topic Re: Is it possible to lock down the Web AppBuilders connection to an organization? in ArcGIS Web AppBuilder Questions

Is it possible to lock down the Web AppBuilders connection to an organization?

DavidYarnell — Thu, 19 Mar 2015 00:11:12 GMT

When a new user arrives at the Web AppBuilder (Developers Edition), they are prompted for the full URL of their portal or ArcGIS Online for Organizations subscription. This is practical for users running the application locally, but if we’re standing this up in a shared (or potentially public) deployment, we need to be able to lock this down to our organization’s subscription, and not allow users to specify a different URL. Is there a way to control this?

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

RobertScheitlin__GISP — Thu, 19 Mar 2015 01:59:20 GMT

David,

The Web AppBuilder Developer version is not meant to be an application that is shared amongst your users. You develop your app then you download your app and then deploy to a web server to be shared for your users.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

DavidYarnell — Thu, 19 Mar 2015 14:33:12 GMT

Robert, thanks for your response. I've been looking for a way to pass apps to another Web AppBuilder. For example if I make an app with my Web AppBuilder and deploy it, but then find that some changes need to be made, is there a way to take that app and give it to someone else to make the changes with their own Web AppBuilder? It seems like I should be able to copy the the application into the server\apps folder but my guess is there is more to it then that.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

RobertScheitlin__GISP — Thu, 19 Mar 2015 14:41:01 GMT

David,

Sure there is. In Web AppBuilder there is an import button on the main screen this allows you to import a configured app from AGOL. In Web App Builder Developer edition 1.1 released today there is also the option to import from local computer.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

StanMcShinsky — Thu, 19 Mar 2015 14:44:30 GMT

David,

I agree with Robert that Web AppBuilder is not meant to be shared like that. However one possible scenario could be this.

extract the developers version and place it on your web server in the C:\inetpub\wwwroot folder
manually start the .bat file then you will be prompted to add you organization account to the WAB start up page. If you make this a task to run at start up then you will probably need to add the organization manually every time anyway.
Leave the startup.bat file running on the server
Now multiple people can browse to the WAB start page (http://<servername>:3344/webappbuilder ) and start creating apps.

-Stan

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

DavidYarnell — Thu, 19 Mar 2015 17:44:44 GMT

Just downloaded the new version. Works great Thanks!

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

RebeccaStrauch__GISP — Thu, 19 Mar 2015 19:19:12 GMT

just to throw this out there, I was able to copy the entire WAB folder to a new machine, register it under the same app inAGOL and Fire it up on the second machine. It could see what I developed on the other machine...but local on the second machine. granted, keeping these in sync could become an issue right away, but it is possible to share that way. Most likely refreshing the entire web-app folder once in a while might work. It was just me playing, not sharing with someone else, so not testing in the real world.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

TorrinHultgren — Tue, 24 Mar 2015 23:24:25 GMT

We (David and I) successfully followed the instructions for running the WAB as a windows service, and multiple users can connect using either Esri or enterprise credentials (via SAML) and confgure applications, however two main concerns arose in our testing:

We don't seem to have the ability to lock access down to our organization - that is, any user can visit the site, enter their ArcGIS Online for Organizations URL (or even a portal URL) and use our custom standalone WAB with their portal. Not exactly the service we'd intended to provide to the public.
When a user connects, they are only shown applications that they have configured themselves, however on the file system applications are identified by simple integers (1,2,3,etc) and nothing prevents a user from specifying any integer and viewing and editing applications authored by other users (provided they have access to the same source web map). This is definitely a dealbreaker for use in a shared environment.

And although we had some success using IISNode and the IIS7 URLRewrite module to try and route traffic from port 80 to node.js in a controlled manner (without routing 100% of traffic there), there were too many calls to the node.js root (rather than a predictable, filterable path) to make this a practical reality similar to a tomcat webapp. Discussions with Esri's developers and support techs haven't gotten very far, if anyone else out there is trying to work through some of these details, we'd appreciate the discussion. Thanks!

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

RobertScheitlin__GISP — Tue, 24 Mar 2015 23:59:11 GMT

Torrin,

I believe that you are attempting to use Web AppBuilder in an unintended manner. My understanding of the Web AppBuilder design is that a developer or configurator will use Web AppBuilder to built a stemapp site and then that stem app is deployed for use to your intended audience. I don't believe that trough all my talks with the dev team that your workflow was ever intended to be supported.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

TorrinHultgren — Wed, 25 Mar 2015 17:39:43 GMT

Thanks, Robert, it sounds like our experience in discussing this pattern with Esri developers has been consistent with yours - that it wasn't anticipated or intended. Nevertheless, we have been hearing this functionality repeatedly and insistently requested by our customers - they want a Web AppBuilder experience similar to the ArcGIS Online version where they have the freedom not just to tweak a few widget settings on a preconfigured app, but to choose from an expanded list of widgets (and themes) in a fully online interface. And despite the fact that Esri seems to have not anticipated this scenario, the developer edition of Web AppBuilder functions surprisingly well in this shared environment, with only the few small aforementioned issues. We can and will submit this as an enhancement request on ideas.arcgis.com, but wondered whether the developer community was hearing similar requests and had already managed to hack together a solution. As always, very much appreciate your insight!

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

RichAlger — Wed, 24 May 2017 03:23:57 GMT

What did you end up doing, Torrin? Our organization wants to do something similar.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

TorrinHultgren — Wed, 24 May 2017 04:10:29 GMT

We never did get the developer edition working in anything other than a sandbox environment for "communal development", but this business case is one of the drivers towards us exploring Portal for ArcGIS. Portal's a heavy lift from a resource and management perspective, but it does offer at least a few compelling options not available in AGOL.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

Dvirus — Thu, 03 May 2018 15:36:31 GMT

Torrin Hultgren‌ Did you success to manage with IISNode and WAB 2.7 a full functional WAB expericnce ?

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

TorrinHultgren — Thu, 03 May 2018 16:05:01 GMT

No, it's pretty clear that Esri doesn't intend to support WAB as a standalone multiuser solution and their answer to this question is a full-fledged Portal installation. We've tested that, and it works fine - if you throw enough hardware at it. But that's only for the configurator portion of WAB . If you use either AGOL or Dev Edition for an initial configuration and then dump it out for further customization, it runs fine on any web server, no need for Node.JS or any other server-side components. We do a lot of that because of our limited hosting options.

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

Dvirus — Sun, 06 May 2018 20:20:09 GMT

Hi Torrin Hultgren‌

Thanks for reply.

If so, is there any point to building a settings screens for widgets?

according to that every 'save' to application the operator need to download it as zip and hosted in the IIS server ?!

What do you say about 'Hybrid' mode:

1. Host the folder C:\WebAppBuilderForArcGIS_2.7\server\apps in IIS

2. Need to change the api url at env.js file (in each app) - uncomment line 107

3. Continue to configure via the WAB SDK (Node app).

4.( after finish configure close startup.bat)

Is that make sense? or maybe there is other workflow?

The goal is to move the entire management (As much as possible) of the app to the portal interface so the operator can manage by him self most of the settings that relate to the app.

P.S

No, it's pretty clear that Esri doesn't intend to support WAB as a standalone multiuser solution and their answer to this question is a full-fledged Portal installation.

In which case you don't install the a full-fledged Portal?! How WAB SDK can work without portal?

How you will select Map?

A Lot of widgets 'talk' with portal items.. (Add Data widget for example..)

Re: Is it possible to lock down the Web AppBuilders connection to an organization?

TorrinHultgren — Mon, 07 May 2018 22:17:39 GMT

Hi Dvirus b‌,

We had been hoping for a solution where we could deploy WebAppBuilder running under Node.js, without portal, and federate it with our ArcGISOnline subscription to allow a customizable multiuser WebAppBuilder experience. That's the vision that we're giving up on because Esri's only supporting this scenario under a Portal umbrella. And while we're disappointed, we can think of some pretty defensible reasons why they chose that route, among them the concerns you raise.

To your first question - adding a settings screen for widgets is probably more helpful to those running WAB under Portal than those running standalone WAB - mostly because the latter are likely to be developers who skip past GUIs and go straight to config files. But it's still a best practice. Hope that helps.