Secured Services

[HeatherHainsworth]

Ok I am trying to set up a silverlight application that will connect to secured services.

I have done this in flex (on IIS6) and had no issues, but silverlight (on IIS7, where the services are IIS6) is causing me issues.

my main.xaml
<UserControl x:Class="securedServices.MainPage"
   :
  <Grid x:Name="LayoutRoot">
        <esri:Map x:Name="MyMap" Background="White" Extent="-8872918, 5397570, -8797798, 5443301">
            <esri:Map.Layers>
                <esri:ArcGISDynamicMapServiceLayer ID="Neighbourhoods" 
                                                Token="_QmVAPVTU9z3T3OwG41RZysTMqRwL5wwOWpf019qj5a6Ywshg7HMmEkMVsHuBo1bHjVVMdoqOfuzEkTF7rF1JQ.."
                                                   Opacity="0.5" Visible="True"
                      Url="https://MACHINENAME/ArcGIS/rest/services/Secured/Neighbourhoods/MapServer" />
            </esri:Map.Layers>
        </esri:Map>
    </Grid>
</UserControl>

Token was created using the token page and referencing the referer url as https://localhost/securedServices

There is a clientaccesspolicy file on the ArcGIS Server hosting machine
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-methods=�?�*">     
        <domain uri="*"/>
      </allow-from>     
      <grant-to>     
        <resource path="/api" include-subpaths="true"/>
      </grant-to>     
    </policy>
  </cross-domain-access>
</access-policy>

when I run the application I get a Security Exception error, talking about a crossdomain violation.

So not sure what I am missing here...

[dotMorten_esri]

Is your Silverlight app also hosted on a HTTPS website? Silverlight gets a little picky when trying to talk to HTTPS hosted services. We blogged about this earlier:
http://blogs.esri.com/Dev/blogs/silverlightwpf/archive/2009/08/31/Using-services-across-schemes.aspx
This blogpost might also be of interest:
http://blogs.esri.com/Dev/blogs/silverlightwpf/archive/2010/02/15/How-to-use-secure-ArcGIS-Server-se...

[HeatherHainsworth]

First, I tried creating a second output directory and enabling SSL on it so then changing my secured service to use this output directory rather than the normal one but I still get security violations. I am hosting the application on my computers IIS which I have enabled a Self SSL certificate on and I am using a https address as the referrer address to the application.

This question may all be a mute point though, the way I read that article it implied that if my base map is not a secured service, that I will not be able to use it if I am calling it from a HTTPS web URL?

[HeatherHainsworth]

So

I have a virtual directory / Application in IIS7 that is called securedServices, I have enabled SSL on that directory
I have a virtual directory in IIS7 that is called arcgisoutputhttps, that I have enabled SSL

I have a dynamic map service on a remote machine, that has an SSL certificate
The Map service is pointing to the arcgisoutputhttps virtual output directory

I have a application in visual studio that is compiling to the IIS7 location mentioned above called securedServices. VS is configured to run the application as https://localhost/securedServices The web application references the web service use https://MACHINE/ArcGIS/rest/services/Secured/Neighbourhoods/MapServer

I have generated a token using the gettoken page, (this is just phase one, phase two of this project will be to set up the proxy). so my call to the map service looks like this.

<esri:ArcGISDynamicMapServiceLayer ID="Neighbourhoods" 
                                                   Token="_QmVAPVTU9z3T3OwG41RZysTMqRwL5wwOWpf019qj5a6Ywshg7HMmEkMVsHuBo1bHjVVMdoqOfuzEkTF7rF1JQ.."
                                                   Opacity="0.5" Visible="True"
                      Url="https://MACHINE/ArcGIS/rest/services/Secured/Neighbourhoods/MapServer" />

So based on the chart from the blog I am going for the last entry in the last table where the hosted application is HTTPS and the service schema is https... what am I missing though?

[dotMorten_esri]

what am I missing though?

First of all, a description of what problem you are now seeing happening after these changes? What Initialization failure (if any) do you get on your layer? What is the Fiddler log teling you?

[HeatherHainsworth]

Sorry, I am still getting the same error, the Security Exception while trying to connect to the REST Endpoint. Fiddler doesn't provide any errors just says it is trying to connect to the machine through the SSL port (being 443).

[dotMorten_esri]

Sorry, I am still getting the same error, the Security Exception while trying to connect to the REST Endpoint. Fiddler doesn't provide any errors just says it is trying to connect to the machine through the SSL port (being 443).

So are you saying that the app is actually requesting the layer information and map from the services, but the service is returning an error, or are you saying that you don't see any requests going to the service? Does the client access policy file get requested? Do you see anything after that? All this information is important to understand what is going on.
Also see this post: http://blogs.esri.com/Dev/blogs/silverlightwpf/archive/2009/08/24/Troubleshooting-blank-layers.aspx

[JasonHansel]

hhainsworth,
I am trying to set up the same configuration. Could you share how you got htis to work in Flex on IIS 6.0? I have tried pointing the DYnamic ArcGIS Service to a secured virtual directory, however, when I try to add directory in Manager, I get denied. Any help would be appreciated.

Thanks Jason.

"I have a virtual directory / Application in IIS7 that is called securedServices, I have enabled SSL on that directory
I have a virtual directory in IIS7 that is called arcgisoutputhttps, that I have enabled SSL

I have a dynamic map service on a remote machine, that has an SSL certificate
The Map service is pointing to the arcgisoutputhttps virtual output directory"