WMS – Accessing WMS with Basic Authentication in ArcGIS Pro

arcgis-proauthenticationwms

I am trying to access a Basic-Auth secured WMS Service. When requesting the Capabilities document, the service will always list some layers, even without authentication. But with authentications, more layers should be listed.

Unfortunately it won't work, only publicly available layers are listed in ArcGIS Pro. When I look at the HTTP request I can not see an Authorization header.

What kind of authentication is used in ArcGIS Pro (or ESRI products in general) when adding username/password in the "Add WMS Server Connection" Dialog? How is this intended to work?

I am completely in control of said service, it is possible to debug and configure any way we like. At the moment it supports HTTP Basic only but other methods could be implemented. I tested this service with a Browser and QGIS, where everything works as expected.

Best Answer

Unlike QGIS for example, ArcGIS Pro won't just happily send user credentials in the initial Request. It tries without Authorization header first, expects a 401 Unauthorized Status and a WWW-Authenticate Basic Header in return. Then, and only then, the Authorization header with user credentials will be set. This is per the Spec, but happens to be a bit inconvenient.

In our case, we always want to answer with a Capabilities document, because we need authentication only for some layers. An unauthorized user will therefore just get a much shorter list of layers. An additional mechanism for distinguishing users is needed, I opted for an additional HTTP GET parameter in the URL.

Related Solutions

OpenLayers Authentication – Using HTTP Basic Authentication with OpenLayers

The solution we ended up with was to add an authenticating proxy server between the OpenLayers client and the backend WMS service. So instead of connecting directly to the WMS service the OpenLayers client connects to a proxy server which adds the required authentication headers to the requests.

Example code for creating the layers:

var layer = new OpenLayers.Layer.WMS( "background", "http://myproxyaddress.com/23ergwe435dw3463", {layers: 'basic'} );

Example Apache proxy configuration:

ProxyRequests     Off
ProxyPreserveHost On
SSLProxyEngine On
<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>
SetEnvIf Request_URI "23ergwe435dw3463" wms_provider_name
RequestHeader set Authorization: "Basic Xk12BLdVNzUo5UGl0po5Y" env=wms_provider_name
ProxyPass         /23ergwe435dw3463  https://wmsprovideraddress.com
ProxyPassReverse  /23ergwe435dw3463  https://wmsprovideraddress.com

You can have multiple proxy configurations using this style.

What you should put inside the Authorization quotes is just the base-64 encoding of the string "username:password" (without the quotes). For more information see this link: https://stackoverflow.com/questions/567814/apache2-reverse-proxy-to-an-end-point-that-requires-basicauth-but-want-to-hide-t

[GIS] How to use layers from trusted servers in ArcGIS Online

I have done this in the past, but I authenticated the secured service from our own server on the ArcGIS Online side. In my case, I just needed a single Feature Service to be used in an AGOL app. Not quite the same workflow, but it worked. Here are the steps I followed:

From your "My Content" tab, click "Add Item". Choose "ArcGIS Server web service".
Provide the URL to the secured service and enter your credentials. Choose the option to store the credentials with the item and do not prompt for authentication.
Share the service with the public or whatever groups need to see it.

Once it has uploaded and shared, all requests to the service will start with http://utility.arcgis.com/usrsvcs/servers/. I believe this is acting as a proxy on AGOL to communicate with the secured service.

And it even shows as logged in at the REST endpoint on AGOL with the credentials you provided:

You should now be able to publicly consume and edit this in an AGOL app.