Request tokens ignored on dev/qa servers if portal URL and UserSession.portal don't match

When using request with ArcGIS Online Dev/QA environments, a token will not be added to the request unless the portal URL matches the authentication UserSession.portal.

The dev/qa owningSystemUrl is not recognized as a ArcGIS Online server https://github.com/Esri/arcgis-rest-js/blob/master/packages/arcgis-rest-auth/src/UserSession.ts#L826

[patrickarlt]

I think this is happening in 2 similar but different cases because unless the URL passes the tests in https://github.com/Esri/arcgis-rest-js/blob/master/packages/arcgis-rest-auth/src/UserSession.ts#L725-L729 the UserSession.portal must exactly matches the owningSystemUrl in order to be considered for federation.

This means that the following cases fail to federate:

1. UserSession.portal === "https://someorg.mapsdev.arcgis.com/sharing/rest/" this actually appears to be a fairly common case for apps like Storymaps. since in dev owningSystemUrl is always https://devext.arcgis.com these don’t match and federation doesn’t happen. This was the original issue from @qlqllu https://github.com/Esri/arcgis-rest-js/blob/b956d910aadf76729190a54b6af0d3286cc11079/packages/arcgis-rest-auth/src/UserSession.ts#issuecomment-507092212. I think this is also the original issue reported by @ssylvia.
2. In cases where there is a scheme mismatch between http:// and https:// which is what @timmorey reported in https://github.com/Esri/arcgis-rest-js/blob/b956d910aadf76729190a54b6af0d3286cc11079/packages/arcgis-rest-auth/src/UserSession.ts#issuecomment-504144004.

@tomwayson has the right solution since we cant consider devext to be federated with production or vica versa so you would have to:

1. Determine if UserSession.portal is ANY ArcGIS Online Environment.
2. Get the ArcGIS Online Environment of UserSession.portal.
3. Determine if url is ANY ArcGIS Online Environment.
4. Get the ArcGIS Online Environment of url.
5. If 1 and 3 are true AND 2 and 4 match then we can short cut federation.

The alternative would be to modify https://github.com/Esri/arcgis-rest-js/blob/master/packages/arcgis-rest-auth/src/UserSession.ts#L826 with new tests to make sure that things like https://someorg.mapsdev.arcgis.com/sharing/rest/ and https://devext.arcgis.com are considered federated and to resolve the http/https issue.

[qlqllu]

I receive the NOT_FEDERATED, which I think it’s caused by this reason.

The portal in session is the org URL: beijing.mapsdevext.arcgis.com, and the feature service URL is: servicedev.arcgis.com.

I think these 2 URLs should be considered as federated.