topic Record based Feature Class Security in ArcGIS API for Silverlight Questions

Record based Feature Class Security

DaveRabrun — Fri, 25 Jun 2010 19:03:32 GMT

I want to design a project which will require that 100+ users have access to their own polygon records. This is not a collaborative effort, a user adds polygons, and only this user (and I as the admin) will be able to see their polygons. In theory, i should be able to create one feature class, the columns would then be "Polygon_Name, Polygon_ID, User_ID and Polygon_geometry".

I can create the feature & geodata services to serve the feature class , i can secure the services with token-based authorization and i can query based on the USER_ID column so only the polygon records of the appropriate user returns. But the way i understand it (and please correct me if I'm wrong), at this point, the only thing preventing users from seeing another's records is the querytask which is done from within the client(and therefore has no security).

Other than creating a different feature class and feature service for each of the 100+ users (which is not feasible), is there any other way of doing this?

Can the querytask be intercepted, checked and then sent along?
Can I use the featurelayer & editor purely for the user interface, but then have the polygon submitted to a WCF service which adds or edits an existing polygon in a feature class through web adf (or yet another featurelayer & feature service which only the admin has access to?)

Any thoughts on this would be greatly appreciated

Re: Record based Feature Class Security

dotMorten_esri — Mon, 28 Jun 2010 23:51:26 GMT

You could use a proxy on the querytask/featurelayer and check the userid there. Basically before parsing the query on to the server, the proxy will modify the url to append the Where clause.

Re: Record based Feature Class Security

DaveRabrun — Wed, 21 Jul 2010 03:45:22 GMT

Thank You, just like you said, I can pretty much intercept and apply business logic to all rest calls from proxy.ashx.

Re: Record based Feature Class Security

dotMorten_esri — Wed, 21 Jul 2010 18:51:37 GMT

You can use use a proxy to run your query through and validate that the UserID hasn't been tampered with. There's a ProxyUrl property on the query task that you can use for this.