How to make WebMap App URL private?

[TheoFaull]

Hi all,

I've made a web map app with sensitive data. I want to share the map with people within my company using the URL of the map.

These people aren't in my ArcGIS Online 'organisation' or any of the groups on there, so in order for them to access the URL link, I have to share the map with 'everyone (Public)'.

However I'm worried anyone in the world could now find the map online and access it. Is this true? How can I get around this problem?

I think there needs to be a 'private URL' option when sharing these online maps.

Thanks,

Theo

[RobertScheitlin__GISP]

Theo,

  You have to use one of your AGOL named users and provide it to them to login. Esri allows you to buy more named users for this exact scenario.

[TheoFaull]

Ok, but we also plan to share it with 100s of our customers. Again, we only want customers who are sent the URL to be able to view the map. How can we do this?

Theo

[RobertScheitlin__GISP]

Theo,

   Do you plan to have 100s of customers login to this app?

[TheoFaull]

Well, ideally I don't want them to have to login to it. We just want a secret link on our website for them to visit (they'll be sent an email revealing the link). We don't want to have to provide 100s of usernames and passwords. Or buy 100s of named user accounts.

Perhaps it's possible for me to remove all indexing tags on the web map? So it's 'un-searchable' on ArcGIS Online?

[RobertScheitlin__GISP]

Theo,

   Then you will definitely want to go the Proxy route then. I have a thread (quite a long one) where I walk someone through setting this up.

https://community.esri.com/thread/165919 

Additional links:

Setting up a proxy with Web AppBuilder Developer Edition | Support Services Blog 

Setting up a Proxy | Support Services Blog 

GitHub - Esri/resource-proxy: Proxy files for DotNet, Java and PHP. 

[TheoFaull]

Thanks Robert, although that thread probably holds the answers, it looks way like it's way past my IT/networking expertise!

proxies... jsons.... etc etc.

Anyway, I still think ESRI need to develop a 'share privately' option. So only those with the URL can access the map.

Theo

[JeffSauder]

Hi Theo,

The proxy makes it so they don’t have to log in, the rules pass that to the web page and “log in” automatically for the user. It’s the only way to keep your map / layers secure, without resorting to buying hundreds of user accounts (and making everyone log in every time, that wouldn’t go over well here). I wouldn’t just publish it to everyone and hope no one outside sees it, that’s kinda risky (our attorneys wouldn’t be happy if I did that). Portal is another solution, then you could keep the data from going outside your firewall, so sharing with everybody shouldn’t be an issue in that scenario.

I am trying to get this proxy set up myself, ESRI support has been helping me since I can’t get it working, but once we get it done, it should be done, and other apps I put together should be able to use it as well. I think I’m in the same boat as you, we are a town with over 800 internal users (different map apps, like fire dept, planning/development, public works, etc.) but all users that would need an account without the proxy solution.

Leaving our old environment and getting into this has definitely proved to be a challenge, for sure, in all aspects, from arcgis online to wab to javascript. I am getting through this piece by piece (somewhat) but the user support is really good. I will also read through the workflow from Robert, to see if that will help me get this proxy up and running.

Best of luck Theo,

Jeff

[JeffSauder]

You should be able to use a proxy with rules that contain the clientID and client secret for your organization, so any requests going to your site will go through the  proxy and then pass the info the secured app

Here's some info:  http://doc.arcgis.com/en/web-appbuilder/manage-apps/use-proxy.htm

I've have the same issues as you do, Theo, and am working to try and get this to work with the proxy.  If you try this let me know if you have success.

Jeff

[TheoFaull]

Thanks Jeff, but as soon as I read 'proxy with rules' I lost you!

It all sounds a bit fiddly and IT focused.

I'll have a read through that link and if I understand anything, I'll let you know!

Theo