FeatureService WorkspaceConnectionString with Portal Token

[marco_vertigis]

Hi there,

I am currently searching for advise on how to provide a portal token within a feature service workspaceConnectionString.

Within the ExportWebMapSpecification there is the possibility to directly insert a token on a layer basis

in order to access secured feature services:

"operationalLayers":[
 {
   "id":"<webmapOperationalLayerId>",
   "url":"<url1>",
   "token":"<tokenString1>",
   "title":"<title1>",
   "opacity":<opacity1>,
   "visibility":"<true | false>",
   "minScale":<minScale1>,
   "maxScale":<maxScale1>
 }
]

 I am wondering if there exists some similar behaviour within the Definition of a CIMFeatureLayer more specifically in its CIMFeatureTable and the underlying CIMStandardDataConnection. Unfortunately there is no documentation on whats supported within the WorkspaceConnectionString property.

There is a property called "TOKENPROVIDERTYPE" so there is some hidden way to inject a token for authentication?

URL=<arcgis-server-url>/services/<feature-service>/FeatureServer;USER=;ENCRYPTED_PASSWORD=XXXXXX;TOKENPR...}

  Any help or hint to a documentation would be appreciated!

[CharlesMacleod]

hi marco, can u try something like this:

var lyr_params = new LayerCreationParams(....) {
  ServiceCustomParameters = new Dictionary<string, string>(){
    {"TOKENPROVIDERTYPE","1234567890abcdefgh...etc...."}
  }
};

the dictionary can be any set of (string, string) key/value pairs fyi

[marco_vertigis]

Hi Charles, thanks for your response!

I made some experiments with your hint and could not achieve what I want.

I did the following, first I tried to set the token as suggested by you with the "ServiceCustomparameters" Property:

var lyrx = new LayerDocument(@"C:\layer.lyrx");
var cimLyrDoc = lyrx.GetCIMLayerDocument();
var token = "<token>";
var lcp = new LayerCreationParams(cimLyrDoc);
lcp.ServiceCustomParameters = new Dictionary<string, string>()
{
	{ "TOKENPROVIDERTYPE", token },
	{ "TOKEN", token }
};
var lyr = LayerFactory.Instance.CreateLayer<FeatureLayer>(lcp, map);
var cimLyr = lyr.GetDefinition() as CIMFeatureLayer;

Unfortunately Pro always prompts the Credentials Window as soon as "CreateLayer" is called. Afterwards the ServiceCustomProperties does not seems to be appended to the CustomParameter Field of the CIMStandardDataConnection Object. https://pro.arcgis.com/en/pro-app/latest/sdk/api-reference/topic14849.html

I did not find any hint within the layer or its CIM structure that the token got appended somewhere. Is this a BUG?

Secondly I made some testing with arcpy.

> aprx = arcpy.mp.ArcGISProject("CURRENT")
> aprx.activeMap.listLayers()
> lyr = aprx.activeMap.listLayers("broken-layer")
> lyr.getDefinition("V3")
> cim_layer.featureTable.dataConnection.customParameters
# Custom Parameters are empty on the broken layer
[]
> lyr.isBroken
True
# try to set the custom parameters by hand
> cim_map = arcpy.cim.CIMStringMap()
> cim_map.key = "TOKEN"
> cim_map.value = "<token-value>"
> cim_layer.featureTable.dataConnection.customParameters.append(cim_map)
> cim_map2 = arcpy.cim.CIMStringMap()
> cim_map2.key = "TOKENPROVIDERTYPE"
> cim_map2.value = "<token-value>"
> cim_layer.featureTable.dataConnection.customParameters.append(cim_map2)
> cim_layer.featureTable.dataConnection.customParameters
[<arcpy.cim.CIMSymbolizers.CIMStringMap object at 0x0000026CAD106310>, <arcpy.cim.CIMSymbolizers.CIMStringMap object at 0x0000026CAD1065E0>]
# As soon as the definition is set, Pro again prompt the credentials dialog
> lyr.setDefinition(cim_layer)
# still broken even with the token as custom parameter set
> lyr.isBroken
True
> cim_layer = lyr.getDefinition("V3")
> cim_layer.featureTable.dataConnection.customParameters
[<arcpy.cim.CIMSymbolizers.CIMStringMap object at 0x0000026CAC0A08E0>, <arcpy.cim.CIMSymbolizers.CIMStringMap object at 0x0000026CAC0A0880>]

Either I am misunderstanding the customParameters property on the CIMStandardDataConnection wrongly or it does simply not work.

Any further ideas on how I can authenticate my layer with a generated portal token?

EDIT: I even manually exported the broken layer into a .lyrx file and appended the token key value pair to every customProperty/customParameter Field I could find. No effect at all. Lyrx file is attached.

[marco_vertigis]

@CharlesMacleod Any response to this? I have the feeling this feature does not work at all.

[CharlesMacleod]

hi marco, sorry, missed your follow on q. i spoke w/ the development team and it "should" work. they cant repro. they're going to put a sample add-in together for u.

note: is it that the token is not being sent or that the server is rejecting the token?

[CharlesMacleod · Accepted solution]

hi marco, so it's a bug. custom parameter properties in a layer file shld work. the dev team has submitted an issue. if u want to, u can open a bug report with Tech Support and they can link the internal issue to the bug report allowing u to track progress.

The only thing working, it seems, per the dev team, as currently is if custom parameters are added directly to the URL - for example:

{
        "type" : "CIMFeatureTable",
        "displayField" : "STATE_NAME",
        "editable" : true,
        "dataConnection" : {
          "type" : "CIMStandardDataConnection",

          "customParameters" : [  <----- this is ignored! bug
            {
              "type" : "CIMStringMap",
              "key" : "token",
              "value" : "QVoIg1fwLpgBMAiov2v6P1CYanOHEn27wFNfQI4IoJfB8SG3qfUmnhJZeSS05yyj"
            }
          ],
                                           This shld work (note the url)
          "workspaceConnectionString" : "URL=https://acme.server.com/arcgis/rest/services/Acme_Layers/MapServer;CUSTOMPARAMETERS=token=QVoIg1fwLpgBMAiov2v6P1CYanOHEn27wFNfQI4IoJfB8SG3qfUmnhJZeSS05yyj",   

          "workspaceFactory" : "FeatureService",
          "dataset" : "5",
          "datasetType" : "esriDTFeatureClass"
        },
        "studyAreaSpatialRel" : "esriSpatialRelUndefined",
        "searchOrder" : "esriSearchOrderSpatial"
      }

[marco_vertigis]

Hi Charles, thanks for your response! I was able to manipulate the 'workspaceConnectionString' and pass a Portal token. Really appreciate it!