A common workflow in distributed collaborations between ArcGIS Enterprise organizations is to share map, feature, and image services by reference. In these cases the data isn’t copied, but the service URL is made available to all Enterprise organizations participating in the collaboration. This allows it to be searched for and added to web maps and web apps. That’s great, but if the service is secured (not shared with everyone), users trying to access the service must provide credentials to view the data. These are not their own credentials but rather credentials for a user from the originating Enterprise organization. In many cases, this requires administrators to set up additional accounts and requires users to remember another set of credentials, which can be a lot of overhead. Many organizations asked for a way to make these shared services accessible without needing to provide credentials.
At 10.8 we added the ability to save Viewer credentials for all services shared by reference using distributed collaboration. While possible in 10.8, it was a bit difficult to find that resource in the REST API.
At 10.8.1 we added the option to make these changes from directly within the Enterprise portal. This means a user with the privilege ‘Collaborations’ can edit a collaboration workspace and enable or disable this feature. Let’s take a closer look.
In the example below, from within the Enterprise portal under Organization > Settings > Collaborations, a ‘Sharing_Services’ collaboration has already been established.
When I click on the Sharing_Services collaboration, I see the list of workspaces defined for the collaboration.
If I click on the workspace, information about the workspace is displayed including the new option to “Allow participants to view services without signing into this portal”. The new option is circled below.
Click on Edit to add, remove, or update these credentials.
The credentials entered here must belong to a member assigned a Viewer user type and the member must have access to the group associated with the workspace. If credentials are entered for a member with any other user type assigned or the member does not have access to the group, you will receive an error.
Once saved, these credentials are encrypted and used by the other participating Enterprise organizations. Any existing services that have already been shared with collaboration groups will be updated with the credentials and any new service shared will have the credentials saved by default. When a user accesses the shared services in one of the recipient Enterprise organizations, they will no longer be asked to provide credentials, providing a seamless experience.
If the credentials are removed from the workspace, the existing services will be updated and restored to the original urls. A user that accesses the shared service from a recipient Enterprise organization will be required to enter credentials to view the service.
There are a few things to remember:
- This ability to save Viewer credentials is only available in Enterprise to Enterprise collaborations. It is not available when collaborating with ArcGIS Online.
- Since these saved credentials are for a member with the Viewer role, it is not possible to perform any edits on shared feature services, as Viewers only have privileges to view content, not edit.
- This feature is available in ArcGIS Enterprise release 10.8 and later. Any participating Enterprise organizations with earlier releases will not be able to take advantage of this.
More information is available in the ArcGIS Enterprise help documentation including details on how to add the Viewer credentials to a workspace as a collaboration host or as a collaboration guest.
Hi – this is a great enhancement. Are there plans to enable this functionality for Enterprise to Online collaborations?
No, at this time there are not plans to enable this for Enterprise to Online collaboration. This is due to licensing on ArcGIS Online.
Are there still no plans to enable this for an Enterprise to Online collaboration?
The fact that this functionality is not available for Enterprise to AGOL collaborations is very frustrating. I am developing an internal site on our enterprise for non-GIS folks to view an entire catalog of their agency’s data curated from various locations (AGOL, standalone servers, and Enterprise). Not all of this data is intended to be publicly shared. The fact that I must have an account in both platforms for users to be able to view data sourced in AGOL seems to contradict the fact that a “distributed collaboration (or simply collaboration) is based on a foundation of trust between participating… Read more »
Hi Jeff,
Thank you a lot for the article, I did exactly the same, but still prompt me for authentication, is it normal ?
Other question, if the collaboration is ok and credentials are saved, can we use the REST service in an application (configured with guest identity) without asking for credentials ?
Hi Jeff,
I tested this setup on my machine with two VMs (10.8.1 and 10.9.1 Enterprise) and was able to access the items without requiring authentication.
However, with production portals (both 10.9) that are accessible via the internet, we are still prompted to login even though we did exactly the same steps in adding Viewer account.
Are there any other prerequisites?