Authentication

Authentication settings for an upgraded REST provider are stored on the AUTHENTICATION node under the server node in the MapDrawerProviders configuration. The AUTHENTICATION node has one or more child authentication nodes that define settings for specific GIS services.

These authentication methods are supported:

  • TOKEN: Username/password or long-lived token authentication
  • OAUTH: Application client ID/secret authentication (named user)

Esri licensing requirements

Esri licensing terms govern which authentication type you must use depending on the context of access. Understanding these requirements is critical to remaining in compliance.

Context Required authentication type Reason
GIS Sync, background jobs, or any headless system-to-system process TOKEN No named user is involved.
Map Browser, Map Drawer, or any component where a human user interacts with secured map layers OAUTH Esri requires named user authentication whenever there is user interaction.

Using a generic token to render secured map layers for end users in Map Browser or Map Drawer is a violation of Esri licensing terms. Esri requires named user authentication (OAUTH) any time there is user interaction with secured services.

Best practice

As a best practice, configure a separate child authentication node under the provider's AUTHENTICATION node for each context:

  1. TOKEN node: Used by GIS synchronization and any background processes that do not involve user interaction.
  2. OAUTH node: Used by Map Browser and Map Drawer components for all interactive, user-facing map access.

This separation ensures that:

  • Background processes can authenticate efficiently using service credentials.
  • Interactive map access complies with Esri named-user licensing requirements.
  • Your configuration clearly distinguishes what is technically possible from what is contractually allowed.

Token authentication

Use token authentication only for headless operations such as GIS synchronization and background batch processes where no user interaction occurs.

You can use either a short-lived token or a long-lived token. Specify these attributes on the authentication node for a short-lived token:

  • Server URI: Specify the URI of the server.
  • Token Service URI: Specify the URI of the service that generates tokens.
  • Authentication Type: Specify TOKEN.
  • Username: Specify the user name.
  • User Password: Specify the password.

Specify these attributes on the authentication node for a long-lived token:

  • Server URI: Specify the URI of the server.
  • Authentication Type: Specify TOKEN.
  • Access Token: Specify the long-lived access token.

OAUTH (named user) authentication

Use named user authentication for all user-facing GIS operations, including Map Browser and Map Drawer. Specify these attributes on the authentication node:

  • Authentication Type: Specify OAUTH.
  • Application Client ID: Specify the client ID to use for authentication.
  • OwningSystemUri: Specify the URI of the system that owns the server.
  • RedirectUri: Specify the redirect URI to use for authentication.