topic Re: Flex Viewer 3.0 - Secured Service using IdentityManager in ArcGIS Viewer for Flex Questions

Flex Viewer 3.0 - Secured Service using IdentityManager

PanWang — Sat, 11 Dec 2021 19:17:09 GMT

I am trying to use a new function in Flex Viewer 3.0: "Edit secure service" (http://resourcesbeta.arcgis.com/en/help/flex-api/samples/index.html#/Edit_secure_service/01nq00000074000000/). I have already set up the configurations in ArcGIS Server and it seems working fine when I connect a map service with the right user name and password. But when it comes to multiple services, the log-in window pops up repeatedly for each services, even though they have access to the same role.

For example, when I try to use 3 services in my opreational layer:

       <operationallayers>
             <layer label="Service1" type="dynamic" visible="false" 
                   url="http://localhost/ArcGIS/rest/services/Service1/MapServer"/>
            <layer label="Service2" type="dynamic" visible="false" 
                   url="http://localhost/ArcGIS/rest/services/Service2/MapServer"/>
            <layer label="Service3" type="dynamic" visible="false" 
                   url="http://localhost/ArcGIS/rest/services/Service3/MapServer"/>
      </operationallayers>

all the services are protected and accessible to only one role in ArcGIS server:

[TABLE="class: grid"]Service Allowed roleuser_namepasswordService1 staff staff1 staff1$Service2 staff staff1 staff1$Service3 staff staff1 staff1$
[/TABLE]

But when Flex Viewer starts, the log-in window pops up 3 times for each service, which is unnecessary for they are using the same user name and password!

Did anyone meet the same problem before, and have a solution to it ? Thanks in advance!

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

PanWang — Mon, 04 Jun 2012 23:09:36 GMT

I read this from the Help of Arcgis API for FLEX: "Supplying end users with a user name and password is not appropriate when services from more than one ArcGIS Server system are used in an application, as multiple logins would be required. This limitation does not apply when using multiple services within the same ArcGIS Server system, since the challenge is issued for the entire server" .

It is quite strange that I am actually using multiple services within the same ArcGIS Server system, so the problem of multiple logins should not happen. But it happens as I described above.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

JosephAccardi — Tue, 05 Jun 2012 13:26:08 GMT

I'm having the same issue. I'm getting multiple log-in pop-ups for every secured service I have in my application. I hope someone can shed some light on this situation.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Tue, 05 Jun 2012 14:59:20 GMT

Does the application work fine once you login to each service?

What version of the Viewer are you testing?

What is the contents of http://localhost/ArcGIS/rest/info ?

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

JosephAccardi — Tue, 05 Jun 2012 15:17:29 GMT

I'm using FV 3.0. Yes, each service works once I provide a log-in for each one. Here's what is says when I go to http://localhost/ArcGIS/rest/info:

Server Info
Current Version: 10.1

SOAP URL: http://<localhost>/arcgis/services

Secure SOAP URL: null

Authentication Information:

Is Token Based Security: true
Token Service URL: http://<localhost>/arcgis/tokens/
ShortLived Token Validity: 60 minutes

I am still in production and haven't pushed my application to the outside yet.

Thanks

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Tue, 05 Jun 2012 16:42:59 GMT

Are you using 3.0 Prerelease or Beta 1?

What version of 10.1 server are you using?

If you check the traffic using a tool like HttpFox, you should see it first trying to get the json for the layers and the response saying that a token is required, and then after you log in, you should see it trying again with a token added to the request. What is the response to these requests?

[ATTACH=CONFIG]14952[/ATTACH]

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

JosephAccardi — Wed, 06 Jun 2012 11:43:14 GMT

I'm using FV 3.0 Prerelease and 10.1 Prerelease.

I may have misstated my issue. I've noticed that if I log onto the web application as a user who has permissions to all the secured map services featured on the site I only see the log-in pop-up once. However, if I log onto the web application as a user who doesn't have permissions to all the services a log-in will pop up multiple times and errors are generated which say that some of the services could not load (because the user doesn't have permissions to use them).

I guess my question is how can I create a log-in pop-up (or log-in screen) that a user can log-in once and only the services that he/she has permissions to will be populated on the site (without the multiple log-ins or permission errors)?

Thank you for your help on this.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Thu, 07 Jun 2012 15:02:51 GMT

In 3.0 final, when the user cancels a login, there won't be an error message displayed.

If you don't want the user to see a login for layers they don't have access to, you could create different Viewers or different configs and then direct users to the appropriate URL.

e.g.,

http://host/viewer1
http://host/viewer2

or

http://host/viewer/index.html?config=config1.xml
http://host/viewer/index.html?config=config2.xml

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

ChrisMahon — Thu, 12 Sep 2013 17:38:12 GMT

Did you ever resolve this issue?

I just started a post that sounds like that same issue?
http://forums.arcgis.com/threads/92518-Custom-SignInWindow-will-not-go-away...

I'm using FV 3.0 Prerelease and 10.1 Prerelease.

I may have misstated my issue. I've noticed that if I log onto the web application as a user who has permissions to all the secured map services featured on the site I only see the log-in pop-up once. However, if I log onto the web application as a user who doesn't have permissions to all the services a log-in will pop up multiple times and errors are generated which say that some of the services could not load (because the user doesn't have permissions to use them).

I guess my question is how can I create a log-in pop-up (or log-in screen) that a user can log-in once and only the services that he/she has permissions to will be populated on the site (without the multiple log-ins or permission errors)?

Thank you for your help on this.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

BenjaminMercier — Fri, 06 Dec 2013 14:31:30 GMT

Are you using 3.0 Prerelease or Beta 1?

What version of 10.1 server are you using?

If you check the traffic using a tool like HttpFox, you should see it first trying to get the json for the layers and the response saying that a token is required, and then after you log in, you should see it trying again with a token added to the request. What is the response to these requests?

[ATTACH=CONFIG]14952[/ATTACH]

Hi Dasa,

I got a problem with the request POST when I log, actually, it send to the URL http://.../generateToken but I would like, like on yours, https://..../generateToken, could you explain me how to do that??

Thanks in advance,

Ben

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Tue, 10 Dec 2013 20:24:51 GMT

Hi Dasa,

I got a problem with the request POST when I log, actually, it send to the URL http://.../generateToken but I would like, like on yours, https://..../generateToken, could you explain me how to do that??

Thanks in advance,

Ben

What is the Token Service URL shown at: http://[host]/arcgis/rest/info

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

BenjaminMercier — Wed, 11 Dec 2013 08:17:10 GMT

Hello,

Thanks for your answer. This info return the URL of the intern server of the company if I use this url request: "http://vwpfr010app134:6080/arcgis/rest/info
Authentication Information:

Is Token Based Security: true

Token Service URL: http://vwpfr010app134:6080/arcgis/tokens/

ShortLived Token Validity: 60 minutes

But we have recently installed a web adaptor to access our web applications from everywhere to this adress: https://sygdev.systra.info/arcgis/rest/info and here is the result:

Authentication Information:

Is Token Based Security: true

Token Service URL: https://sygdev.systra.info/arcgis/tokens/

ShortLived Token Validity: 60 minutesF

From applications I use in extern, I use the second url, so I don't know why generateTokens URL don't use an https request...

I hope you understand me.

Ben

PS: I don't understand why this url is slow to answer...

https://sygdev.systra.info/arcgis/tokens/

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Wed, 11 Dec 2013 16:36:49 GMT

Can you double-check that your application is using the web adapter URL? You can use the Chrome Dev tools to see the network requests. Also, do yo have a public URL to your app?

One problem may be that I get a SSL certificate error ("host name mismatch") when loading https://sygdev.systra.info/arcgis/rest/info

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

BenjaminMercier — Wed, 11 Dec 2013 16:41:36 GMT

Hi Dasa,

To answer your question:
1) Yes this application use https://sygdev.systra.info/test so it's the web adaptor URL
2) The genrate token URL use http://sygdev.systra.info/arcgis/tokens which actually not exist, I don't understand why it use that.

We'll have to buy a domain name befre having a certificate. I hope...

Ben

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

DasaPaddock — Wed, 11 Dec 2013 17:05:59 GMT

Hi Ben,

I found that the problem is that the JSON /rest/info response used by the app is returning the URL as just http. See the tokenServicesUrl at: https://sygdev.systra.info/arcgis/rest/info?f=pjson

This may be a server bug. It is being investigated.

Are you compiling your Viewer? If you are, I can show you how to update the code so that it doesn't use the /rest/info response.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

BenjaminMercier — Wed, 11 Dec 2013 17:51:43 GMT

Hi Dasa,

Well found !!
For my job I use source code of ArcgIS Viewer For Flex, but usually, the others are publishing web app with the 3.3 application builder...
I guess it should be a parameter of the ArcGIS Server or something else to do with the web adaptor...

Thanks so much. Tell me if you have something new.

Re: Flex Viewer 3.0 - Secured Service using IdentityManager

BenjaminMercier — Tue, 07 Jan 2014 12:37:29 GMT

Hi Dasa,

I found where to modify this parameter finally...
It's located in the http://yourArcGISServerURL/arcgis/admin/security/config folder. In Update I had to choose "HTTP or HTTPS" protocol or "HTTPS Only".

Thanks you Dasa to find from where I had the problem.

Ben