Intercepting REST, SOAP, and OGC service requests

Map and image services support three different types of requests:

• REST API requests
• SOAP API requests
• OGC requests

In order for an SOI to intercept these requests, you need to implement the following interfaces:

• IRESTRequestHandler—for handling REST API requests
• IRequestHandler2—for handling SOAP API requests including requests made by ArcGIS for Desktop clients (such as ArcMap)
• IWebRequestHandler—for handling OGC requests

Even if a particular service configuration does not support OGC requests, you need to handle all of the above interfaces. Depending on the business logic you are implementing there are two general approaches you can take.

If you are implementing an SOI that will perform security functions, then it is recommended that you begin by implementing all the above interfaces and blocking all requests. As you implement your custom code, you can logically allow access through the above interfaces. If you do not initially block incoming requests and subsequently allow access as desired, you run a greater risk of inadvertently exposing a security vulnerability.

If you are not implementing security functionality, you could implement the three interfaces by passing all requests through to the underlying standard implementation in order to allow normal functionality. Then subsequently add additional business logic to the one or more operations you want to enhance.

When a service is configured with an SOI, the server framework routes all service requests to the SOI. It is the responsibility of the SOI to filter the requests, delegate the request to the actual map or image service objects (if applicable), and then optionally further process the responses before returning it to the client.

Implementing layer-level access control

If you implement layer level-access control through an SOI, you'll also need to configure ArcGIS Server's REST handler to disable caching of all layer resources included the service. This will allow you to intercept operations and filter out layers which are not allowed. You can disable this by setting the service's disableCaching property to true in the ArcGIS Server Administrator Directory.

1. Open the ArcGIS Server Administrator Directory and sign in. The URL is typically formatted http://gisserver.domain.com:6080/arcgis/admin.
2. Click services and click the name of the desired service. If you don't see it in the list, it may be located within a folder in this directory.
3. Click edit.
4. In the properties section of the service JSON, add the disableCaching property and set its value to true, for example:

   "properties": {
     ...
     "disableCaching": "true",
     ...
    },

5. Click Save Edits.