topic IWA Portal Login and Feature Service Access in .NET Maps SDK Questions

IWA Portal Login and Feature Service Access

AndyWright — Thu, 14 Mar 2019 18:26:48 GMT

We've got an IWA Portal setup in house and we are working on getting our iOS Runtime Xamarin Forms application to work properly with it. We have been using oAuth based authentication for years and now have customers implementing IWA based Portals and need to support that.

To get the login going I am using the ArcGISNetworkCredential. When the authentication challenge is issued against our IWA portal we pop up a home grown username/password form, take that information, create the ArcGISNetworkCredential and login to the portal accordingly. I've got that all working well.

We have a couple of tools that utilize feature services to create offline geodatabases to support field work. When I try to generate those offline geodatabases using the ArcGISNetworkCredential I am getting an error that a token is required. Makes sense. Problem is the ArcGISNetworkCredential does not have a token associated with it.

I then switched gears and attempted to use the ArcGISTokenCredential for everything - logging into the portal and generating geodatabases from feature services. No luck there - could not get that to work for logging in.

I've been through the multitude of online documents referring to integrated windows authentication implementation and have used a lot of code examples in there within our app. I have not found anything that addresses our particular scenario though. I feel like I'm close on this and am missing a small piece of the puzzle.

Can someone point me in the right direction? Thanks!

Re: IWA Portal Login and Feature Service Access

JoeHershman — Thu, 14 Mar 2019 20:19:37 GMT

I'd be curious how you get the Windows user name from an iOS device, but that is another question.

When you use the Windows user name I have found that the user name needs to be in the form:

user@DOMAIN where domain is in all caps. If using Windows authentication and the domain is not in CAPS it fails

Re: IWA Portal Login and Feature Service Access

AndyWright — Thu, 14 Mar 2019 22:07:06 GMT

We pop up a homegrown login page for the user to enter their creds. That works fine. My issue is with accessing a feature service on our portal and making a request to that service. It is complaining about a token when I make that request to the service.

Re: IWA Portal Login and Feature Service Access

JoeHershman — Thu, 14 Mar 2019 23:38:07 GMT

Can you post the code?

Re: IWA Portal Login and Feature Service Access

AndyWright — Sat, 11 Dec 2021 07:48:11 GMT

That's a little tough as we've got pieces of all this all over the place, but I'll get you the basics here in no specific order. What I was after with this post was a recipe. There has to be a set of steps that has to be taken to log into an IWA portal and be able to make requests against feature services in that portal. It seems like the ArcGISNetworkCredential gets me in the front door, but doesn't allow me to drink any beers in the fridge if you know what I mean.

AuthenticationManager.Current.ChallengeHandler = new IwaChallengeHandler { AllowSaveCredentials = saveCredentials };

await CreateIwaCredentialAsync(new CredentialRequestInfo
 {
     ServiceUri = new Uri(_serviceUri),
     AuthenticationType = AuthenticationType.NetworkCredential
 });

ArcGISNetworkCredential credential = await 
    AuthenticationManager.Current.ChallengeHandler.CreateCredentialAsync(credRequestInfo) 
    as ArcGISNetworkCredential;

if (credRequestInfo.Response == null)
       AuthenticationManager.Current.AddCredential(credential);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

using EFCloud.Events;
using EFCloud.Security.Managers;
using EFCloud.ViewModels;
using EFCloud.Views;
using Esri.ArcGISRuntime.Security;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Xamarin.Forms;

namespace EFCloud.Security.Handlers
{
	internal class IwaChallengeHandler : IChallengeHandler
	{
		#region Variable/property declaration

		private bool _allowSaveCredentials;
		private bool _areCredentialsRestored;
		private LoginPage _loginPage = new LoginPage();


		// A TaskCompletionSource to store the result of a login task.
		private TaskCompletionSource<Credential> _loginTaskCompletionSrc;


		public bool AllowSaveCredentials
		{
			//  The first time AllowSaveCredentials is set to true, the cached credentials are added to the AuthenticationManager
			//  The default value is false

			get { return _allowSaveCredentials; }

			set
			{
                if (_allowSaveCredentials != value)
                {
                    _allowSaveCredentials = value;

                    if (_allowSaveCredentials && !_areCredentialsRestored)
                    {
                        //  The first time AllowSaveCredentials is set to true, add the cached credentials to AuthenticationManager

                        _areCredentialsRestored = true;

                        foreach (var crd in RetrieveAllSavedCredentials())
                        {
                            AuthenticationManager.Current.AddCredential(crd);
                        }
                    }
                }
            }
		}

		#endregion

		#region Constructor and Initialize

		public IwaChallengeHandler()
		{
			Initialize();
		}

		private void Initialize()
		{
			// Set up event handlers for when the user completes the login entry or cancels
			LoginPageViewModel loginPageViewModel = _loginPage.BindingContext as LoginPageViewModel;
			loginPageViewModel.OnLoginInfoEntered += LoginInfoEntered;
			loginPageViewModel.OnCanceled += LoginCanceled;
		}

        #endregion


        /// <summary>
        /// Retrieves all EpochField credentials
        /// </summary>
        /// <returns>IEnumerable<Credential></returns>
        internal IEnumerable<Credential> RetrieveAllSavedCredentials()
        {
            return CredentialManager.RetrieveAll();
        }

        public async Task<Credential> CreateCredentialAsync(CredentialRequestInfo info)
		{
			// Ignore challenges for OAuth (might come from secured layers in public web maps, for example).
			if (info.AuthenticationType != AuthenticationType.NetworkCredential)
			{
				Console.WriteLine("Authentication for " + info.ServiceUri.Host + " skipped.");
				return null;
			}

			// Return if authentication is already in process
			if (_loginTaskCompletionSrc != null && !_loginTaskCompletionSrc.Task.IsCanceled)
			{
				return null;
			}

			// Create a new TaskCompletionSource for the login operation
			// (passing the CredentialRequestInfo object to the constructor will make it available from its AsyncState property)
			_loginTaskCompletionSrc = new TaskCompletionSource<Credential>(info);

            // Show the login controls on the UI thread
            // OnLoginInfoEntered event will return the values entered (username, password, and domain)

            ArcGISNetworkCredential iwaCred = AuthenticationManager.Current.FindCredential(info.ServiceUri, AuthenticationType.NetworkCredential) as ArcGISNetworkCredential;

            if (iwaCred != null)
            {
                _loginTaskCompletionSrc.TrySetResult(iwaCred);
            }
			else
            {
                Device.BeginInvokeOnMainThread(async () => await App.Current.MainPage.Navigation.PushAsync(_loginPage));
            }

			// Return the login task, the result will be ready when completed (user provides login info and clicks the "Login" button)
			return await _loginTaskCompletionSrc.Task;
		}

		#region Event Handlers

		// Handle the OnLoginEntered event from the login UI
		// LoginEventArgs contains the username, password, and domain that were entered
		private void LoginInfoEntered(object sender, LoginDialogEventArgs e)
		{
			// Make sure the task completion source has all the information needed
			if (_loginTaskCompletionSrc == null ||
				_loginTaskCompletionSrc.Task == null ||
				_loginTaskCompletionSrc.Task.AsyncState == null)
			{
				return;
			}

			try
			{
				// Get the associated CredentialRequestInfo (will need the URI of the service being accessed)
				CredentialRequestInfo requestInfo = _loginTaskCompletionSrc.Task.AsyncState as CredentialRequestInfo;

				// Create a new network credential using the values entered by the user
				var networkCredential = new System.Net.NetworkCredential(e.Username, e.Password, e.Domain);

				// Create a new ArcGIS network credential to hold the network credential and service URI
				var arcgisCredential = new ArcGISNetworkCredential
				{
					Credentials = networkCredential,
					ServiceUri = requestInfo.ServiceUri
				};

                if (AllowSaveCredentials)
                {
                    CredentialManager.AddCredential(arcgisCredential);
                }

                // Set the task completion source result with the ArcGIS network credential
                // AuthenticationManager is waiting for this result and will add it to its Credentials collection
                _loginTaskCompletionSrc.TrySetResult(arcgisCredential);
			}
			catch (Exception ex)
			{
				// Unable to create credential, set the exception on the task completion source
				_loginTaskCompletionSrc.TrySetException(ex);
			}
			finally
			{
				// Dismiss the login controls
				App.Current.MainPage.Navigation.PopAsync();
			}
		}

		private void LoginCanceled(object sender, EventArgs e)
		{
			// Dismiss the login controls
			App.Current.MainPage.Navigation.PopAsync();

			// Cancel the task completion source task
			_loginTaskCompletionSrc.TrySetCanceled();
		}

		#endregion

		public void Reset()
		{
			_loginTaskCompletionSrc = null;
		}
	}
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: IWA Portal Login and Feature Service Access

JoeHershman — Sat, 11 Dec 2021 07:48:14 GMT

Certainly a lot more involved than what I have ever done. This is the very basic approach when I save a User/Password in configuration so things work on machines not attached to the domain (mainly because my test environment is often not on the domain of the Portal but the Portal uses Windows Auth)

private async Task<TokenCredential> GetWindowsCredential()
{
	Uri sharingUri = new Uri($"{Settings.PortalUrl}/sharing/rest");
	TokenCredential credential;

	try
	{
		//Assume that IWA is turned on on machine
		credential = await AuthenticationManager.Current.GenerateCredentialAsync(sharingUri, "", "");
	}
	catch (Exception)
	{
		//if failed then use provided user and password - testing also requires
		// user name muust be in form: user@DOMAINNAME
		credential = await AuthenticationManager.Current.GenerateCredentialAsync(sharingUri, Settings.WindowsUser, Settings.WindowsPwd);
	}

	return credential;
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I do the same in another app (it is WPF not Xamarin though) that uses a form to get user input. All done basically the same except for a little ditty to get the password:

// _securePassword is SecureString
string password = new NetworkCredential(string.Empty, _securePassword).Password;‍‍‍‍‍

In WPF when the user enters into a password text box it gives you a SecureString type. I don't know if Xamarin is the same, but that's a way I figured to get a plain text string from the SecureString object.

Also there are some things that don't directly ask for Credential or have as a parameter but it is required. The following does the trick for me in those cases

AuthenticationManager.Current.AddCredential(await GetWindowsCredential());‍

I have never had issue with this.

As a general rule I will call into GetWindowsCredential anytime I need a credential unless there is a significant performance concern and I am sure that I am using the saved Credential over a short time. But the token does expire and so if cached too long will no longer be valid

Hope that helps

Re: IWA Portal Login and Feature Service Access

AndyWright — Mon, 18 Mar 2019 22:17:23 GMT

Hey Joe thanks for the reply. I went ahead and tried the brute force approach and tried to generate a TokenCredential object from my user credentials right before generating an offline geodatabase from the feature service. More or less doing it the same way you are, and I am currently getting a 401 error on that which is really strange. We are now working with our network dude to see if something is wrong outside of our Portal implementation.

Re: IWA Portal Login and Feature Service Access

JoeHershman — Wed, 20 Mar 2019 13:52:00 GMT

Have you tried to log in from the device directly to the sharing web site using Windows credentials?

Re: IWA Portal Login and Feature Service Access

AndyWright — Wed, 20 Mar 2019 19:04:18 GMT

I just tried that Joe and it worked fine. Took my windows credentials and logged me in.

Re: IWA Portal Login and Feature Service Access

JoeHershman — Thu, 21 Mar 2019 16:53:01 GMT

Just thinking if it was a Portal issue you would also have a problem logging in directly, so scratching my head a bit on what would be wrong

Re: IWA Portal Login and Feature Service Access

AndyWright — Thu, 28 Mar 2019 18:49:08 GMT

Hey Joe. So I am now able to get a token successfully in a WPF app, but continually get 401 errors with the same code in a Xamarin Forms app. I feel like there is a small piece of the puzzle missing on the Forms side. I believe you are right in saying it is not a Portal issue. I'm wondering if it is something at the IIS level since the creds are passed through automatically in Windows and not in iOS or Android. We've played around with a few settings and have had no luck so far. We also have a Esri support ticket opened on this.

Re: IWA Portal Login and Feature Service Access

JoeHershman — Fri, 29 Mar 2019 15:46:42 GMT

I am only doing on an iOS emulator on a mac through Xamarin. I am able to create the credential and create a portal object with an IWA configured portal. My portal is setup in AWS so not dealing with any additional security that an internal IT might be adding. What I find really confusing in what you described is you are able to login to the sharing API directly from a browser but not through your app, as far as I know these should both work the same in regards to passing credentials

Re: IWA Portal Login and Feature Service Access

AndyWright — Fri, 29 Mar 2019 15:51:57 GMT

We had a little breakthrough late yesterday. We are now using straight REST API calls to get the token against the feature service and then applying that token to an ArcGISTokenCredential object. We can supply that object to the geodatabase create and sync calls. Seems like a franken-solution, but it's working so we're going with it for now. There has to be a way to accomplish all this through the Runtime API, but we weren't able to put all the puzzle pieces together correctly for an IWA portal. Thanks for all your input though Joe.