Advice on Authenticating Domain Users (via ADFS) Against Secure Services

AlexSchafer — Fri, 06 May 2016 20:45:21 GMT

Hello Community -

I am looking for some guidance on how to approach authenticating active directory domain users against a secure ArcGIS Server map service. Knowing there are several approaches, please note the following:

The application needing to consume the secure ArcGIS Server service is a custom developed web application using the ArcGIS Javascript API (v3.16).
The ArcGIS Server (v10.4) hosting the service is federated to ArcGIS Portal (v10.4).The Portal itself authenticates users via ADFS via the "Enterprise Logins via SAML identity provider.
Being federated, ArcGIS Server now "defers" security to the Portal - and I think THAT is what is making this challenging, if not impossible.
Consequently, the service itself will only allow access to either everyone (Public) or defined Portal members (via a Portal group). Correct? The members of that particular Portal group are defined via an AD Group.

Ideally, I would like to expose the secure service to members of that AD Group WITHOUT defining them as Portal members. The service existed before the Portal and it has not been added as a Layer in the Portal. I just want to use the service, but Portal seems to get in the way!

Additionally, if we did want to make the service available to a Portal user, we want to make sure they are not presented with a second login prompt when they access feature layers exposed in the Portal if they have already authenticated via ADFS.

Can I even do this with ArcGIS Server federated to the Portal ?? Or do I have to drop the federation?

Some of the approaches tried thus far:

Oauth2.0 via the Javascript API

I tried the approach mentioned here:

http://www.mymanatee.org/arcgis_js_api/sdk/jssamples/portal_oauth_inline.html

Using this method, I was prompted to log into the Portal in order to access the secured services.

App login approach

I followed the approach mentioned here:

https://developers.arcgis.com/authentication/accessing-arcgis-online-services/

Based on this, I was able to get a token, however the token did not appear to work on secured services. It would return "Invalid token" as a dojo script error when the ArcGISDynamicMapServiceLayer was called in the ArcGIS JavaScript API.

Looking at what is posted below, it does not appear that secured services can use this method.

https://developers.arcgis.com/authentication/limitations-of-application-authentication/

Named user approach

Post to -[portal_url]/arcgissrv/tokens/generateToken

In the POST we supplied the following information:

f: "json"

username: [username]

password: [password]

client: "referrer"

referrer: [custom app URL]

When we used a portal account we would get back a token response:

{"token":"5dvEdVwMi4a3LpKfW-02ofyg8fi5bStGiO0tP-S7BlYut3gjMFbdC8TRJnTFS88v","expires":1462567122484}

When we used a domain (AD) account without having a portal account set up we received the message:

{"error":{"code":401,"message":"You are not authorized to access this information","details":"Invalid credentials"}}

Re: Advice on Authenticating Domain Users (via ADFS) Against Secure Services

Anonymous User — Thu, 18 Jun 2020 05:27:40 GMT

Hi,

I am in similar situation, Do you want to share your solution . That would be very helpful. Thanks

My case ArcGIS Server is federated to portal (10.8) which is further using IWA. Now i want to use ArcGIS Server service rest url with my custom app but no option is working out. I was assuming App login approach should work but i was wrong.

topic Re: Advice on Authenticating Domain Users (via ADFS) Against Secure Services in ArcGIS Server with JavaScript API Questions

Advice on Authenticating Domain Users (via ADFS) Against Secure Services

Re: Advice on Authenticating Domain Users (via ADFS) Against Secure Services