Release Notes 4.13

What’s New

Authentication with ArcGIS Enterprise Portal or ArcGIS Online

You can now fully connect a map.apps installation with ArcGIS Enterprise Portal or ArcGIS Online. This allows users to log in to map.apps with their Portal or ArcGIS Online account via the OAuth 2.0 protocol. The assigned portal groups and portal roles are translated into roles for map.apps. These roles can then be used to control access to the map.apps manager, individual apps or specific tools. In addition, non-public content such as webmaps or layers can be used without logging in again (single sign-on).

Authentication with Keycloak (via OpenID Connect)

As an alternative to connecting to ArcGIS, it is now also possible to connect your map.apps installation to Keycloak. Using the roles assigned in Keycloak, you can then control access to the map.apps manager, individual apps or specific tools.

Order of search results

In map.apps 4.12, the ability to display results from multiple search topics simultaneously in a suggestion list was introduced. In this release, a configuration option is now introduced to define the order of search topics. In this way you can ensure that results from particularly important topics appear first.

Hide empty fields in popups

You can now hide fields that do not contain values in a popup. For each feature it is checked individually which fields are filled with values. The display of popups can thus be made much more compact and clearer, especially for map services in which empty values frequently occur.

Automatically expand entries in map content control (TOC)

With the help of a new configuration option, entries in the map content control can now be displayed automatically expanded at startup. This makes it easier for new users to find map content in deeper nested layers.

Accessibility improvements

Several improvements have been made to increase the accessibility of apps. The drawer menu, which is usually located to the left of the search, can now be operated more easily using the keyboard. In addition, so-called aria labels have been added or optimized in various places to improve the usability of screen readers.

New features for developers

New LayerStore implementation

In this release a new class LayerStore is introduced, which will replace the class ct/mapping/store/MapServerLayerStore in the agssearch bundle in the future. The class LayerStore is stored with an ArcGIS FeatureLayer instance and is therefore consistent with the content of the map (for example when using definition queries). The agssearch bundle now creates LayerStore instances by default in the class AGSStoreFactory and the configuration options AutoStoreRegistration and AGSStore.

Further new functions and improvements

  • The ArcGIS API for JavaScript used by map.apps as technical basis is updated to version 4.22 with this release. This results in numerous improvements and bug fixes in the base technology.

  • The use of material design icons as tool icons has been simplified.

  • The Proj4js library has been updated to version 2.7.5.

  • map.apps can now be used under Java 17.

  • The default value of client.config.requestMaxUrlLength has been reduced to "2048".

  • The bundle search-api now informs about the selected search result via the event system.

  • map.apps Proxy now supports bearer token based authorization.

A complete list of all changes can be found in Changelog.

Update Notes

New Database Tables

map.apps requires the new database tables IDENT_EXTSESSIONS, IDENT_SESSIONS, and IDENT_TOKENS.

Starting from this version, map.apps creates those tables when starting Tomcat if they do not exist already and the property db.hibernate.schemaUpdate=update in the appropriate config file is set. If you have not set or changed this setting so far, you do not need to make any changes.

If you wish to create the tables manually, instead, use the appropriate SQL script for your database in use:

Use of ArcGIS roles in map.apps

If you previously used roles derived from ArcGIS Enterprise Portal or ArcGIS Online groups in map.apps, this previously required the following notation: "user@@group". The syntax changes to "group::user" with this release.

Tools in the DockingBar in the Footer are no longer in a toggle group by default. If they are not to be opened at the same time, they must be assigned to a group.

Discontinued Features

The following features are discontinued with this release:

  • Java 8 — With this version, running map.apps with Java JRE 8 is no longer supported. We recommend using Java 17.

  • Tomcat 8.5 — With this version, running map.apps in Tomcat 8.5 is no longer supported. We recommend using Tomcat 9.0.

  • As of this release, line 3 bundles are no longer included in the rollout folder. For more details on the map.apps line 3 lifecycle, see the lifecycle overview .

  • The Advanced Configuration (Bundles) section has been removed from the live configuration.

  • The eventservice which was needed in line 3 for the Follow Me function has been removed.

  • The font directionsUiFont has been removed.


  • Esri ArcGIS API for JavaScript 4.22.2

  • ArcGIS Arcade 1.16

  • Moment.js 2.29.1

  • Vue.js 2.6.14

  • Vuetify.js 1.5.24



map.apps was not affected by the vulnerability known as Spring4Shell. However, to be absolutely on the safe side, we have updated the Spring Framework version to 5.3.18 in this version.


Update Spring Framework to version 5.3.18


Fixed Security Issues


Fix CVE-2021-22060

New Features


[Accessibility] Add aria labels to icon buttons


[Accessibility] Add aria-disabled to disabled ui elements


[agssearch] LayerStore: implement support for feature layers that are not in the map


[apprt] Introduce logging API for better control of log output of bundles


[Layout] Simplify usage of material design icons as tool-icon


[Live Configuration] Remove "Advanced Configuration (Bundles)" section


[map.apps Proxy] Support Bearer Token based Authorization


[monaco-editor] Update to 0.30.1


[Popups] Hide empty values


[Portal Integration] Allow custom role mapping via


[Portal Integration] Consume custom services in protected app


[Portal Integration] Consume portal items and federated protected services in protected app


[Portal Integration] Do not force login when app item is shared with public


[Portal Integration] Prepare Maven Plugins for new authentication


[search-api] Provide information about selected result


[Search] Define order of search stores


[Security] Use Keycloak for user management


[System] Support Java 17


[System] Update ArcGIS API for JavaScript to version 4.22


[System] Update jackson-databind to (CVE-2020-36518)


[templatelayout] Change default value of property 'WidgetDefinitions._keepWindowOpenState' to true


[Templates] Remove toggleMode from dockingBarBottomLeft


[TOC] Allow to expand group on start


Allow definition of custom setters for injected '_properties'.


Provide a store implementation that directly searches on a layer


Reduce default value of client.config.requestMaxUrlLength to 2048


Remove event service from mapapps web app


Update proj4.js to 2.7.X for nadgrid support

Fixed Issues


[app-mgmt-service] app.json cannot be loaded with dynamic bundles


[apprt-core/Promise] Unhandled promise rejections are not logged


[apprt-core] Observers cannot handle recursive calls to clean()


[Authentication] Wrong error handling during activation of AuthenticationWidgetController


[AutoStoreRegistration] Changing definitionExpression property of a layer is not observed


[AutoStoreRegistration] Stores are registered multiple times in some cases


[Bundle documentation] Wrong locateme tool ID


[Coordinate Viewer] Wrong scale is shown in web mercator projection


[ct-proxy] proxy.allowedSSLDNs not working as expected


[jsregistry] Version of bundles mangled and changed when uploaded


[Legend] Classes are listed in wrong order


[Live Configuration] Editor in custom info bundle is blocked by csp restrictions


[LoginUI] Missing Aria-Labels for username and password field


[Manager] Portal sharing icon gets lost


[Map] Configured ground layer throws error in 2D views


[map-init] initInvisibleLayerStrategy: on-visible does not work in firefox


[MapNavigation] Initial extent not reset correctly


[parametersearch] result items not transformed to map spatial reference system


[Popups] Custom popup actions are not added again


[Portal Registration] Old oauth client id is used if app is re-registered at portal


[Resultcenter] Paging wrong for services with different speed


[Search / map-actions] Popups do not resolve domain values / coded values


[Selection] Error if multiple selections are started fast in a row


[TemplateLayout] Standalone exported app does not start in firefox if no files in cache


[Templates] Missing template scope for tocWidget definition in template-seasons


[Templates] Unexpected closing of windows on browser resize


[TOC] Prevent inlining HTML in description


[TOC] StateInfoTooltip disappears in Firefox when placing toc on right side


[Tools] Child HTML element of a tool uses the same "id" attribute


[Toolset] Drawer toolset is not navigatable by keyboard


[Toolsets] Collapsed Toolsets are not navigatable via keyboard focus


[Toolsets] Toolsets are not drawn / positioned in uncompressed build