Hi @Anonymous,
The key difference here is that the ArcGIS is an incredibly special case: it's a core visual provided by a third party, rather than a custom visual, and as such is subject to elevated privileges in the main UI window.
Due to iframe sandboxing with custom visuals, there are two ways to work with external URLs at this time:
- Using the IVisualHost.launchUrl()method, which opens URLs in a new tab, after confirmation from the user running the report that this is okay. There's no callback functionality, so can't be used to persist cookies etc. back to the calling iframe.
- Async calls to endpoints that are seved over HTTPS and have an Access-Control-Allow-Origin of any (*).
I am aware of a couple of vendors whose visuals are part of a suite of services they provide and have had to manage auth back these systems in their custom visuals by providing users with resources such as user-specific API keys that they can add as properties to the visual and validate these using the second method.
Your scenario isn't something I've needed to explore previusly, but if I were to attempt your challenge and I'm using React, I might start with the following thought process:
- If I don't have a valid token, I could use React component state to present a 'login screen' to the user instead of the regular visual view.
- You might also be able to do this using the landing page API instead, so you have some specific workflow around it.
- If my authenticating endpoint can be served over HTTPS and is basically a web service, then I could use an async call from this form in my code to submit credentials and retrieve a token.
- As the request comes from an empty domain, there's no easy way to shore up your endpoint to accept requests specifically from Power BI.
- Therefore you may need some kind of additional key-based auth against your API that only the visual knows about to prevent potential DDoS scenarios.
- This token could be persisted into the visual's objects by setting up a place for it in my capabilities.
- This would be a proxy for cookies or other browser-based storage.
- You can also hide capabilities from the end-user, so that you can use them to store values you don't want exposing in the pane. I've done a simple example here - this is for show/hide based on another property, but you could just tell the method to always hide objects you don't want exposing in the UI.
- You could use IVisualHost.persistProperties to store a token in the visual's objects without any interaction from the user, ready for any updates or subsequent reloads.
- There's unfortunately no doc for this method, but you can find the interfaces needed for this to work in the typings.
- Note that this will trigger an update method in your visual, so if you're doing anything asynchronous while this is going on, you might want to wait for those to complete before firing this step.
- When the visual next fires up, you can retrieve this token as part of the regular settings parsing, and possibly check for validity and go back to the start if the token has expired for re-auth.
This is the result of a couple minutes' brainstorming, so not suggesting it's definitely a way to do this but might open some avenues for you.
Probably not the answer you were after, I'm sure, but hopefully may allow you to approach the challenge from a different angle.
Good luck,
Daniel
