topic Re: FV 3.0 Disable Secure Service Login in ArcGIS Viewer for Flex Questions

FV 3.0 Disable Secure Service Login

SimonRoss_User — Sun, 01 Jul 2012 20:42:18 GMT

I've already posted this to an existing post (http://forums.arcgis.com/threads/54640-FV-3.0-and-Login) but thought I'd open separately so there's no confusion.

Just started working with FV 3.0 and having some issues with the new login popup for secured services.

Our existing applications (FV 2.5) are secured via an ASP form control. Credentials for the secure services are built into the proxy page. Currently with the new secure services login this causes a separate challenge for authentication. Ideally I'd just like to disable the new secure services challenge but can't seem to make this happen in the flexviewer source code. I've tried removing the IdentityManager.instance.enabled = true but this makes no difference. I still get the popup appear. Any ideas on how to customize the viewer to remove this?
Thanks

Re: FV 3.0 Disable Secure Service Login

DasaPaddock — Mon, 02 Jul 2012 15:32:40 GMT

If the proxy is adding a token and no security error is returned to the client, then the IdentityManager should not be showing the sign in dialog.

Since creating an instance of the Portal also enables the IdentityManager, try adding this after line 45 of PortalBasemapAppender:

IdentityManager.instance.enabled = false;

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Mon, 02 Jul 2012 15:49:38 GMT

If the proxy is adding a token and no security error is returned to the client, then the IdentityManager should not be showing the sign in dialog.

Since creating an instance of the Portal also enables the IdentityManager, try adding this after line 45 of PortalBasemapAppender:

IdentityManager.instance.enabled = false;

Dasa - thanks for the response. I added this as directed and also set the instance of IdentityManager.instance.enabled to false in the ViewerContainer.mxml. Unfortunately this now causes a fault code 499 Unauthorized Access when the application launches and the layer cannot be accessed. For reference our proxy configuration has user name and password credentials embedded to generate a token at runtime - could this be causing the issue?

proxy.ashx, proxy.config

    <serverUrl url="https://MYDOMAIN/ArcGIS/rest/services"
               matchAll="true"
        dynamicToken="true"
        userName="USER"
        password="PASSWORD"
               host="SERVER_ID"
               ></serverUrl>
</serverUrls>

Re: FV 3.0 Disable Secure Service Login

DasaPaddock — Mon, 02 Jul 2012 16:55:53 GMT

Can you post your Viewer's config.xml?

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Mon, 02 Jul 2012 17:01:59 GMT

File is attached

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Sun, 12 Dec 2021 04:49:04 GMT

Hi Simon,
What you are trying to do is pretty common. Just to make sure that we have it correct:

1) You are accessing your Flex Viewer app via a asp login, I'm assuming you are using IIS authentication to access this?
2) You then are trying to work with some secure services. You do NOT want your users prompted for credential info correct?
3) You have a proxy page configured to point to these services with the servername and info passed in via the proxy config?
4) If all this is correct, the info in the proxy should provide the credential info without having to be prompted by the Identify Manager.

This makes me wonder if there is something else going on with the proxy configuration. In order to try and narrow this down, let's take the Flex Viewer completely out of the equation as it just adds more variables when troubleshooting.

Could you please try using something as basic as a sample web API sample and see if you can access your layers in that. I'm not sure exactly what type of layers you are working with but there are plenty of simple samples that you could copy/paste and change out the layer URL to that of yours. In addition to this, just make sure that you are also pointing to your proxy config file in the code. You would do this by setting the proxyURL property to the location of your proxy.ashx file.

For example

<esri:ArcGISDynamicMapServiceLayer url="https://ServerName/ArcGIS/rest/services/Secure/USASecured/MapServer" proxyURL="proxy.ashx" />

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Mon, 02 Jul 2012 17:53:38 GMT

Hi Simon,
After looking at this further, I remembered others having issues (not just in the Flex API) using the proxy page with dynamic tokens. The actual proxy.ashx file needed to be updated to allow this. Could you try using this updated proxy page instead? See if it makes any difference. Let us know how this goes as this should be updated as well in any documentation.

Thanks,
Heather

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Mon, 02 Jul 2012 19:12:50 GMT

Heather,

Thanks for your response. We're already using the updated proxy.ashx page and been using it without issue with Flex Viewer 2.5. As you suggested I created a basic sample app and this accessed the secure service via the proxy credentials without issue. In answer to the detailed questions in your first post
1/ Yes
2/ Yes
3/ Yes - see previous post for setup of proxy.config
4/ I wish this were true!

Thanks a lot

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Mon, 02 Jul 2012 19:26:51 GMT

Heather,

Thanks for your response. We're already using the updated proxy.ashx page and been using it without issue with Flex Viewer 2.5. As you suggested I created a basic sample app and this accessed the secure service via the proxy credentials without issue. In answer to the detailed questions in your first post
1/ Yes
2/ Yes
3/ Yes - see previous post for setup of proxy.config
4/ I wish this were true!

Thanks a lot

Hi Simon,
Thanks for the update. This helps narrow things down. So it does sound like the proxy is working as it should using the updated proxy file since you can do it without any problems directly in an API sample. Let me see if we can try and repro it on our end here. If possible, could you attach the proxy.zip you are using (including the ashx and config files)?

Thanks.

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Mon, 02 Jul 2012 19:35:28 GMT

Heather - here are the files. One other thing, which you may have guessed anyway, all access to our server is via SSL

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Mon, 02 Jul 2012 20:04:14 GMT

Heather - here are the files. One other thing, which you may have guessed anyway, all access to our server is via SSL

Hi Simon,
Thanks. Let me get something set up on this end and see what I can figure out. I'll be in touch.

Heather

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Tue, 03 Jul 2012 19:44:23 GMT

Hi Simon,
Just wanted to keep you updated. I'm still looking into this. Hopefully should have something soon.

Thanks

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Tue, 03 Jul 2012 19:46:56 GMT

Thanks Heather - Happy 4th of July

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Thu, 05 Jul 2012 13:12:09 GMT

Hi Simon,
Could you try one thing for me please? It looks like there may be a slight typo in the source that may be causing the issue with proxies not being honored for layers.

Go to line 495 of MapManager.mxml and change

From:
layerObject.proxyURL = m_configData.proxyUrl;

To:
layerObject.proxyUrl = m_configData.proxyUrl;

Could you please try this out and let me know if this takes care of the problem? If not, then there may be something more that we are missing.

Thanks again,
Heather

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Thu, 05 Jul 2012 13:27:07 GMT

Heather - that did the job! A couple of queries around that though - I ran that change on a version of the viewer code where I'd already made the additional references to IdentityManager.instance.enabled = false as documented previously in this discussion. If I understand correctly those modifications should no longer be required if it's picking up the proxy info correctly. Is that right? Secondly presumably this will be corrected in a future release of the compiled viewer?

Thanks for all your help
Best Regards

Simon

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Thu, 05 Jul 2012 13:39:14 GMT

Heather - that did the job! A couple of queries around that though - I ran that change on a version of the viewer code where I'd already made the additional references to IdentityManager.instance.enabled = false as documented previously in this discussion. If I understand correctly those modifications should no longer be required if it's picking up the proxy info correctly. Is that right? Secondly presumably this will be corrected in a future release of the compiled viewer?

Thanks for all your help
Best Regards

Simon

Excellent, I'm glad to hear it. As for your questions...You should not need those previous modifications you made. Go ahead and remove it and see how it goes. And for the second question, yes this has been marked as a bug and should be fixed shortly. I would keep an eye on GitHub where we keep the source and you can check for any recent check-ins.

Thanks for helping us troubleshoot this.

Re: FV 3.0 Disable Secure Service Login

JosephAccardi — Fri, 06 Jul 2012 12:15:10 GMT

Hi Simon,
What you are trying to do is pretty common. Just to make sure that we have it correct:

1) You are accessing your Flex Viewer app via a asp login, I'm assuming you are using IIS authentication to access this?
2) You then are trying to work with some secure services. You do NOT want your users prompted for credential info correct?
3) You have a proxy page configured to point to these services with the servername and info passed in via the proxy config?
4) If all this is correct, the info in the proxy should provide the credential info without having to be prompted by the Identify Manager.

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

Re: FV 3.0 Disable Secure Service Login

SimonRoss_User — Fri, 06 Jul 2012 12:32:22 GMT

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

Joseph,

Is there any particular reason you cannot set up a proxy page - it's a very straightforward process to do and the best way to keep the user credentials for the services hidden. The help files give a great walkthrough of the setup process - takes about 10 minutes!

Re: FV 3.0 Disable Secure Service Login

HeatherGonzago — Fri, 06 Jul 2012 13:28:24 GMT

I am also using IIS basic/windows authentication to secure my FV 3.0 application. I do not have any security on my services because I'm also trying to avoid my external users from having to supply their credentials for every secured service in the web application. At the same time, I need the services to be secure without having the credentials prompt pop-up. I am not working with a proxy page so my scenario is only #1 and #2 from the list above. Is there a way to disable the prompt with secured services without using a proxy page?

Thanks

Normally you are prompted for the credential which generate the token needed to unlock the services. The user/pass information is
configured and stored by the administrator via Manager.

If you do not want your users to have to log in to access specific services, you may be able to control which users/roles have access
to what services through other means like Integrated Windows Authentication or even using a custom Security provider.

The first option works with the user/roles that are managed directly in MS Windows Active Directory server. This way you can take advantage
of the accounts already on your network. You would need to set up the permissions to your services based on these accounts. There is a
tutorial on this at http://resources.arcgis.com/en/help/main/10.1/index.html#/Securing_web_services_with_Integrated_Windows_Authentication/015400000517000000.

I would suggest taking a look at the 10.1 security section on the online resources Help section. They have a pretty good description of the
different options you can choose.

You may also want to ask some of these security-type questions on the main ArcGIS Server 10.1 -Windows or General discussion forum as well.

HTH,

Re: FV 3.0 Disable Secure Service Login

DasaPaddock — Fri, 06 Jul 2012 15:30:29 GMT

Also, the IdentityManager will not prompt the user for credentials if the server is not configured to use token based security.