Restrict access to flex using existing sql username and rolls

ChrisMahon · ‎12-10-2010

I'm currently hosting many internal sites by enabling security in arcgis manager. all works great. i'm using arcgis server 9.3.1 and currently all of my end user map applications are built using .NET.
I'm in the process of switching to Flex and would like to restrict access to my end user applications as well as my services. I was hoping to use the existing security settings in arcgis server so that when an end user hits my web mapping flex site to redirects to a login page. once authenticated the login redirects back to the 'swf' file and provided the proper credentials to arcgis server to allow access to the mapping services also as they currenly are locked down using arcgis server security settings.
Basically i want to use the existing sql user names and rolls already set up to lock the 'swf' file and then set the users credential to server to unlock the mapping services.
Any ideas??

grahamcooke · ‎12-13-2010

Hi Chris,

You can embed a swf in an aspx page, so the best way I've found to utilise .net security is to make a .net wrapper application with login page that redirects to the aspx page hosting your swf on successful authentication.

If you search for my username on here (or possibly the old forum at the esri.com address) you should find the.threads where this was discussed. Can't post links myself as I'm replying on my phone.

Hope this helps

ChrisMahon · ‎12-17-2010

Thanks for the tip.

I actually tried that but had some issues,

the code below is what i used, however it does not work in FireFox....works great in IE and Chrome. Many of my users (including myself) are Firefox users....?

Any ideas whats happening, i'm using FireFox version 3.6.13

Thanks

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Untitled Page</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>


            <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="100%" height="100%" id="index">
                <param name="movie" value="flex\index.swf" />
                <param name="quality" value="high" />
                <param name="bgcolor" value="#ffffff" />
                <param name="allowScriptAccess" value="sameDomain" />
                <param name="allowFullScreen" value="true" />
                
                <object type="application/x-shockwave-flash" data="flex\index.swf" width="100%" height="100%">
                    <param name="quality" value="high" />
                    <param name="bgcolor" value="#ffffff" />
                    <param name="allowScriptAccess" value="sameDomain" />
                    <param name="allowFullScreen" value="true" />
                
                
                    <p>
                        Either scripts and active content are not permitted to run or Adobe Flash Player version
                        10.0.0 or greater is not installed.
                    </p>
                
                    <a href="http://www.adobe.com/go/getflashplayer">
                        <img src="http://www.adobe.com/images/shared/download_buttons/get_flash_player.gif" alt="Get Adobe Flash Player" />
                    </a>
                
                </object>
                
            </object>




    </div>
    </form>
</body>
</html>

DasaPaddock · ‎12-17-2010

One approach is to just take the html wrapper (myapp.html) that Flash Builder creates for your app and copy it to myapp.aspx and then add the asp code to it.

HaroldBostic · ‎12-17-2010

I used this approach and it is working well http://www.amergerzic.com/post/FlexASPAuthentication.aspx

ChrisMahon · ‎12-23-2010

I was able to get this working

I tried wrapping the .html inside a .aspx file with some success but i could get it to work in FireFox - only IE and chrome.

I instead I created a folder inside a web mapping application built by AGS Manager - i enabled security from there also.
Then i copied my flex files from bin-debug into the new folder and did a redirect from the login.aspx to my .swf file.
This did not stop people from going straight to the .swf file, bypassing the security so i configured IIS as follows.

1.IIS Manager
2.Right click the website created in AGS Manager, click properties
3.on the "Virtual Directory Tab" click "Configuration button
4.Click the "Insert" button to add a Wildcard applicaiton map then browse to "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" and make sur e"Verify that file exists" check box is UNCHECKED

All works now and I can use AGS server to control the websites security.

Thanks to all

ChrisMahon · ‎12-23-2010

I used this approach and it is working well http://www.amergerzic.com/post/FlexASPAuthentication.aspx

Thanks

This link you provided looks very promising and the actual direction I wanted to take initially. I will test it out and post my results.

Thanks again!