How do you embed a private map or application into another website?

[BrettShaver]

We are looking to embed ArcGIS online maps and feature layers into a separate website but do not want to make this data available to the public.  Is this possible?

[KellyGerrow]

Hey Brett,

How will you limit the access to only the authorized users? Will you use ArcGIS Identities or control security in another way. Generally, if the data and app are shared publicly, other users will be able to find and access the app. If the content is not shared publicly, the app can still be embedded but the user will be prompted to sign in to provide their authorized username and password.

Oauth Samples:

Access ArcGIS Online items using OAuthentication | ArcGIS API for JavaScript 4.5 

Secure Rest Endpoint:

Limit access to public layers - Crowdsource Polling | ArcGIS for Local Government 

-Kelly

[BrettShaver]

Hi Kelly,

Thanks for the quick reply.  To give a bit more context on this:  We are currently developing our own "Project Portal"web-based application with Mendix (not ESRI portal) where people will sign in and see all sorts of information about the project (e.g. graphs, tables, calendars, etc.) but there will also be interactive maps.  Ideally, we'd like those embedded maps to pull hosted feature layers, or maps from AGOL.  It seems like we could embed the data or maps pretty easily if the data was public, but that's not an option due to security concerns.  We're happy to have all the users of the "Project Portal" also need an ArcGIS online account if that's necessary to maintain security - then we could manage access based on our current group settings.

Any thoughts or help would be greatly appreciated!

Thanks,

Brett  

[TrangKieu]

Hi Kelly, 
So after I authenticate to the ArcGis Online web portal. Trying to embed url link in the iframe of my web application and accessing using the same browser. This is my test map link: 

https://arcg.is/0D1qDa

Then I'm getting errors like 
Refused to display 'https://trangkieu.maps.arcgis.com/home/signin.html?returnUrl=https%3A%2F%2Ftrangkieu.maps.arcgis.com%2Fhome%2Fwebmap%2Fviewer.html%3Fwebmap%3D00d7646094624b49844448612f5d7f36%26extent%3D-115.5901%2C35.9023%2C-114.5759%2C36.3516' in a frame because it set 'X-Frame-Options' to 'deny'.

Note that the url has changed at this point. It seems like arcgis has rejected us.

I would have thought is signed into the portal would be just like signing in using the Oauth method above.

Can you shed some lights into this please? 

Many thanks.

Trang.