We are developing Android mobile app using ArcGIS Runtime SDK for Android that shows map with basemap from ArcGIS Online and multiple layers from onsite GIS Server. GIS Server infrastructure sits behind firewall with a load balancer in DMZ.
F5 based load balancer is configured to authenticate requesting user as valid domain user. The mobile app would have established application VPN tunnel and will have session cookie. However, we are not sure how this session cookie can be passed to F5 load balancer since all calls to ArcGIS Map Services are made by MapViewer when map is zoomed or panned. There is no programmatic control to set session cookie or authentication header.
In the runtime code, we will have MapView object and will add ArcGISDynamicMapServiceLayer multiple times using Java code. However, we do not see any way to set session cookie or credentials either on MapView object or on ArcGISDynamicMapServiceLayer object. ArcGISDynamicMapServiceLayer constructor has UserCredentials parameter but it seems like ArcGIS Server credentials and not the credentials/token that can be used to authenticate user on the network. When F5 load balancer receives the request as URL to map service, it will not have any domain credentials or cookie and will be rejected.
This must be a common problem for all runtime apps deployed on devices that are not on the network. Has anyone able to resolve it?