nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Different sharing settings on Map Service and associated Feature Service for editing does not work?

Jay_Gregory

I have published a Map Service and associated Feature Service (feature access to enable editing) off my enterprise geodatabase. It results in a Map Image Layer and Feature Layer in my federated Portal. The Feature Layer points to server API resource (.../FeatureServer) and the Map Image Layer points to server API resource (.../MapServer).

I have tried to share the Map Image Layer publicly while keeping the Feature Layer just accessible to me for editing purposes (see screenshot)

However, if I navigate to my REST endpoints on server as an anonymous user (using an incognito window to ensure no credential caching), I can see both the MapServer and FeatureServer

What's more, as an anonymous user, I can query and edit the features via the Feature Service API endpoints (delete, add, etc).

We are working on a fully patched 10.9 Enterprise with federated Portal. This seems like it is not working as designed, and it also seems like I can't be the first person to experience this if its some undiscovered bug.

Is there anything I could be doing wrong / anything I'm missing?

It really seems to undermine the security of the entire system if otherwise.

Find more posts tagged with

Accepted answers

All comments

Scott_Tansley

Sorry, there were multiple Q's in there and I was specifally trying to target - Why do they get symbology sometimes but not others?

In answer to the can you share them differently, no, they're the same service, but just present differently for different purposes.

Michele_Hosking

Mmm - those were questions I know users will be asking when there are two of everything and they use one one day and the other the next without realising. They weren't my questions. But thanks for the linkedin post. 🙂

Scott_Tansley

I put a post out on LinkedIn just last week on this very subject: https://www.linkedin.com/posts/scotttansley_feature-service-layer-or-map-service-map-activity-7437271966383960064-_Hdg?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAIwtdIBpi-ACpbhpKoEcKdTAm2sBT4bXow

Michele_Hosking

Looks like this is quite an old idea but totally support being able to share the map service and the feature service separately. In Enterprise in my case. We are moving to using our AGOL for all public data and Enterprise for internal. We are bulk publishing as much as possible and this results in a map image service and a feature service. We are able to add symbology permanently to the feature service but not the map service so we wanted to be able to share the feature service with the organisation and hide the map image service in a separate group. This is because having 2 of everything is confusing for users. Why do they get symbology sometimes but not others? Why is there a filter on sometimes and not others. It's super annoying that this still isn't possible.

Scott_Tansley

It’s a logical argument but I would guess this is a legacy thing, as the style of security predates Enterprise.

there are third party solutions that extend the capabilities like you suggest. I know Esri rely on them for some projects/use-cases.

and I’ve seen the data exposed in different ways across five services in a nod to what you’re trying to do.

Jay_Gregory

Understood - I was afraid this was by design - though to me it's still unintuitive.

It might make sense if the Portal somehow updated the sharing of the associated Feature Layer in the UI if you changed the sharing of the Map Image Layer. Right now in the UI, it looks as if the Map Image Layer is shared anonymously and the Feature Layer is shared with no one, but it is not actually the case when traversing the REST endpoints.

Furthermore, in order to support what is a very intuitive use case (data view accessible by everyone, data edits accessible by a few) you have to publish TWICE. One MapService with Feature Access enabled (which itself results into two REST endpoints - MapServer, FeatureServer), and one MapService without Feature Access enabled. I really thought the whole point of having separate MapService and FeatureService was so you could share them differently (besides the other tradeoffs in MapService vs FeatureService).

Scott_Tansley

Actually I’d say that’s expected behaviour. The feature server extends the capabilities of the map server. Effectively they are the same underlying service.

The way that I have always dealt with this is to have two map services. One is public. The other is extended to a feature server and shared with the appropriate groups. So in your case secure what you have published and then publish an open map service with no feature capabilities.

The more fine grained type security you describe is possible with the hosted feature layers through views. But security of traditional referenced data sources is much more course.

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.