Integrated Windows Authentication (IWA) is used in some ArcGIS Enterprise federated environments to let users authenticate automatically with their Windows credentials.
Support for IWA varies across VertiGIS Studio products because some components run in the browser, while others make server-side requests that cannot negotiate Windows authentication on behalf of the end user.
Problems occur when web-tier authentication is required, and anonymous access is disabled on the ArcGIS Portal Web Adaptor. When anonymous access is enabled, a token is issued when users sign in and VertiGIS Studio works as expected.
IWA support by VertiGIS Studio Product
| Product | IWA Support (Supported / Not Supported / Partial) | Notes |
|---|---|---|
| Web | Partial | IWA sign-in works in managed browser environments where the portal and services are in the intranet zone. Cross-origin requests and embedded scenarios may not support IWA credential passthrough reliably. Portal token authentication is recommended. |
| Mobile | Supported | Mobile device users will see two prompts: the first to enter Windows credentials, and the second to enter ArcGIS Enterprise credentials. |
| Printing | Not Supported | The print service runs server-side and cannot pass the end user's Windows credentials to secured map services. |
| Reporting | Not Supported | The reporting engine makes server-side requests to data sources and feature services and cannot perform IWA credential negotiation on behalf of the user. |
| Workflow | Partial | Activities in client workflows that run in the browser context may work with IWA in supported browser configurations. Activities in server workflows cannot use IWA and require token-based access. |
| Access Control | Supported | |
| Search | Partial | Requires additional custom configuration and a second Web Adaptor |
What Partial support means
Partial support means IWA may work in specific browser-based or managed environments, but it is not reliable across all deployment patterns. In practice, this usually applies to browser sessions that can negotiate Windows authentication directly with ArcGIS Enterprise services. If the product component makes cross-origin, embedded, or server-side requests, IWA may fail and a token-based approach is required.
Recommendations
- Use portal token authentication for VertiGIS Studio solutions.
- Migrate systems that use web-tier integrated Windows authentication to use SAML or OpenID Connect.
- Validate authentication behavior in your target browser, network zone, and deployment architecture before going live.
Comments
0 comments
Please sign in to leave a comment.