topic Re: ArcSDE Issue regarding Users and Privileges in ArcGIS Enterprise Questions

ArcSDE Issue regarding Users and Privileges

AhmedArrar — Tue, 02 Sep 2014 08:18:20 GMT

I am using ArcSDE 10.2.1 with Oracle 11g R2... I have created a user with create session privilege granted to him, I also granted him a select privilege on a dataset the user is unable to perform any edits but he is able to export data to XML, GDB and shapefile and copy the FDS to a personal GDB.

please advice.

Re: ArcSDE Issue regarding Users and Privileges

Anonymous User — Tue, 02 Sep 2014 08:25:22 GMT

Hi Ahmed,

What is exactly the problem? Please take a look at this link you might already know:

ArcGIS Help (10.2, 10.2.1, and 10.2.2)

Re: ArcSDE Issue regarding Users and Privileges

AhmedArrar — Tue, 02 Sep 2014 08:40:16 GMT

I went through this article and it was useless but to make things clear here are extra details:

- Oracle Installed and the DB Instance created.

- ArcSDE Repository and user created perfectly.

- Tablespaces were created to comply with ArcSDE dbtune file

- dbtune imported "st_geometry"

- data owner user created with the following privileges:

- create table

- create sequence

- create trigger

- create view

- create session

- unlimited tablespace

- data viewer user created with only create session privilege

- data owner user loaded the data perfectly, registered it as versioned, grant select on one FDS to the data viewer

- data viewer unable to edit features, but able to export the FDS which he had privileges for viewing.

what do you advice

Re: ArcSDE Issue regarding Users and Privileges

Anonymous User — Tue, 02 Sep 2014 08:59:06 GMT

I´m still not sure what the problem is. You do not want the data viewer to export data?

Re: ArcSDE Issue regarding Users and Privileges

AhmedArrar — Tue, 02 Sep 2014 09:03:41 GMT

Hi Richard,

thank you for your cooperation, sure as a data viewer the user is to be unable to edit so how about exporting the data, the user mustn't do so. this is my issue I wonder if any one has faced this issue before.

regards.

Re: ArcSDE Issue regarding Users and Privileges

Anonymous User — Tue, 02 Sep 2014 09:17:32 GMT

When a user can view data in ArcSDE he will be able to export that data outside the geodatabase. This is standard behaviour.

Re: ArcSDE Issue regarding Users and Privileges

RiyasDeen — Tue, 02 Sep 2014 09:23:41 GMT

Hi Ahmed,

If a user has select privilege on a feature class then arcmap will allow the user to add the FC as layer. If you can add a layer to arcmap then there is nothing preventing the user from exporting the FC out.

Exporting a feature class requires select privilege on the FC, which the user already has. Export is nothing but select and insert on new FC.

Re: ArcSDE Issue regarding Users and Privileges

AhmedArrar — Tue, 02 Sep 2014 09:50:00 GMT

hi,

then how does ArcSDE guarantees data integrity? regarding my experience with ArcSDE releases prior to 10.2, if a user is a viewer he shouldn't be able to export the data since he is not the owner of the data. I am using ArcSDE as an enterprise GDB in order to manage multiple users edits and at the same time to keep my data secure and centralized, but this is not rational.

if a user has a privilege as a viewer then he must be able to add data to ArcMAP and use it to prepare maps for example, I can share my DB connection file with users who doesn't have ArcGIS Desktop advanced "they have basic" and they can easly connect and retrieve the data display it, inquire it, analyze it and present it.

suppose that my data has external stockholders viewers, then every one can take a copy of the data. again it makes no sense.

do you agree.

Re: ArcSDE Issue regarding Users and Privileges

Anonymous User — Tue, 02 Sep 2014 10:13:34 GMT

There a other ways to protect your data. If you really don´t want external viewers to retrieve your data, think of other ways, as for example creating map or WMS services.

Re: ArcSDE Issue regarding Users and Privileges

VinceAngelo — Tue, 02 Sep 2014 14:05:56 GMT

How could GRANTing a user SELECT access possibly impair data integrity? SELECT access has ALWAYS meant that users can download data -- there is no other possible way this could work. If you don't want users extracting data, don't grant them SELECT access.

You'll need to use other tools to give them access to an application which won't give them the ability to directly download data, but even that wouldn't stop screen capture and heads-up digitizing in some other context.

Re: ArcSDE Issue regarding Users and Privileges

AhmedArrar — Wed, 03 Sep 2014 03:47:19 GMT

convincing, but is there any third party tool which provides high level of security, where I can control such issues.

Re: ArcSDE Issue regarding Users and Privileges

RiyasDeen — Wed, 03 Sep 2014 04:02:09 GMT

Hi Ahmed,

When you give select privilege on your FC to a user and let them access your DB directly, there is no way you can prevent users from extracting the data out.

Richard's suggestion below is your best option, if you want your users to just view the data and not download it. create a map service with Query and data operations disabled. users can add this map service in arc map and view the data but cannot download data as vectors.

ArcGIS Help 10.1

Richard Miedema wrote:

There a other ways to protect your data. If you really don´t want external viewers to retrieve your data, think of other ways, as for example creating map or WMS services.

If you don't have ArcGIS Server and can't procure one, you can explore open source software which support WMS.