KB484310: Support Basic Auth for ESRI Proxy

As described in our Geospatial Product Help, there may be circumstances where you want or need to use a proxy for the ESRI server. For example, you might have security tokens that you do not want to be visible on your local ESRI server. Or you may have requests that exceed the limit on the length of the uniform resource locators (URLs) imposed by the browser. Or you may have CORS limitations on the local ESRI server.
Using a proxy for the ESRI server can get around all these problems. However, if your local ArcGIS server resides “behind” the WAF (web application firewall) and the web container such as Tomcat (running the ArcGIS web adaptors) requires the Basic Auth, using the access token in the

esriproxy.jsp

will not pass the authentication.
 
In this case, you need to follow the steps below to enable Basic Auth:
 
Add a new

<serverUrl>

entry for each service that will use the proxy. The

proxy.config

allows you to use the serverUrl tag to specify one or more ArcGIS Server services that the proxy will forward requests to. The serverUrl tag has the following attributes:
 

• url: Location of the ArcGIS Server service (or other URL) to proxy. Specify either the specific URL or the root (in which case you should set matchAll="false").
  
• matchAll="true": When

  true

  all requests that begin with the specified URL are forwarded. Otherwise, the URL requested must match exactly.
  
• username: Username to use when requesting a token - if needed for ArcGIS Server token based authentication.
  
• password: Password to use when requesting a token - if needed for ArcGIS Server token based authentication.
  
• tokenServiceUri: If username and password are specified, the proxy will use the supplied token service uri to request a token. If this value is left blank, the proxy will request a token URL from the ArcGIS server.
  
• useAppPoolIdentity: When

  true

  , the IIS application pool identity will be used for authenticating with secured resources. This configuration will supersede the domain, username, and password configurations. The default is

  false

  . Only applies to DotNet proxy.
  
• domain: The Windows domain to use with username/password when using Windows Authentication. Only applies to DotNet proxy.
  
• clientId. Used with clientSecret for OAuth authentication to obtain a token - if needed for OAuth 2.0 authentication. NOTE: If used to access hosted services, the service(s) must be owned by the user accessing it, (with the exception of credit-based esri services, e.g. routing, geoenrichment, etc.)
  
• clientSecret: Used with clientId for OAuth authentication to obtain a token - if needed for OAuth 2.0 authentication.
  
• oauth2Endpoint: When using OAuth 2.0 authentication specify the portal specific OAuth 2.0 authentication endpoint. The default value is  ArcGIS Portal Directory .
  
• accessToken: OAuth2 access token to use instead of on-demand access-token generation using clientId & clientSecret. Only applies to DotNet proxy.
  
• rateLimit: The maximum number of requests with a particular referer over the specified rateLimitPeriod.
  
• rateLimitPeriod: The time period (in minutes) within which the specified number of requests (rate_limit) sent with a particular referer will be tracked. The default value is 60 (one hour).
  
• hostRedirect: The real URL to use instead of the "alias" one provided in the

  url

  property and that should be redirected. Example:

  <serverUrl url="http://fakedomain" hostRedirect="http://172.16.85.2"/>.

  
  

Note: Refresh the proxy application after updates have been made to

proxy.config

 
The following example demonstrates a proxy using application credentials and limiting requests to ten per minute.

<serverUrl url="http://route.arcgis.com"
    clientId="6Xo1d-example-9Kn2"
    clientSecret="5a5d50-example-c867b6efcf969bdcc6a2"
    rateLimit="600"
    rateLimitPeriod="60"
    matchAll="true">
</serverUrl>

The following example demonstrates a tag for a resource that does not require authentication.

<serverUrl url="http://sampleserver6.arcgisonline.com/arcgis/rest/services"
    matchAll="true">
</serverUrl>