How to print secured map services with Web Tier and Windows Authentication with Flex 3.7 and ArcGIS Server 10.3.1 ?

[WilliamRice]

Problem:  I have a web application that was created using ArcGIS Viewer for Flex 3.7.  From the Flex Print widget, I am unable to print a map containing secured map services.  I receive the error "Unable to connect to map server".  The ArcGIS Server Print task works without error if the map does not contain any secured map services.

Server software:  ArcGIS for Server 10.3.1

Client:                  ArcGIS Viewer for Flex 3.7

Web Server:         IIS

OS:                      Windows 2008 R2

Security Configuration:

a) In ArcGIS Server Manager, I have both the User and Role Store configured using the "Windows Domain" option.  Technical Note:  Because not all of our Windows Domain Controllers in our Windows Domain have the GC or Global Catalog role,  I have to manually configure a domain controller to use using the REST Admin.  I can see all of my Windows users and Windows Groups in Manager.

b) Web Adaptors:  I have two web adaptors installed.  One web adaptor for the public map services and a second web adaptor for the restricted, secured map services.  The web adaptor for the restricted/secured map services is configured in IIS to use Windows Authentication.

This issue is similar to the bug described in Knowledge Base Article # 41982 for ArcGIS Server versions 10.1 and 10.2.

41982 - Unable to print secured services with web-tier authentication

Does anyone know of a work around for printing secured map services using Web Tier and Windows Authentication with Flex 3.7 and ArcGIS for Server 10.3.1 ?

[JonathanQuinn]

So the user running your ArcGIS Server Windows service is set to a domain user that is within a role that has access to the secure service you want to print?  That's the first step to try.  If that doesn't work, (there is a current issue with that workflow that affects some sites at 10.3.1 which is resolved at 10.4), go through this documentation ​and embed your active directory credentials within the GIS Server connection.

[WilliamRice]

Jonathan,

Yes, I have the ArcGIS Server Service running using a Windows Domain user account and also have the Windows Group containing that user account applied to the ArcGIS Server services folder containing the secured services.  This method worked for printing of secured services from the ArcGIS Viewer for Flex apps with ArcGIS Server 10.2 but this method does not work with 10.3.1.

Using the documentation reference provided above, Printing maps that contain secured services, I have published to ArcGIS Server a new Print service containing the Export Web Map tool.  The next step is for me to create a long duration token using the ArcGIS Token Service with the URL of "http://name:6080/ArcGIS/tokens/generateToken , correct ?  Then, how do I use that token?  Do I pass that token in the URL of the <taskurl> attribute of the Flex Print widget?  I am not seeing any examples in the Esri ArcGIS Server documentation or REST API documentation for passing the token in a REST URL.

[JonathanQuinn · Accepted solution]

You'll need to embed the credentials within the Export Web Map tool within the toolbox you're using.  Steps 7 and 8 cover that part.  Your print task checks against what services the user embedded within the print task has access to, generates the authentication and authorization information required to access the services, and then prints them.  You should be configuring the print task with a GIS Server connection where your active directory credentials are saved within the print task: