In the end we opened up a support issue with ESRI with the final answer being that at ArcGIS Server (Linux) 10.1 this is not an officially supported configuration. At 10.2 and above I am told that it is possible to mark services as being publicly available with web tier authentication enabled (I have not verified this myself).
However, I was able to find a workaround to get this working on 10.1. The workaround is based on a thread asking about the same setup with IIS/Windows. Unfortunately, Tomcat/Linux doesn't have an "Anonymous Authentication" feature like IIS does but the same affect can be achieved with a bit of hackery. Assuming your public user (as explained in the other thread) is named 'anonymous' it is possible via a Servlet Filter to make it appear as if the user has authenticated:
@WebFilter(servletNames = "agswebadaptor")
public class AnonymousFilter implements Filter
{
private String user = "anonymous";
@Override
public void init(FilterConfig filterConfig) throws ServletException { }
@Override
public void destroy() { }
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
{
chain.doFilter(new AnonymousRequestWrapper((HttpServletRequest) request, user), response);
}
private static final class AnonymousRequestWrapper extends HttpServletRequestWrapper
{
private final String user;
public AnonymousRequestWrapper(HttpServletRequest request, String username)
{
super(request);
this.user = username;
}
@Override
public String getRemoteUser() { return user; }
}
}
This ServletFilter will need to be added to the web adapter arcgis.war (unzip it and add the above compiled class to WEB-INF/classes) and the web.xml will need to be tweaked to use a Servlet 3.0 descriptor by replacing the first few lines with:
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
id="Web_Adaptor" version="3.0">
Once you've made the above modifications you can zip the arcgis.war back up and deploy it on Tomcat (I tested on Tomcat 7.0.59). When accessing this customized web adapter all requests to the ArcGIS Server will appear as authenticated to the 'anonymous' user (or whatever username you set the user variable to).
Hope this helps someone.
