Skip to content

Commit 7229845

Browse files
aloverroaloverro
committed
update arcgis configuration for usgov and other api fixes
1 parent 0d86912 commit 7229845

File tree

4 files changed

+213
-30
lines changed

4 files changed

+213
-30
lines changed

‎articles/planetary-computer/create-connection-arc-gis-pro.md

Lines changed: 213 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,12 @@ By the end of this guide, you'll be able to securely browse and access Microsoft
2828
> Before you begin, review [Register an application in Microsoft Entra ID](/entra/identity-platform/quickstart-register-app) for background information on app registration.
2929
3030
## Register web API application for ArcGIS Pro
31-
31+
### [Public](#tab/public)
3232
1. Open the Azure Portal and go to **Microsoft Entra ID**.
3333

3434
[ ![Screenshot showing a user selecting Microsoft Entra ID from Azure portal.](media/microsoft-entra-id.png) ](media/microsoft-entra-id.png#lightbox)
3535

36-
1. Navigate to **App registrations** \> **New registration**.
36+
1. Navigate to **App registrations** > **New registration**.
3737

3838
[ ![Screenshot showing new app registration.](media/new-app-registration.png) ](media/new-app-registration.png#lightbox)
3939

@@ -42,6 +42,7 @@ By the end of this guide, you'll be able to securely browse and access Microsoft
4242
- ArcGIS Pro
4343

4444
1. Set **Multitenant** as the account type.
45+
4546
[ ![Screenshot showing register an app ArcGIS Pro.](media/register-an-app-arcgis-pro.png) ](media/register-an-app-arcgis-pro.png#lightbox)
4647

4748
[ ![Screenshot showing new app registration ArcGIS Pro.](media/new-app-registration-arcgis-pro.png) ](media/new-app-registration-arcgis-pro.png#lightbox)
@@ -75,8 +76,87 @@ By the end of this guide, you'll be able to securely browse and access Microsoft
7576
1. Go to **API Permissions**.
7677

7778
- Add and grant admin consent for:
78-
- Azure Storage \> user_impersonation.
79-
- Microsoft Graph \> User.Read (This permission is enabled by default).
79+
- Azure Storage > user_impersonation.
80+
- Microsoft Graph > User.Read (This permission is enabled by default).
81+
82+
[ ![Screenshot showing howto configure the addition of API permissions.](media/add-api-permissions.png) ](media/add-api-permissions.png#lightbox)
83+
84+
1. **Grant admin consent** after permissions are added.
85+
86+
[ ![Screenshot showing how to grant admins consent.](media/grant-admin-consent.png) ](media/grant-admin-consent.png#lightbox)
87+
88+
1. Go to **Expose an API**.
89+
90+
- Add **App ID URI**.
91+
92+
[ ![Screenshot showing how to add the app id URI .](media/add-app-id-uri.png) ](media/add-app-id-uri.png#lightbox)
93+
94+
1. Define scopes:
95+
96+
- user_authentication (Display name: ArcGISPro-API-User-Auth)
97+
- user_impersonation (Display name: ArcGISPro-API-Impersonation)
98+
99+
[ ![Screenshot showing add user authentication scope.](media/add-user-authentication-scope.png) ](media/add-user-authentication-scope.png#lightbox)
100+
101+
[ ![Screenshot showing add user impersonation scope.](media/add-user-impersonation-scope.png) ](media/add-user-impersonation-scope.png#lightbox)
102+
103+
1. Select **Add a client application** and note the App ID.
104+
105+
[ ![Screenshot showing how to add a client app.](media/add-a-client-app.png) ](media/add-a-client-app.png#lightbox)
106+
107+
### [US Gov](#tab/usgov)
108+
1. Open the Azure Portal and go to **Microsoft Entra ID**.
109+
110+
[ ![Screenshot showing a user selecting Microsoft Entra ID from Azure portal.](media/microsoft-entra-id.png) ](media/microsoft-entra-id.png#lightbox)
111+
112+
1. Navigate to **App registrations** > **New registration**.
113+
114+
[ ![Screenshot showing new app registration.](media/new-app-registration.png) ](media/new-app-registration.png#lightbox)
115+
116+
1. Register the Web API app. Suggested names:
117+
- ArcGISPro-GeoCatalog-WebAPI or
118+
- ArcGIS Pro
119+
120+
1. Set **Multitenant** as the account type.
121+
[ ![Screenshot showing register an app ArcGIS Pro.](media/register-an-app-arcgis-pro.png) ](media/register-an-app-arcgis-pro.png#lightbox)
122+
123+
[ ![Screenshot showing new app registration ArcGIS Pro.](media/new-app-registration-arcgis-pro.png) ](media/new-app-registration-arcgis-pro.png#lightbox)
124+
125+
1. After registration, complete the following configuration within the new app registration ArcGIS Pro.
126+
127+
- Go to the **Authentication** tab.
128+
129+
- Add platform: **Web**.
130+
131+
[ ![Screenshot showing the selection to add a web platform type of authentication.](media/add-web-platform.png) ](media/add-web-platform.png#lightbox)
132+
133+
1. Set **Redirect URI**: <https://localhost>.
134+
135+
[ ![Screenshot showing how to add a redirect URI.](media/add-redirect-uri.png) ](media/add-redirect-uri.png#lightbox)
136+
137+
1. Add platform: **Mobile and Desktop applications**
138+
139+
[ ![Screenshot showing add mobile desktop app.](media/add-mobile-desktop-app.png) ](media/add-mobile-desktop-app.png#lightbox)
140+
141+
1. Set **Custom Redirect URI**: arcgis-pro://auth.
142+
143+
[ ![Screenshot showing configure desktop device.](media/usgov-mobile-redirect-1.png) ](media/usgov-mobile-redirect-1.png#lightbox)
144+
145+
1. In the new **Mobile and desktop applications** panel, select *Add URI* to add a second Redirect URI: https://login.microsoftonline.us/common/oauth2/nativeclient
146+
147+
[ ![Screenshot showing configure desktop device.](media/usgov-mobile-redirect-2.png) ](media/usgov-mobile-redirect-2.png#lightbox)
148+
149+
1. Enable **ID tokens** under **Implicit grant and hybrid flows**.
150+
151+
1. Select **Save**.
152+
153+
[ ![Screenshot showing enable ID tokens ArcGIS App authentication.](media/enable-id-tokens.png) ](media/enable-id-tokens.png#lightbox)
154+
155+
1. Go to **API Permissions**.
156+
157+
- Add and grant admin consent for:
158+
- Azure Storage > user_impersonation.
159+
- Microsoft Graph > User.Read (This permission is enabled by default).
80160

81161
[ ![Screenshot showing howto configure the addition of API permissions.](media/add-api-permissions.png) ](media/add-api-permissions.png#lightbox)
82162

@@ -103,7 +183,66 @@ By the end of this guide, you'll be able to securely browse and access Microsoft
103183

104184
[ ![Screenshot showing how to add a client app.](media/add-a-client-app.png) ](media/add-a-client-app.png#lightbox)
105185

106-
## Register desktop client application for ArcGIS Pro
186+
## Register desktop client application for ArcGIS Pro
187+
### [Public](#tab/public)
188+
189+
Register a second application (with a distinct name) to represent ArcGIS
190+
Pro Desktop and configure its API permissions --- ensuring it includes
191+
access to the web API exposed by the first application.
192+
193+
1. Create a second app registration for the ArcGIS Pro desktop client.
194+
195+
- Suggested name: ArcGISPro-GeoCatalog-DesktopClient or GeoCatalog-ArcGIS.
196+
197+
- Set account type: **Single tenant**.
198+
199+
[ ![Screenshot showing register second app arcgisprodesktopclient.](media/register-second-app-arcgis-pro-desktop-client.png) ](media/register-second-app-arcgis-pro-desktop-client.png#lightbox)
200+
201+
[ ![Screenshot showing new app registration GeoCatalog ArcGIS.](media/new-app-registration-geocatalog-arcgis.png) ](media/new-app-registration-geocatalog-arcgis.png#lightbox)
202+
203+
1. Configure the Desktop Client App.
204+
205+
Complete the following configuration within the new App registration GeoCatalog-ArcGIS.
206+
207+
- For **Authentication**, repeat the same steps as in Step 1:
208+
209+
- Add platform: **Web**.
210+
- Set **Redirect URI**: https://localhost.
211+
- Add platform: **Mobile and desktop applications**
212+
- Set **Redirect URI**: arcgis-pro://auth.
213+
- Enable **ID tokens** under **Implicit grant and hybrid flows**.
214+
- Select **Save**.
215+
216+
- **API Permissions**: Adding Access to the Web API App.
217+
218+
- In the **API permissions** tab, select **Add a permission**.
219+
220+
- Go to the **APIs my organization uses** tab and search for the **Web
221+
API app** created in Step 1 (for example, ArcGIS Pro).
222+
223+
- Select the app name to open the **Request API Permissions** screen.
224+
225+
[ ![Screenshot showing request API permissions.](media/request-api-permissions.png) ](media/request-api-permissions.png#lightbox)
226+
227+
- Select both user_authentication and user_impersonation; the delegated permissions defined in the first app.
228+
229+
- Select **Add permissions**.
230+
231+
[ ![Screenshot showing add API permissions ArcGIS Pro.](media/add-api-permissions-arcgis-pro.png) ](media/add-api-permissions-arcgis-pro.png#lightbox)
232+
233+
- Continue to add the following delegated permissions:
234+
235+
- **Azure Storage** > user_impersonation.
236+
- **Azure Orbital Spatio** > user_impersonation.
237+
- **Microsoft Graph** > User.Read (This permission is enabled by default).
238+
- Select **Add permissions**.
239+
- Select **Grant admin consent**.
240+
241+
[ ![Screenshot showing app selection on request API permissions screen.](media/app-selection-on-request-api-permissions-screen.png) ](media/app-selection-on-request-api-permissions-screen.png#lightbox)
242+
243+
[ ![Screenshot showing grant admin consents (4).](media/grant-admin-consents-4.png) ](media/grant-admin-consents-4.png#lightbox)
244+
245+
### [US Gov](#tab/usgov)
107246

108247
Register a second application (with a distinct name) to represent ArcGIS
109248
Pro Desktop and configure its API permissions --- ensuring it includes
@@ -127,8 +266,9 @@ access to the web API exposed by the first application.
127266

128267
- Add platform: **Web**.
129268
- Set **Redirect URI**: https://localhost.
130-
- Add platform.
269+
- Add platform: **Mobile and desktop applications**
131270
- Set **Redirect URI**: arcgis-pro://auth.
271+
- Add another **Mobile and desktop applications** Redirect URI: https://login.microsoftonline.us/common/oauth2/nativeclient.
132272
- Enable **ID tokens** under **Implicit grant and hybrid flows**.
133273
- Select **Save**.
134274

@@ -151,9 +291,9 @@ access to the web API exposed by the first application.
151291

152292
- Continue to add the following delegated permissions:
153293

154-
- **Azure Storage** \> user_impersonation.
155-
- **Azure Orbital Spatio** \> user_impersonation.
156-
- **Microsoft Graph** \> User.Read (This permission is enabled by default).
294+
- **Azure Storage** > user_impersonation.
295+
- **Azure Orbital Spatio** > user_impersonation.
296+
- **Microsoft Graph** > User.Read (This permission is enabled by default).
157297
- Select **Add permissions**.
158298
- Select **Grant admin consent**.
159299

@@ -166,6 +306,7 @@ access to the web API exposed by the first application.
166306
This section outlines how to configure authentication and data access in the **ArcGIS Pro desktop application**, using OAuth 2.0 integration with **Microsoft Entra ID** and access to the **Microsoft Planetary Computer Pro GeoCatalog**. It includes steps to add an authentication connection and create storage and STAC data connections.
167307

168308
## Add an authentication connection
309+
### [Public](#tab/public)
169310

170311
1. Open the **ArcGIS Pro settings** page in one of the following ways:
171312

@@ -186,6 +327,10 @@ This section outlines how to configure authentication and data access in the **A
186327

187328
- Enter your **Entra Domain** and **Client ID**.
188329

330+
- You can [find your **Entra Domain**](/partner-center/account-settings/find-ids-and-domain-names) (also know as your **Primary Domain**) from with Microsoft Entra ID from your Azure Portal
331+
332+
- Your **Client ID** is the client ID you set above in the **Add a client application** step.
333+
189334
- Add the following **scopes**:
190335

191336
- `https://storage.azure.com/.default`
@@ -203,6 +348,48 @@ This section outlines how to configure authentication and data access in the **A
203348
> [!TIP]
204349
> For more information, see the official ArcGIS Pro documentation [Connect to authentication providers from ArcGIS Pro](https://pro.arcgis.com/en/pro-app/latest/get-started/connect-to-authentication-providers-from-arcgis-pro.htm).
205350
351+
### [US Gov](#tab/usgov)
352+
353+
1. Open the **ArcGIS Pro settings** page in one of the following ways:
354+
355+
- From an open project, select the **Project** tab on the ribbon.
356+
- From the start page, select the **Settings** tab.
357+
358+
1. In the side menu, select **Options**.
359+
360+
1. In the **Options** dialog box, under **Application**, select **Authentication**.
361+
362+
1. Select **Add Connection** to add a new authentication connection.
363+
364+
1. In the **Add Connection** dialog box:
365+
366+
- Enter a **Connection Name**.
367+
368+
- For **Type**, select **Microsoft Entra ID**.
369+
370+
- Select **Azure US Government** under **Azure Environment**
371+
372+
- Enter your **Entra Domain** and **Client ID**.
373+
374+
- You can [find your **Entra Domain**](/partner-center/account-settings/find-ids-and-domain-names) (also know as your **Primary Domain**) from with Microsoft Entra ID from your Azure Portal
375+
- Your **Client ID** is the client ID you set above in the **Add a client application** step.
376+
377+
- Add the following **scopes**:
378+
379+
- `https://storage.usgovcloudapi.net/.default`
380+
381+
- `https://geocatalog.spatio.azure.us/.default`
382+
383+
[ ![Screenshot showing how to add a connection.](media/add-authentication-usgov.png) ](media/add-authentication-usgov.png#lightbox)
384+
385+
- Select **OK**.
386+
387+
- Sign in through the Authentication dialog and complete the prompts.
388+
389+
[ ![Screenshot showing how to sign in with the Authentication dialog.](media/sign-in.png) ](media/sign-in.png#lightbox)
390+
391+
> [!TIP]
392+
> For more information, see the official ArcGIS Pro documentation [Connect to authentication providers from ArcGIS Pro](https://pro.arcgis.com/en/pro-app/latest/get-started/connect-to-authentication-providers-from-arcgis-pro.htm).
206393
207394
## Prepare and record GeoCatalog information
208395

@@ -213,7 +400,7 @@ This section outlines how to configure authentication and data access in the **A
213400

214401
1. Select on the GeoCatalog. For example, **arcgisprogeocatalog**.
215402

216-
1. Record the **GeoCatalog URI**. For example, **https://arcgisprogeocatalog.\<unique-identity\>.\<cloud-region\>.geocatalog.spatio.azure.com**.
403+
1. Record the **GeoCatalog URI**. For example, **https://arcgisprogeocatalog.<unique-identity>.<cloud-region>.geocatalog.spatio.azure.com**.
217404

218405
[ ![Screenshot showing how to retrieve the GeoCatalog URI.](media/get-geocatalog-uri.png) ](media/get-geocatalog-uri.png#lightbox)
219406

@@ -224,17 +411,9 @@ This section outlines how to configure authentication and data access in the **A
224411

225412
1. Record the **Collection Name**. For example, sentinel-2-l2a-tutorial-1000.
226413

227-
1. Construct the **Token API Endpoint** using this pattern:
228-
229-
```bash
230-
\<GeoCatalog URI\>/sas/token/\<Collection Name\api-version=2025-04-30-preview
231-
```
232-
233-
Example:
234-
235-
```bash
236-
https://arcgisprogeocatalog.\<unique-identity\>.\<cloud-region\>.geocatalog.spatio.azure.com/sas/token/sentinel-2-l2a-tutorial-1000?api-version=2025-04-30-preview
237-
```
414+
1. Construct the **Token API Endpoint** using this pattern: ```<GeoCatalog URI>/sas/token/<Collection Name>?api-version=2025-04-30-preview```
415+
416+
- Example:```https://arcgisprogeocatalog.<unique-identity>.<cloud-region>.geocatalog.spatio.azure.com/sas/token/sentinel-2-l2a-tutorial-1000?api-version=2025-04-30-preview```
238417

239418
1. Select the collection name.
240419

@@ -247,13 +426,13 @@ This section outlines how to configure authentication and data access in the **A
247426
1. In the resulting JSON display, locate the key "**title:assets:thumbnail:href**" and copy the corresponding value. For example:
248427

249428
```bash
250-
https://\<unique-storage\>.blob.core.windows.net/sentinel-2-l2a-tutorial-1000-\<unique-id\>/collection-assets/thumbnail/lulc.png
429+
https://<unique-storage>.blob.core.windows.net/sentinel-2-l2a-tutorial-1000-<unique-id>/collection-assets/thumbnail/lulc.png
251430
```
252431

253432
1. Record the value of Account Name and Container Name:
254433

255-
- **Account Name**: for example \<unique-storage\>
256-
- **Container Name**: for example sentinel-2-l2a-tutorial-1000-\<unique-id\>
434+
- **Account Name**: ```<unique-storage>```
435+
- **Container Name**: ```sentinel-2-l2a-tutorial-1000-<unique-id>```
257436

258437
[ ![Screenshot showing collection json display.](media/collection-json-display.png) ](media/collection-json-display.png#lightbox)
259438

@@ -269,14 +448,16 @@ This section outlines how to configure authentication and data access in the **A
269448

270449
1. For **Authentication**, select the name of the auth profile that you created in previous steps.
271450

272-
1. For **Access Key ID (Account Name)**, use the **Account Name** value that you recorded earlier: \<unique-storage\>.
451+
1. For **Access Key ID (Account Name)**, use the **Account Name** value that you recorded earlier: <unique-storage>.
273452

274-
1. For **Bucket (Container) Name** use the **Container Name** value that you recorded earlier: sentinel-2-l2a-tutorial-1000-\<unique-id\>.
453+
1. For **Bucket (Container) Name** use the **Container Name** value that you recorded earlier: sentinel-2-l2a-tutorial-1000-<unique-id>.
454+
455+
1. Do not specify a **Folder**.
275456

276457
1. Add the provider option **ARC_TOKEN_SERVICE_API** and set the value to your **Token API Endpoint** that you constructed earlier. For example:
277458

278459
```bash
279-
https://arcgisprogeocatalog.\<unique-identity\>.\<cloud-region\>.geocatalog.spatio.azure.com/api/token/sentinel-2-l2a-tutorial-1000?api=version=2025-04-30-preview
460+
https://arcgisprogeocatalog.<unique-identity>.<cloud-region>.geocatalog.spatio.azure.com/api/token/sentinel-2-l2a-tutorial-1000?api=version=2025-04-30-preview
280461
```
281462

282463
1. Add the provider option **ARC_TOKEN_OPTION_NAME** and set the value **to AZURE_STORAGE_SAS_TOKEN**.
@@ -294,14 +475,16 @@ This section outlines how to configure authentication and data access in the **A
294475

295476
- Provide a name for the STAC Connection: For example, GeoCatalog_Connection.
296477

297-
- For Connection use the form```\<GeoCatalog URI\>/api```. For example,
478+
- For Connection use the form```<GeoCatalog URI>/stac```. For example,
298479
```bash
299-
https://arcgisprogeocatalog.\<unique-identity\>.\<cloud-storage\>.geocatalog.spatio.azure.com/api
480+
https://arcgisprogeocatalog.<unique-identity>.<cloud-storage>.geocatalog.spatio.azure.com/stac
300481
```
301482

302483
- Reference the Authentication settings made in previous step.
484+
485+
- Add **Custom Paramaters**: Name: ```api-version```, Value: ```2025-04-30-preview```
303486

304-
- Add the ACS connection file that was created in previous step to the STAC connection.
487+
- Add the ACS connection file that was created in previous step to the **Cloud Storage Connections** list.
305488

306489
- Select **OK**.
307490

‎articles/planetary-computer/media/add-authentication-usgov.png

49.9 KB
Loading

‎articles/planetary-computer/media/usgov-mobile-redirect-1.png

25.2 KB
Loading

‎articles/planetary-computer/media/usgov-mobile-redirect-2.png

77.3 KB
Loading

0 commit comments

Comments
 (0)