How to implement user authentication

• 1. Create OAuth credentials

  Create developer credentials in your organization's portal.

• 2. Implement an OAuth flow

  Add authorization code to your app.

• 3. Make a request

  Use an access token to authorize service requests.

ArcGIS APIs and SDKs

User authentication is typically implemented using an ArcGIS Maps SDKArcGIS Maps SDKs are developer products for building mapping and spatial analysis applications for web browsers, native devices, and game engines.Learn more or a scripting API such as ArcGIS REST JSArcGIS REST JS is a collection of JavaScript modules that can access ArcGIS location services and ArcGIS Enterprise services.Learn more or the ArcGIS API for PythonArcGIS API for Python is a pythonic library for performing GIS visualization, analysis, data management, and GIS system administration tasks.Learn more. These libraries make it easy to implement user authentication using the built-in AuthenticationManager and IdentityManager classes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
        const info = new OAuthInfo({
          appId: "YOUR_CLIENT_ID",
        });


        esriId.registerOAuthInfos([info]);
        esriId
          .checkSignInStatus(info.portalUrl + "/sharing")
          .then(() => {
            handleSignedIn();
          })
          .catch(() => {
            handleSignedOut();
          });

        document
          .getElementById("sign-in")
          .addEventListener("click", function () {
            esriId.getCredential(info.portalUrl + "/sharing");
          });

        document
          .getElementById("sign-out")
          .addEventListener("click", function () {
            esriId.destroyCredentials();
            window.location.reload();
          });
        let map;

Manual implementation

User authentication can also be implemented manually by making direct requests to the proper REST API endpoints. To do so, typically make a request to the authorization endpoint and token endpoint of your organization's portal serviceA portal service provides the functionality to securely create, access, and manage content, data services, users, and groups in a portal. The service can be hosted by Esri or in ArcGIS Enterprise.Learn more

This example shows how to implement an OAuth 2.0OAuth 2.0 is an industry standard protocol for authorization. It defines how to obtain and manage credentials for web, desktop, and mobile applications. It is supported by ArcGIS.Learn more authorization code flow with PKCE without an ArcGIS API.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
            const authorizationEndpoint = 'https://www.arcgis.com/sharing/rest/oauth2/authorize'+
            '?client_id=' + clientId +
            '&code_challenge=' + codeChallenge +
            '&code_challenge_method=S256' +
            '&redirect_uri=' + window.encodeURIComponent(redirectUri)+
            '&response_type=code'+
            '&expiration=20160';

            signInButton.addEventListener('click', () => window.open(authorizationEndpoint, 'oauth-window', 'height=400,width=600,menubar=no,location=yes,resizable=yes,scrollbars=yes,status=yes'));

            signOutButton.addEventListener('click', () => updateSession(false));

            const oauthCallback = (authorizationCode) => {

                const tokenEndpoint = 'https://www.arcgis.com/sharing/rest/oauth2/token';

                fetch(tokenEndpoint, {
                    method:'POST',
                    body: JSON.stringify({
                        client_id:clientId,
                        grant_type:'authorization_code',
                        code:authorizationCode,
                        redirect_uri:redirectUri,
                        code_verifier:codeVerifier
                    }),
                    headers: {
                        "Content-type": "application/json; charset=UTF-8"
                    }
                })

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

<!DOCTYPE html>
  <head>
    <title>ArcGIS user authentication OAuth 2.0 callback (vanilla JS)</title>
  </head>
  <body>
    <script type="module">

        const match = (window.location.search) ? window.location.search.match(/\?code=([^&]+)/) : false;
        // if we found an authorization code in the URL, pass the token up to a global function in index.html
        if(match[1]) {
            window.opener.oauthCallback(match[1]);
        }
        window.close();

    </script>
  </body>
</html>

Generate token flow

The generate token flow can be used in situations where it is not possible to implement secure OAuth 2.0 flows. This flow requests an access tokenAn access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication.Learn more by making a request to the /generateToken endpoint that includes an unencrypted username and password.

1
2
3
4
5
6
curl https://www.arcgis.com/sharing/rest/generateToken \
-d 'f=json' \
-d 'username=USERNAME' \
-d 'password=PASSWORD' \
-d 'referer=https://www.arcgis.com' \
-d 'client=referer'

1
2
3
4
5
{
  "token": "iX_oSlAphdxzi...",
  "expires": 1609488000000,
  "ssl": true
}

ArcGIS APIs and SDKs

If you use user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more with an ArcGIS Maps SDKArcGIS Maps SDKs are developer products for building mapping and spatial analysis applications for web browsers, native devices, and game engines.Learn more, the AuthenticationManager or IdentityManager classes automatically handle authentication with the access token, requiring no additional action from you.

The examples below show how to display a map in apps that implement user authentication.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
        function handleSignedIn() {

          map = new Map({
            basemap: "arcgis/topographic", // basemap styles service
          });
          const view = new MapView({
            map: map,
            center: [-118.805, 34.027], // Longitude, latitude
            zoom: 13, // Zoom level
            container: "viewDiv", // Div element
          });

        }

ArcGIS REST APIs

If you implement user authentication manually, your application can include the access tokenAn access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication.Learn more in requests to REST APIsArcGIS REST APIs are the API specifications for all ArcGIS location services and ArcGIS Enterprise services. They define the operations, parameters, and structures required to make HTTPS requests.Learn more by setting the token parameter.

This example shows how to geocode an address with the geocoding serviceA geocoding service is a service that can search for addresses, place addresses, businesses, reverse geocode coordinates to addresses, provide suggestions for places, and perform bulk geocoding. It is hosted by Esri as the ArcGIS Geocoding service and can also be hosted in ArcGIS Enterprise.Learn more.

1
2
3
4
curl https://geocode-api.arcgis.com/arcgis/rest/services/World/GeocodeServer/findAddressCandidates \
-d "f=pjson" \
-d "address=1600 Pennsylvania Ave NW, DC" \
-d "token=<YOUR_ACCESS_TOKEN>"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
{
    "spatialReference": {
      "wkid": 4326,
      "latestWkid": 4326
    },
    "candidates": [
      {
        "address": "1600 Pennsylvania Ave NW, Washington, District of Columbia, 20500",
        "location": {
          "x": -77.036548499999995,