Embed external content in ArcGIS

This pattern relies on a primary user experience in an ArcGIS app, such as ArcGIS Experience Builder, ArcGIS Dashboard, other configurable web apps, or ArcGIS Pro. The desired integration embeds content from another system into the ArcGIS interface, in one of several common patterns:

• An entire <iframe> embed, which is supported in ArcGIS Hub and ArcGIS Enterprise Sites, in ArcGIS Experience Builder through the Embed widget, and in ArcGIS Dashboards as embedded content.

• Embedded HTML content shown in an popup, such as an embedded image. This is limited to supported HTML tags and can be used to show an image from a remote system or a link to a remote application or endpoint.

Integration patterns in ArcGIS

Various ArcGIS Enterprise or ArcGIS Online configurable apps can embed content through an <iframe> approach. Any app that consumes a web map can work with embedded image configured with a popup, including ArcGIS Pro and ArcGIS Maps SDKs.

Full support

Partial support

Use URL parameters

Many external web applications support a set of on-load configurable properties defined through URL parameters, such as https://myapp.domain.com/showdocument/docId=BND12 (Display a document with the identifier BND12). Using this integration pattern, it is common to dynamically set these URL parameters (controlling how the iframe application will load) using properties from the parent or business system application. For example, if the user is viewing a record with an identifier of BND12 in the ArcGIS application, the iframe can be defined to use a URL that loads the remote application from the external system with the data of interest already visible or a form or interface pre-loaded.

Best practices and challenges with <iframe> embeds

Historically, iframes have been a popular technology that also introduced a wide array of security challenges. This has led to a variety of browser limitations that are imposed on iframes, which can restrict functionality or ease of use across systems. A few key challenges include:

• Single sign-on is complicated. Browser standards often block the re-use of existing session cookies in an <iframe>, unless the domain of the <iframe> matches the domain of the parent content. This means that a user often must authenticate to the ArcGIS system that is embedded in the <iframe>, which will require a login interaction. If both the parent of the frame and the frame itself are authenticated through the same identity provider, users may expect a single sign on experience and be dissatisfied with a second login requirement. Some enterprise identity providers may also block the use of their sign-in dialog in an iframe, and other approaches such as carefully-crafted Content-Security-Policy headers may be required.

• To best address this issue, use the same domain (such as .domain.com) for both parent and iframe site, use the same single sign-on provider, and allow the app to automatically forward users to login as necessary.

• File downloads or uploads may be blocked. Browser security may block download of files from iframes, with a download link or download button in an embedded app not reporting an error or failure, but simply failing to download a file such as an export from a feature table. This category of issue is usually reported through a browser JavaScript console message.

• Screen size may negatively affect user interfaces. Iframes are frequently defined as a constant frame size in pixels, and apps that will be embedded should be designed for that expected view size. If the parent application can intelligently scale the iframe to the user’s screen resolution, users with larger screens may have a responsive experience, but a fixed size iframe will result in a small embedded window that may have a negative user experience. Embedded apps should be designed so all the primary UI elements and interactions can be accomplished in the provided screen area.

• Communications between the iframe and parent window are usually limited. While some <iframe> patterns support communications between the parent window and the <iframe> through protocols or patterns like postMessage, most ArcGIS applications do not provide this capability, so interactions in the iframe application do not affect the parent window, or vice versa.