I have a multi-tenant web mapping application running on ArcGIS server. I am trying to replace with geoserver. Identity of the users for tenants are maintained through another identity api. After successful login Api generates the session token through get token service for a user passing the fixed credentials. Geoserver provides Digest and http header method- but is there a way to generate unique tokens for every session- so that no information related to user authentication is hard coded in client side code and all the communication between client application and geoserver is happening with a session token similar to this:
https://xxxxx/rest/services/xxxxx/MapServer/export?bbox=xxxxx&size=1393%2C85&dpi=96&format=png24&transparent=truelayers=show%3A1&token=2Cj8mUHLD5jD2fNNZ8SO-bP-94.&f=image
[GIS] How to create services with session tokens in geoserver
geoserverSecurity
Related Solutions
If you use Fiddler when you are firing a token authentication you can see the response (403 Forbidden etc).
I used this when first setup FME Server with security - this uses the same Token method and is not unique to ArcGIS REST but REST with security. It is likely to be either software security issues or the webserver refusing the users request.
This Token Security (via proxy) on an ArcGIS Server (Javascript) might be useful for your application http://forums.arcgis.com/threads/33714-Token-Security-on-an-ArcGIS-Server-%28Javascript%29
When you connect to a secured web site with a non-IE Browser, the login credentials you use will be re-used when you connect to the same web site.
If you are using two different web sites, then the user will be prompted again when their browser tries to connect to the second web site.
You are certainly able to generate a token for a client to consume later. However, I would recommend just using the integrated authentication for both your viewer and the ArcGIS Server, as generating a token on-the-fly will sometimes lead to problems if the client does not provide sufficient information for your to generate the token. (for example, Silverlight running in Firefox will not provider a Referer header if the request was a GET)
Here's how my test machine is set up for Windows authentication:
Best Answer
There is a community plugin for
authkey: https://docs.geoserver.org/stable/en/user/community/authkey/index.html