We (David and I) successfully followed the instructions for running the WAB as a windows service, and multiple users can connect using either Esri or enterprise credentials (via SAML) and confgure applications, however two main concerns arose in our testing:
- We don't seem to have the ability to lock access down to our organization - that is, any user can visit the site, enter their ArcGIS Online for Organizations URL (or even a portal URL) and use our custom standalone WAB with their portal. Not exactly the service we'd intended to provide to the public.
- When a user connects, they are only shown applications that they have configured themselves, however on the file system applications are identified by simple integers (1,2,3,etc) and nothing prevents a user from specifying any integer and viewing and editing applications authored by other users (provided they have access to the same source web map). This is definitely a dealbreaker for use in a shared environment.
And although we had some success using IISNode and the IIS7 URLRewrite module to try and route traffic from port 80 to node.js in a controlled manner (without routing 100% of traffic there), there were too many calls to the node.js root (rather than a predictable, filterable path) to make this a practical reality similar to a tomcat webapp. Discussions with Esri's developers and support techs haven't gotten very far, if anyone else out there is trying to work through some of these details, we'd appreciate the discussion. Thanks!