I'm trying to do a query on a secure service from Silverlight using token based security. It is using the proxy (.ashx & .config) provided by esri). I have stepped through the proxy.ashx in the debugger and can see that it is able to succesffuly request a token and append it to the url.
For testing purposes, I have published the exact same service twice (with slightly different names), once to an unsecure folder, and also to a secure folder. If I access the service in the unsecure folder everything works fine, so I there shouldn't be anything wrong with the service. However, when I acces the service in the secure folder I get the error: {"error":{"code":400,"message":"Unable to complete operation.","details":["Invalid URL"]}}
This URL accesses the unsecure service and works: https://devserver/ArcGIS/rest/services/LayerUnsecureTestWMAS/MapServer/0/query?returnGeometry=true&spatialRel=esriSpatialRelIntersects&where=1+%3d+1&outFields=NAME&f=json&&token=n2zK5kYcIdtQKKXyRXAl4afg3dP9VSLWem-quUBtAFp95ibQeynJMuSD1KGCGIuu
This URL accesses the secure service and produces the Invalid URL error: https://devserver/ArcGIS/rest/services/LayerSecureTestWMAS/MapServer/0/query?returnGeometry=true&spatialRel=esriSpatialRelIntersects&where=1+%3d+1&outFields=NAME&f=json&&token=n2zK5kYcIdtQKKXyRXAl4afg3dP9VSLWem-quUBtAFp95ibQeynJMuSD1KGCGIuu
The proxy appears to append the token regardless of whether or not the service is secure, so the token is the same. The only difference in the URLs is the name of the service ("LayerUnsecureTestWMAS" vs. "LayerSecureTestWMAS").
If I delete one of the characters in the token, the unsecure URL still works, but the secure URL error changes to "Invalid token".
Any ideas what migth be causing this error?
Incidentally, I am able to access the secure service in a web application. in ArcGIS I created a web application and added the LayerSecureTestWMAS as a layer(specifying username and password) , and it worked fine.
I answered my own question. The problem was I did not understand the service folder structure. Since the service was published to a secure folder called SecureServices, that folder name must be in the URL.
