Latest Contributions by DirkVandervoort

ArcGIS Server 10.3.1 When I try to configure a portal using my web adaptor "Portal URL = https://machine.domain.com:7443" I get the error: Failed to get administrator token from Portal. Please verify that the Portal URL specified can be accessed successfully. I'm confused: how can I successfully access the Portal URL when the Web Adaptor cannot create the URL? What am I missing? TIA ... View more

I've wallowed though probably all of Esri's online documentation regarding security and I am still not clear on this. What I want to do is use REST to do query a secure feature service. this all happens in node.js In order to do this in need to obtain a token by passing a username/password to the token dispenser, then append the token to the URL I am using to make my REST call. I know I can do this. What we don't like about this is that is uses a named user - which has, um, unpleasant issues I've discussed elsewhere on this forum. I'm still trying to wrap my head around OAuth. I see that I can register an app with OAuth, which gives me a client_id and client_secret. I use those to obtain an access_token, which I can use to... well... I'm not exactly sure what I can use it for. I do know that I ca not use it to fire queries at the feature service REST endpoint. If it were a perfect world I'd have my feature layer secured in a manner in which I can create a security to it using a client_id and client_secret. Or did I miss something...? Can I access a feature service with REST using a client_id and client_secret and if so, then how? So, my question is that, in general, and in the world of ArcGIS Server and Portal, REST endpoint are secured with REST tokens and registered apps are secured with OAuth and can be accessed with an access_token obtained with the client_id and client_secret, correct? Just checkin... ... View more

We are using ADFS to secure our portal - which is a non-ArcGIS web application. ADFS is the security store for ArcGIS Server and Portal. When the portal get loaded into the browser, it creates two cookies: MYagstoken: <cryptic_string_token> MYagsdetailsCookie: {"userId”:”[email protected]”,”expires":1461627081574,"creationTime":1461623481574} I have verified that the content of MYagstoken is a valid token that I can use to consume secure resources. The token times out in 60 minutes. I am using the ArcGIS Resource Proxy from github to identify the CORS resource but not to obscure a username/password. In other words: username/password is not allowed in the proxy.config and it is the person who logged in to the portal (non-ArcGIS web application) who has obtained the token from the AGS token dispenser via the cookies. We are NOT using the default login UI for IdentityManager. Our identities are created “elsewhere” and are stashed in the cookies. When our JSAPI application gets loaded into the browser it uses the cookies create an object that is used to initiate the IdentifyManager (esriId). var MYagsdetails = JSON.parse(MYagsdetailsCookie); var userId = MYagsdetails.userId; var expires = MYagsdetails.expires; var creationTime = MYagsdetails.creationTime; var serverInfo = {    server: "https://webadaptor.MyDomain.com/portal",    tokenServiceUrl: "https://webadaptor.MyDomain.com/portal/sharing/generateToken/",    hasPortal: true,    webTierAuth: false }; var credential = {    userId: userId,    server: "http://webadaptor.MyDomain.com/portal",   token: MYagstoken,    expires: expires,     validity: undefined,    ssl: true,    creationTime: creationTime,    scope: "portal"  // ”server" does not work }; var idObject = {    serverInfos: [serverInfo],    credentials: [credential] }; esriId.initialize(idObject); This successfully creates a credential that I can use for 60 minutes. There are a couple of oddities at this point: The following gets executing, indicating that the IdentityManager is successfully creating a credential. It should be noted that the token is a different string, although this token is valid as well. esriId.on("credential-create", function(e) {    console.log (Date().toLocaleString() + ' credential-create Credential: ', e.credential); }); The following event NEVER gets fired, even after the 60 minutes: esriId.on("dialog-create", function(e) { console.log (Date().toLocaleString() + ' dialog-create', e); }); The secured services cease to function inside the map. Pan and zoom and nothing happens. There was rich and dynamic map content for 60 minutes though… There are repeated error of “Invalid Token” indicating that the token never refreshed. It was my understanding that when a credential was created by the IdentityManager.initialize, that a timer was created that refreshed the token when it’s timed out. The bottom line is that there is no indication that the security has expired (dialog-create) or that a new credential is created (credential-create). FAIL. I’d like to do either one of two things: Institutional: Inform the user that their security has timed out and that they need to launch the map app again from the portal. This is the “not preferred by acceptable” alternative Technological: Refresh the IdentityManager credential with a new token that will give me another 60 minutes. This is the preferred option. So long as the portal application can create the the cookies (soon to be local storage). One other item: I’ve attempted to use a timer to recreate the IdentityManager credential using the code above and the cookies generated by the portal, but without success. For reasons I don’t understand, I’m just not able to rehydrate the IdentityManager so my users can continue working in the map application. Hope you can help... TIA ... View more

Say, for example we want to run some GIS automation against secured portal content that gets executed by a headless server, i.e., a non-human being. TIA ... View more

We have the full stack of ArcGIS Server and Portal hosted on-premise. We've authored a map service that is secured. In Portal we created a web map that uses an ArcGIS Online basemap and the secured map service. We then wrote a simple JS application that serves the web map. It requires the user to enter credentials - we do not want users to enter credentials, yet the map service must remain secure. Enter the proxy, download from Releases · Esri/resource-proxy · GitHub Following the instructions here: Sharing maps with secure layers | Guide | ArcGIS API for JavaScript, ...adding the appropriate urlUtils and proxy.configs Results in a 403 error. The JS is here: urlUtils.addProxyRule({    urlPrefix: "https://subdomain.domain.com",    proxyUrl: "proxy/proxy.ashx" }); arcgisUtils.arcgisUrl = "https://subdomain.domain.com/portal/sharing/content/items"; arcgisUtils.createMap("<WEB_MAP_ID>","map").then(function(response){}); The content of the proxy.config has: <serverUrl clientId="<ClientID>" clientSecret="<Client_Secret" rateLimit="0" rateLimitPeriod="1" matchAll="true" url="https://subdomain.domain.com/arcgis/rest/services/MapService/MapServer"/> As per the sample. Yet I still get the 403 GET https://subdomain.domain.com/proxytest/proxy/proxy.ashx?https://subdomain.domain…d189aa97?f=json&callback=dojo.io.script.jsonp_dojoIoScript1._jsonpCallback 403 (Forbidden) Can anyone with experience in this realm help provide insight for me please. TIA ... View more

If I emailed the URLhttp://www.arcgis.com/home/mobileviewer/appsharer.html?id=ac7e0840c3444ccbb69082ad99d18eeb and the recipient had Explorer for ArcGIS installed on their device, tapping the URL would  open the web map in Explorer. Is there a similar pattern where I can publish a web map that contains editable layer(s), then share a URLwhich includes the webmap id as a parameter, which will open Collector for ArcGIS when the link is tapped? If yes, what is the pattern for the URL? TIA ... View more