in AGOL). -- The example below
Developer Edition Web Appbuilder
Developer Edition Web Appbuilder with LocalLayer Widget : Bypassing AGOL Items

Here's the variables:

https://mysite.com/mywebapp
https://mysite.com/DotNet/proxy.ashx
https://myorg.maps.arcgis.com
clientID="1111111111111111"
clientSecret="22222222222222222222222222222222"

---------------------------------------------------------

1. The Proxy Config:

<?xml version="1.0" encoding="utf-8" ?>

<ProxyConfig allowedReferers="*"

mustMatch="true">

<serverUrl url="https://services.arcgisonline.com"

matchAll="true"/>

<serverUrl url="https://mysite.com"

matchAll="true"

<serverUrl url="https://myorg.maps.arcgis.com/"

clientId="1111111111111111"

clientSecret="22222222222222222222222222222222"

oauth2Endpoint="https://myorg.maps.arcgis.com/sharing/oauth2/"

rateLimit="600"

rateLimitPeriod="60"

matchAll="true">

</serverUrl>

</serverUrls>

</ProxyConfig>

--------------------------------------------------------------

2. The Json code to add at the end of your config.json

"httpProxy" : {

"useProxy" : true,

"url" : "https://mysite.com/DotNet/proxy.ashx",

"alwaysUseProxy" : false,

"rules" : [{

"urlPrefix" : "https://myorg.maps.arcgis.com/",

"proxyUrl" : "/DotNet/proxy.ashx"

}

]

}

-------------------------------------------------------------------------------------------------------------

3. The Requisite Configurable App Registration Information on AGOL

URL: https://mysite.com/mywebapp

API: JavaScript

App Type: browser

Purpose: Configurable

Redirect URI's: http://mysite.com, https://mysite.com

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MatthewCarey — Thu, 25 Jun 2015 16:06:58 GMT

Alex, thanks so much for writing this up so simply. I tried to use your process with my own web mapping application.

Unfortunately I'm still having the AGOL pop-up appear and ask for my credentials (there's a small generic message box, then when I click OK it takes me to a sign-in pop up page that's customized based on my AGOL organization) and I can't figure out why.

The application resides on my server which is only viewable inside my organization, and the AGOL web map it references is shared with the Organization.

I'm wondering if this is relevant - In the browser (Chrome) console, I see:

Any ideas how I might troubleshoot this? The proxy log seems to indicate that it's having success but nonetheless something is obviously mis-configured somewhere...

Thanks!

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

BillSpiking__GISP — Thu, 09 Jul 2015 12:05:07 GMT

Hi Matthew,

I'm getting the same results with the AGOL pop-up. Did you find away of getting this resolved?

Thank you,

Bill

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MatthewCarey — Thu, 09 Jul 2015 12:49:00 GMT

Hi Bill,

No, I'm afraid I didn't receive any responses so I've been dormant on this issue for a couple of weeks.

I thought I might have unique issues and everyone else is all set.

Are you seeing the same error messages by any chance?

I figure I'll try and reach out to Esri directly next, and will let you know if we figure it out.

Cheers,

Matt

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

BillSpiking__GISP — Thu, 09 Jul 2015 12:54:41 GMT

Yep, I'm seeing the same thing. I'll submit a help ticket as well and let you know what I find out.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MatthewCarey — Thu, 16 Jul 2015 16:26:23 GMT

It turns out that when I swapped out my hosted feature layer for a map service from my organization's ArcGIS Server that's only viewable internally in my AGOL webmap and saved it, it worked with no sign-in required!

So I didn't solve this precise issue but I think the workaround will work for me.

Hope this might help....

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MelanieHammond1 — Fri, 31 Jul 2015 13:44:47 GMT

I'm having the same issues and can't get it to work no matter what I try with the proxy and config. Did you hear anything from Esri?

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

MelanieHammond1 — Fri, 31 Jul 2015 21:04:10 GMT

I submitted a ticket to Esri and was told that basically a map on AGOL must be shared publically to prevent the AGOL sign in from popping up. Sure hope they are planning on allowing a map from Server soon or else the whole WAB becomes fairly useless to us. I'll update if I hear something different.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

C_EHoward — Wed, 30 Sep 2015 14:55:47 GMT

That is what i was told too but it seems if the proxy is configured right you have a web map and web app 'not shared' and still have it appear. After talking to the SDK people for a while yesterday, they concluded I could not use the proxy with a webapp builder app from AGOL. Yet as we see there are help pages for AGOL WAB that say use of a proxy is possible. After trial and error by myself, here is what I think works. I say 'think' because I have so many test maps and apps it is hard to keep them all straight!

My steps are as follows- using a web map that is not shared and a web app that is not shared (created with WAB on AGOL)

1. after cresting the web app, I downloaded that code and saved it to my web server to host the app there. The app now has a URL from my server nistead of having to use the AGOL URL.

2. Create an AGOL content item using the URL from my hosted app. created as a web mapping app, with app type = browser. I then registered it to get the appID

3. I added the appID to the config.json from the downloaded app. I had to change the text encoding to make it look nicer in notepad++

4. I added the proxy code at the end of the web app. I dont enough about javascript to know where you can/cannot add the code, but I do know you have to be mindful of the , and } and ] that each of the code elements use. So my copied code here will show how I added it after the last item in the original config.json

,"httpProxy": {

"useProxy": true,

"url": "", *** i did not need to add anything here although i have tried the proxy URL (below) as well as http://www.arcgis.com/sharing/rest, simply because that was an example i was given by support at some point

"alwaysUseProxy": false,

"rules": [{

"urlPrefix": "http://www.arcgis.com",

"proxyUrl": "http://mysite.com/dotnet/proxy.ashx"

}]

}}}}}}

I then go to my custom URL and am able to see the map, no log in required! I should mention that this is with map services that are secure, yet have the credentials saved. If I use the regular REST endpoint for my services, I still get a log in screen. So I would recommend saving credentials w/secure services (as an AGOL item) as not sharing the web map still requires credentials for map content and does not seem to be handled by the proxy (unless you put in the reference to your services in your proxy.config)

Anyway, I hope this helps someone else. After being told by support that this is, and then is not possible, I wound up figuring it out on my own. I really wish there was consistency in what support analysts told us. To do my job, I need to know how to use all products to produce a end result-- a web app that uses services, Server, MXDs, AGOL content, etc-- I need someone who can tell me how it work it all together. (OK rant over.... )

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

EmmanuelRosetti — Fri, 06 Nov 2015 23:21:09 GMT

Hi,

I also have a problem with the proxy and WAB. Here is my situation : I develop a widget that needs to access data from a mapservice hosted on my ArcGIS Server. I can't let this ressource unsecured so I have ArcGIS Users and Roles for that AGS and some of the roles have access to the service.

My application built with WAB needs to access those data without asking the user for credentials.

So I use the proxy to pass my parameters username and password in the proxy.config file but everytime I try to access (through the wab or directly in the browser) one of the services I registered through the proxy, I receive the ArcGIS Login Rest endpoint.

Isn't the proxy DotNet made by ESRI on github supposed to get the token by itself and proxy my request to the service and return the REST result?

Thanks for your help.

Re: What's the proper configuration for proxy.config and config.json for a self-hosted Web AppBuilder for ArcGIS Web Application?

RebeccaStrauch__GISP — Sun, 08 Nov 2015 09:59:52 GMT

Emmanuel, you may want to read thru Internal ONLY Web Map Sharing Issues for more related info on the proxy with WAB and local services.