topic Re: Help with OAuth in .NET Maps SDK Questions

Help with OAuth

BrianBulla1 — Wed, 04 Oct 2023 18:30:49 GMT

Hi,

I'm just starting with the Maps SDK today, so sorry in advance for the stupid questions. 🙂

So I'm trying to do something that I think should be super simple, but I cannot for the life of me get it to work. I'm using the DisplayAMap sample, changing the portal item to one under my AGOL account, and trying to display it. The missing componenet is the OAuth, since I'll need to enter a username/password to get to the webmap.

I'm looking at the "Secutrity" samples in the .NET WPF app, but don't quite understand how to integrate it into what I already have working in the DisplayAMap Sample.

There seems to be this "ArcGISLoginPrompt.cs" file, that doesn't display the code for in the app. I'm guessing that's an important part of it??

Sorry for the cryptic question....I just have no clue what to even ask.

Re: Help with OAuth

JoeHershman — Wed, 04 Oct 2023 22:49:00 GMT

A little more detail about what you issues are, platform. The security sample in github are hard to follow because they use shared code, better to follow in the sample explanation on the site.

Re: Help with OAuth

BrianBulla1 — Tue, 10 Oct 2023 16:38:18 GMT

Hi @JoeHershman .

So basically what I have done is trying to combine the Display A Map tutorial and the Oath 2.0 tutorial found here (https://developers.arcgis.com/net/tutorials/) and get it to work with a secured webmap in my own AGOL account.

I can get it to build with no errors, but nothing is showing up in the WPF form. It's just a blank map.

Not quite sure how to troubleshoot it.

Re: Help with OAuth

BrianBulla1 — Tue, 10 Oct 2023 17:32:42 GMT

It seems to be stalling at this line, where the web map is getting created. It never gets to the point where it asks for the username/password for AGOL.

Re: Help with OAuth

JoeHershman — Wed, 11 Oct 2023 12:49:43 GMT

Hard to know what you have gotten done.

Have you setup the OAuth app inside of ArcGIS Online? This is discussed in the sample Authenticate with OAuth
1. You can do through dev account if you are using AGOL tied to dev account Register an OAuth application
2. Do on AGOL, this is a bit old so there are slight GUI changes How to Implement OAuth 2.0 for ArcGIS
You need to implement the IOAuthAuthorizeHandler. See at bottom
Wire up everything. This is done before you can make a call that will open the OAuth window. AppClientID, ClientSecret, RedirectUrl all come from the OAuth app in AGOL (or dev center)

private void Initialize(Uri serverUri) { try { var redirectUri = new Uri(RedirectUrl); ServerInfo serverInfo = new ServerInfo(serverUri) { TokenAuthenticationType = TokenAuthenticationType.OAuthAuthorizationCode, OAuthClientInfo = new OAuthClientInfo(AppClientId, redirectUri) { UserInterfaceStyle = UserInterfaceStyle.Dark, ClientSecret = ClientSecret, }, }; AuthenticationManager.Current.RegisterServer(serverInfo); AuthenticationManager.Current.OAuthAuthorizeHandler = _oAuthAuthorizeHandler; AuthenticationManager.Current.ChallengeHandler = new ChallengeHandler(CreateCredentialAsync); } catch (Exception e) { _log?.Log(e.Message, Category.Exception, Priority.None); } } private async Task<Credential> CreateCredentialAsync(CredentialRequestInfo info) { try { Credential credential = null; try { if (info.ServiceUri != null) { var options = new GenerateTokenOptions { TokenExpirationInterval = TimeSpan.FromDays(1) }; credential = await AuthenticationManager.Current.GenerateCredentialAsync(info.ServiceUri, options); AuthenticationManager.Current.AddCredential(credential); ConnectionStatus = ConnectionStatus.Connected; } } catch (OperationCanceledException) { ConnectionStatus = ConnectionStatus.NotConnected; // Login was cancelled, no need to display an error to the user. } catch (Exception e) { _log.Log(e.Message, Category.Warn, Priority.None); } return credential; } catch (Exception) { return null; } }

One annoying with the API is that connecting to Portal does not automatically trigger the the challenge handler. So you have to have the code in the method that connects to portal that, imo, should only be in ChallengeHandler

public async Task<ArcGISPortal> OpenPortalAsync(string portalUrl, bool refresh = false) { var sharingUri = GetSharingUri(portalUrl); //THIS LINE SHOULD OPEN WINDOW! var credential = await AuthenticationManager.Current.GenerateCredentialAsync(sharingUri); AuthenticationManager.Current.AddCredential(credential); _portal = await ArcGISPortal.CreateAsync(sharingUri); PortalUser = _portal.User; return _portal; } private Uri GetSharingUri(string portalUrl) { return new Uri($"{portalUrl}/sharing/rest"); }

IOAuthAuthorizeHandler implementation from esri sample:

// In a desktop (WPF) app, an IOAuthAuthorizeHandler component is used to handle some of the OAuth details. Specifically, it // implements AuthorizeAsync to show the login UI (generated by the server that hosts secure content) in a web control. // When the user logs in successfully, cancels the login, or closes the window without continuing, the IOAuthAuthorizeHandler // is responsible for obtaining the authorization from the server or raising an OperationCanceledException. public class OAuthAuthorizeHandler : IOAuthAuthorizeHandler { // Window to contain the OAuth UI. private Window _authWindow; // Use a TaskCompletionSource to track the completion of the authorization. private TaskCompletionSource<IDictionary<string, string>> _tcs; // URL for the authorization callback result (the redirect URI configured for your application). private string _callbackUrl; // URL that handles the OAuth request. private string _authorizeUrl; // Function to handle authorization requests, takes the URIs for the secured service, the authorization endpoint, and the redirect URI. public Task<IDictionary<string, string>> AuthorizeAsync(Uri serviceUri, Uri authorizeUri, Uri callbackUri) { if (_tcs != null && !_tcs.Task.IsCompleted) throw new Exception("Task in progress"); _tcs = new TaskCompletionSource<IDictionary<string, string>>(); // Store the authorization and redirect URLs. _authorizeUrl = authorizeUri.AbsoluteUri; _callbackUrl = callbackUri.AbsoluteUri; // Call a function to show the login controls, make sure it runs on the UI thread for this app. Dispatcher dispatcher = Application.Current.Dispatcher; if (dispatcher == null || dispatcher.CheckAccess()) { AuthorizeOnUIThread(_authorizeUrl); } else { Action authorizeOnUIAction = () => AuthorizeOnUIThread(_authorizeUrl); dispatcher.BeginInvoke(authorizeOnUIAction); } // Return the task associated with the TaskCompletionSource. return _tcs.Task; } // Challenge for OAuth credentials on the UI thread. private void AuthorizeOnUIThread(string authorizeUri) { // Create a WebBrowser control to display the authorize page. WebBrowser webBrowser = new WebBrowser(); // Handle the navigation event for the browser to check for a response to the redirect URL. webBrowser.Navigating += WebBrowserOnNavigating; // Display the web browser in a new window. _authWindow = new Window { Content = webBrowser, Width = 450, Height = 450, WindowStartupLocation = WindowStartupLocation.CenterOwner }; // Set the app's window as the owner of the browser window (if main window closes, so will the browser). if (Application.Current != null && Application.Current.MainWindow != null) { _authWindow.Owner = Application.Current.MainWindow; } // Handle the window closed event then navigate to the authorize url. _authWindow.Closed += OnWindowClosed; webBrowser.Navigate(authorizeUri); // Display the window. _authWindow.ShowDialog(); } // Handle the browser window closing. private void OnWindowClosed(object sender, EventArgs e) { // If the browser window closes, return the focus to the main window. if (_authWindow != null && _authWindow.Owner != null) { _authWindow.Owner.Focus(); } // If the task wasn't completed, the user must have closed the window without logging in. if (!_tcs.Task.IsCompleted) { // Set the task completion source exception to indicate a canceled operation. _tcs.SetCanceled(); } _authWindow = null; } // Handle browser navigation (content changing). private void WebBrowserOnNavigating(object sender, NavigatingCancelEventArgs e) { // Check for a response to the callback url. const string portalApprovalMarker = "/oauth2/approval"; WebBrowser webBrowser = sender as WebBrowser; Uri uri = e.Uri; // If no browser, uri, or an empty url, return. if (webBrowser == null || uri == null || string.IsNullOrEmpty(uri.AbsoluteUri)) return; // Check for redirect. bool isRedirected = uri.AbsoluteUri.StartsWith(_callbackUrl) || _callbackUrl.Contains(portalApprovalMarker) && uri.AbsoluteUri.Contains(portalApprovalMarker); // Check if browser was redirected to the callback URL. (This indicates succesful authentication.) if (isRedirected) { e.Cancel = true; // Call a helper function to decode the response parameters. IDictionary<string, string> authResponse = DecodeParameters(uri); // Set the result for the task completion source. _tcs.SetResult(authResponse); // Close the window. if (_authWindow != null) { _authWindow.Close(); } } } private static IDictionary<string, string> DecodeParameters(Uri uri) { // Create a dictionary of key value pairs returned in an OAuth authorization response URI query string. string answer = ""; // Get the values from the URI fragment or query string. if (!string.IsNullOrEmpty(uri.Fragment)) { answer = uri.Fragment.Substring(1); } else { if (!string.IsNullOrEmpty(uri.Query)) { answer = uri.Query.Substring(1); } } // Parse parameters into key / value pairs. Dictionary<string, string> keyValueDictionary = new Dictionary<string, string>(); string[] keysAndValues = answer.Split(new[] { '&' }, StringSplitOptions.RemoveEmptyEntries); foreach (string kvString in keysAndValues) { string[] pair = kvString.Split('='); string key = pair[0]; string value = string.Empty; if (key.Length > 1) { value = Uri.UnescapeDataString(pair[1]); } keyValueDictionary.Add(key, value); } // Return the dictionary of string keys/values. return keyValueDictionary; } }

Re: Help with OAuth

BrianBulla1 — Thu, 12 Oct 2023 15:23:28 GMT

Thanks @JoeHershman .

If I use that Authenticate with OAuth sample and modify the code, I can get it to work with my web map I am testing with, so I must have the OAuth setup properly in my Developers Account.

I'll have to figure out how to add what is in this OAuth sample into my own app. It seems quite different than the sample I have been using here: https://developers.arcgis.com/net/security-and-authentication/tutorials/access-services-with-oauth-2-0/

Re: Help with OAuth

BrianBulla1 — Mon, 16 Oct 2023 15:47:43 GMT

OK....so I've gotten things to the point where I think they should be working, but when I use the webmap ID for one in my organization, it just doesn't work. It just sort of hangs on the loading of the map and asking for login credentials.

If I sub my webmap ID for the ID of the public ones that is in the esri samples, I get prompted for the login credentials and then everything loads up.

Is there maybe a setting on my webmap I need to adjust??

I have no clue why I can't get this to work. Here is some code if it helps. Line #64 is where I am seeing the hang.

// Copyright 2022 Esri // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // https://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. using System; using System.Collections.Generic; using System.Text; using Esri.ArcGISRuntime.Geometry; using Esri.ArcGISRuntime.Mapping; using System.ComponentModel; using System.Runtime.CompilerServices; using System.Threading.Tasks; using Esri.ArcGISRuntime.Portal; namespace AccessServicesWithOAuth { class MapViewModel : INotifyPropertyChanged { public MapViewModel() { //SetupMap(); _ = SetupMap(); } public event PropertyChangedEventHandler? PropertyChanged; protected void OnPropertyChanged([CallerMemberName] string propertyName = "") { PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName)); } private Map? _map; public Map? Map { get { return _map; } set { _map = value; OnPropertyChanged(); } } private async Task SetupMap() { // Add the ArcGIS Online URL to the authentication helper. AuthenticationHelper.RegisterSecureServer("https://www.arcgis.com/sharing/rest"); // Create a portal. If a URI is not specified, www.arcgis.com is used by default. ArcGISPortal portal = await ArcGISPortal.CreateAsync(); // Get the portal item for a web map using its unique item id. PortalItem mapItem = await PortalItem.CreateAsync(portal, "41281c51f9de45edaf1c8ed44bb10e30"); //This is the esri sample ID //PortalItem mapItem = await PortalItem.CreateAsync(portal, "29ad2fc9b8794fb0b6dc1ca02948613d"); //This is the ID of my webmap. If I change the sharing on this to //"Everyone", then it loads up ok. Only won't load up when you need //to enter credentials. // Create the map from the item. Map map = new Map(mapItem); // Create a layer to display the ArcGIS World Traffic service. var trafficServiceUrl = "https://traffic.arcgis.com/arcgis/rest/services/World/Traffic/MapServer"; var trafficLayer = new ArcGISMapImageLayer(new Uri(trafficServiceUrl)); // Handle changes in the traffic layer's load status to check for errors. trafficLayer.LoadStatusChanged += TrafficLayer_LoadStatusChanged; // Add the traffic layer to the map's data layer collection. map.OperationalLayers.Add(trafficLayer); // To display the map, set the MapViewModel.Map property, which is bound to the map view. this.Map = map; } private void TrafficLayer_LoadStatusChanged(object? sender, Esri.ArcGISRuntime.LoadStatusEventArgs e) { // Report the error message if the traffic layer fails to load. if (e.Status == Esri.ArcGISRuntime.LoadStatus.FailedToLoad) { var trafficLayer = sender as ArcGISMapImageLayer; System.Windows.MessageBox.Show(trafficLayer?.LoadError?.Message, "Traffic layer did not load"); } } } }

Re: Help with OAuth

JoeHershman — Mon, 16 Oct 2023 16:11:19 GMT

Are you passing an API Key? You need to pass in if using a public map. You can do when loading map or in the Runtime Initialize

Re: Help with OAuth

BrianBulla1 — Mon, 16 Oct 2023 16:35:08 GMT

Yes, I am passing my API key. Do I need to do something in my Dev Account to link this API key directly to the webmap .... or some other kind of setting??

Re: Help with OAuth

BrianBulla1 — Mon, 16 Oct 2023 17:09:41 GMT

Sorry...had to delete a post....still not working.

Re: Help with OAuth

JoeHershman — Mon, 16 Oct 2023 17:11:09 GMT

You need to call ArcGISRuntime.Initialize after setting the API Key

Re: Help with OAuth

BrianBulla1 — Mon, 16 Oct 2023 17:38:29 GMT

Thanks, but that didn't really maike any difference. Still just a blank screen. Seems like the only webmap I can get to work with login credentials is the esri sample one.

I have a regular AGOL account as well as an Organizational account, and trying to load up a webmap from either one where I would need to enter credentials just doesn't work. Webmaps shared as "Everyone" seem to work fine.

Re: Help with OAuth

JoeHershman — Mon, 16 Oct 2023 17:53:17 GMT

If you created an OAuth key through your developer account this would only be attached to your developer account. Meaning it will only give you access to items stored on your developer AGOL. An organizational account would require you to create a OAuth App in that Organization. Have you tried to create a map in the AGOL site that is accessed by your developer login (I assume the BrianBulla1 named user) that you use to access the developer dashboard?

I have a developer site that came with my dev account, although I don't use. But my company has an Organizational account. An map that is setup in my Organization could not be accessed with an OAuth app I setup on the developer dashboard because it is a different account, I could access the traffic layer with my dashboard OAuth

Re: Help with OAuth

BrianBulla1 — Mon, 16 Oct 2023 17:58:20 GMT

Hi,

Yes, my testing has mainly be with useing the same dev. account and AGOL webmap.

Not quite sure how it's all setup, but with the esri samples, you need to add your own API key and OAuth details. Those are both in my developer account, but in the samples all of the webmaps etc. that you access are esri resources, and everything seems to work using those ID's.

There must be something I'm missing....I just have no clue what it would be.

Re: Help with OAuth

ThadTilton — Thu, 19 Oct 2023 17:06:51 GMT

If you successfully log in with OAuth, you don't need to provide an API key.

If it works for the map used in the sample but not for your map, perhaps the account you're logging in with does not have the expected access to that map. If you log in to ArcGIS Online with the same creds, can you access the web map?

Re: Help with OAuth

BrianBulla1 — Mon, 23 Oct 2023 12:43:41 GMT

Hi @ThadTilton . As far as I'm aware, with the esri samples if you do not provide an API key they will not work. There is a specific line of code/instructions that tells you to "insert API Key here".

As for my login, I can definitely see the webmap when I login online. The map will also popup in my test app if I set the access level to "Everyone". It only doesn't work if I set the access level to "Private".....which should generate the username/password screen, but instead the app just hangs there.

What's also weird is if I set my map to "Everyone" so that map actually loads, and then (in my code) add a layer that also needs authentication (esri World Traffic Service....just like in the sample), then I do get prompted for the username/password.

It only seems to hang when my own webmap needs authentication. So this works when the webmap on line #12 is set to "Everyone", but as soon as I turn it back to "Private" everything hangs.

private async Task SetupMap() { // Add the ArcGIS Online URL to the authentication helper. AuthenticationHelper.RegisterSecureServer("https://www.arcgis.com/sharing/rest"); // Create a portal. If a URI is not specified, www.arcgis.com is used by default. ArcGISPortal portal = await ArcGISPortal.CreateAsync(); // Get the portal item for a web map using its unique item id. PortalItem mapItem = await PortalItem.CreateAsync(portal, "4f7b45cd7d034ea9a09ec58658bff70d"); //this is the ID of my AGOL webmap. When set to "Everyone" it will load. // Create the map from the item. Map map = new Map(mapItem); // Create a layer to display the ArcGIS World Traffic service. var trafficServiceUrl = "https://traffic.arcgis.com/arcgis/rest/services/World/Traffic/MapServer"; var trafficLayer = new ArcGISMapImageLayer(new Uri(trafficServiceUrl)); // Handle changes in the traffic layer's load status to check for errors. trafficLayer.LoadStatusChanged += TrafficLayer_LoadStatusChanged; // Add the traffic layer to the map's data layer collection. map.OperationalLayers.Add(trafficLayer); // To display the map, set the MapViewModel.Map property, which is bound to the map view. this.Map = map; }

Re: Help with OAuth

JoeHershman — Mon, 23 Oct 2023 15:06:43 GMT

This does not register your OAuth app

AuthenticationHelper.RegisterSecureServer("https://www.arcgis.com/sharing/rest");

You need to register your OAuth. The OAuthClientInfo is required

		ServerInfo serverInfo = new ServerInfo(serverUri)
		{
			TokenAuthenticationType = TokenAuthenticationType.OAuthAuthorizationCode,
			OAuthClientInfo = new OAuthClientInfo(AppClientId, redirectUri)
			{
				UserInterfaceStyle = UserInterfaceStyle.Dark,
				ClientSecret = ClientSecret,
			},

		};

Re: Help with OAuth

BrianBulla1 — Mon, 23 Oct 2023 15:27:52 GMT

Hi @JoeHershman

As per the sample, here is what .RegisterSecureServer is doing (part of the AuthenticationHelper.cs part of the project....not posted above). The clientID and redirect Url are set earlier in the code and match what I have setup in the Developer dashboard.

public static void RegisterSecureServer(string url, string clientID = OAuthClientID, string redirectUrl = OAuthRedirectUrl) { // Define the server URL, authentication type, client ID, and redirect URL. ServerInfo portalServerInfo = new ServerInfo(new Uri(url)) { TokenAuthenticationType = TokenAuthenticationType.OAuthAuthorizationCode, OAuthClientInfo = new OAuthClientInfo(clientID, new Uri(redirectUrl)) }; // Register the server information with the AuthenticationManager. AuthenticationManager.Current.RegisterServer(portalServerInfo); }

This is more or less, what you suggested, but currently not working. Not exactly sure how the redirect URL works, but I created exactly as the sample tutorial explained.

Re: Help with OAuth

PierreMasson — Mon, 23 Oct 2023 20:26:30 GMT

I have exactly the same problem. I modified the sample to use a Feature Layer posted in our ArcGIS Online Organization. And everything works well. The login prompt appears when it hits that line:

PortalItem portalItem = await PortalItem.CreateAsync(arcgisPortal, WebMapId);

Then I created my own app. .Net 6, I do the register key, the ArcGISLoginPrompt.SetChallengeHandler (I copied the whole class in my test project).. When I hit the same line, the login prompt does not appear but instead I get:

Esri.ArcGISRuntime.Http.ArcGISWebException: 'You do not have permissions to access this resource or perform this operation.'

The only thing different I can see are the projects that runs that code. Like in mine I can't add the nuget package Esri.ArcGISRuntime.LocalServices. I don't know if it`s necessary.

I'm really looking forward to an explanation to this. I spent all day compararing ans searching a solution to that..

Re: Help with OAuth

JoeHershman — Mon, 23 Oct 2023 20:40:13 GMT

Instead of having the app open it when it gets the PortalItem can you add

//THIS LINE SHOULD OPEN WINDOW! var credential = await AuthenticationManager.Current.GenerateCredentialAsync(sharingUri); AuthenticationManager.Current.AddCredential(credential);

before

portal = await ArcGISPortal.CreateAsync(sharingUri);

In your current code, if you put a breakpoint in the ChallangeHandler delegate does it get hit when you call (before making the change I describe above)

PortalItem mapItem = await PortalItem.CreateAsync(portal, "29ad2fc9b8794fb0b6dc1ca02948613d"); //This is the ID of my webmap.