Secure data is an important part of building a mobile application. If you need to use secured content for your app, particularly if that secured content comes from multiple portals, web maps, or layers, you need to set up access to that secured content.
GXM uses Esri Identities and an Esri portal - either ArcGIS Online or on-premises Portal for ArcGIS - to control access to data that needs to be secured. Esri's portal-to-portal sharing options ensure that you can reference or copy data between portals to ensure that users can access content on different portals.
GXM also supports access options such as:
Token-based server-secured services, for example, published directly in ArcGIS Server 10.1 – 10.4.
HTTP AUTH server-secured services, for example, published directly in ArcGIS Server 10.1 – 10.4.
Non-Esri server-secured secured services, for example, an Open Geospatial Consortium (OGC) secured web map service.
This means that if you build a web map that contains server-secured access, you can still include that web map in your application, but the end user will be prompted to sign into each secured server, or realm, when they first attempt to access the secured data. If you include multiple secured layers on multiple servers, end users will have to go through multiple logins.
You cannot use the server-secured option to access secured data from other Esri portals. Neither Esri or GXM support this option. Any attempt to use this option will result in GXM not working. We strongly recommend that you use Esri's portal-to-portal access features. It is important to ensure that the Esri identity that is logged into the Esri portal where your GXM application is located, has the level of access it needs.
GXM does not support a GXM app referencing a secured web map (rather than secured layers within the web map) in a portal that is different from the portal where the application is located.
If a web map in a different portal is accessible but some of the layers within that web map have not been properly shared, GXM is likely to get into a non-responsive state because it cannot access the content.