SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Building Secure Applications

adolfo avatar
adolfo
24 diapositives · 440 Views · Jul 13, 2014

2013 Esri International User Conference July 8–12, 2013 | San Diego, California. Technical Workshop. Building Secure Applications. Dasa Paddock, David Cordes & Tom Shippee. What’s covered in this session. Key secured application terms Common secured service use cases

Building Secure Applications - slide 1
01 / 24Building Secure Applications
1 / 17

Télécharger la présentation

Building Secure Applications
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. 2013 Esri International User Conference July 8–12, 2013 | San Diego, California Technical Workshop Building Secure Applications Dasa Paddock, David Cordes & Tom Shippee

  2. What’s covered in this session • Key secured application terms • Common secured service use cases • Implementing OAuth-based apps Building Secure Applications

  3. What’s covered in other security sessions Enterprise Architecture ArcGIS Online Security and ArcGIS Online Designing an Enterprise GIS Security Strategy Building Secure Applications ArcGIS Online & Cloud Computing Security Best Practices Securing ArcGIS Services Advanced Securing ArcGIS Services Introduction Best Practices in Setting Up Secured Services in ArcGIS for Server Core ArcGIS Server Building Secure Applications

  4. Common use cases for secured services How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  5. Key secured application terms Understanding the concepts… Building Secure Applications

  6. Understanding authentication • Key security decision • Configured by the GIS admin • Specific to a given ArcGIS server site • Can occur at different levels • Web server (e.g., IIS) • Application (e.g., GIS Server) • Verifies credentials against a user store • Web server requires Windows Active Directory (AD) • Groups and roles can be stored elsewhere Building Secure Applications

  7. Web Server level authentication • Implementation • Configured in the web server (e.g., IIS) • Runs in browser before the app is called • Web tier authentication in ArcGIS Server • Login models • Integrate Windows Authentication (IWA) • Pass Windows login credentials • Basic or Digest • Challenges with a login dialog Building Secure Applications

  8. Application level authentication • Implementation • Web server MUST be configure for anonymous access • Token-based • ArcGIS Server uses server tokens • ArcGIS Online uses portal tokens • Requires server or portal token service • GIS server tier authentication in ArcGIS Server • Login using ArcGIS Identity manager • Handles all login and token processing • Supported in all Web APIs Building Secure Applications

  9. What is single sign on? • Integrate Windows Authentication (IWA) • Sign in once to Windows • Supporting apps automatically passed Windows credentials • Same user credentials • Sign in multiple times using the same credentials • SaaS Application • AGOL model login once to the application • Token stored as an application cookie Building Secure Applications

  10. What is OAuth? • Industry standard enterprise authentication system • Login redirected to enterprise security server • Application NEVER see credentials • Works with SAML • Server based mechanism that handles login requests • Supported by AGOL for enterprise authentication • More in final section… Building Secure Applications

  11. Common secured service use cases Apps to access secured services Building Secure Applications

  12. Use case: Identity Manager How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  13. Identity Manager • Why should I use it? • Handles all login and token processing • Works with default token security model AGS & AGOL • Available in all Web API’s & viewer apps • What should I watch out for? • Only works for token secured services • Prompts multiple times rather than ignoring services Building Secure Applications

  14. Use case: Impersonation How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  15. Impersonation: Embedded credentials • To be completed… • To be completed… Building Secure Applications

  16. Use case: Integrated Windows Authentication How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  17. Integrated Windows Authentication (IWA) • To be completed… • To be completed… Building Secure Applications

  18. Use case: PKI How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  19. PKI • To be completed… • To be completed… Building Secure Applications

  20. Implementing OAuth-based apps Industry standard enterprise logins Building Secure Applications

  21. Use case: OAuth How service URLsauthenticate Application (server & portal tokens) Web server (e.g., IIS) Single sign on or User login User login Impersonated AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Browser-based Authentication via Application Level Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI

  22. OAuth implementation details • To be completed… • To be completed… Building Secure Applications

  23. Thank you… Please fill out the session evaluation First Offering ID: 1421 Online – www.esri.com/ucsessionsurveys Paper – pick up and put in drop box Designing and Using Cached Map Services

  24. Building Secure Applications