idea Allow privledges to be set for feature classes within a feature dataset in Data Management Ideas

Allow privledges to be set for feature classes within a feature dataset

RobertDeHerrera — Tue, 09 Aug 2022 21:21:04 GMT

In a multi-user SDE environment, some feature classes need to participate within a topology. However, we need the ability to deny edit privledges to selected feature classes within a feature dataset. An example:

Tax district boundaries are maintained by the Assessor's office.
Election precinct boundaries are maintained by the Elections office.
Both tax districts and precincts share topological relationships.
Elections staff don't want Assessor's staff fiddling with their boundaries accidentally.
Assessor's staff don't want Elections staff fiddling with parcels accidentally.

Currently, the only option in SDE is to grant users from both offices full edit permissions to the entire feature dataset.
We need the option to disallow edit privledges to individual feature classes within a feature dataset.

Re: Allow privledges to be set for feature classes within a feature dataset

CattyannCampbell — Thu, 01 Apr 2010 13:09:49 GMT

Absolutely! We run into this in my office all the time in our case it has to do with Easements and Zoning boundaries.

Re: Allow privledges to be set for feature classes within a feature dataset

MicahWilliamson — Thu, 01 Apr 2010 13:40:31 GMT

yes, This is a good idea. My workaround is that I push a copy of the needed feature class out to another department after topology is run, creating redundant data.

If they do this ArcCatalog would need a better way to 'track' privileges.

Re: Allow privledges to be set for feature classes within a feature dataset

JoshuaDye4 — Thu, 01 Apr 2010 14:17:24 GMT

I have run into similar problems inside one of our datasets. I would love to be able to add that extra layer of protection to feature classes. I have "fixed" more than once, an edit session gone wrong.

Re: Allow privledges to be set for feature classes within a feature dataset

GIS-Cambria — Thu, 01 Apr 2010 14:18:22 GMT

I agree with permissions at the feature class level, regardless of participation in a dataset or not.

As a workaround for now, couldn't you set up department specific GDBs and replicate pertinant info between departments. Then the editing would be constrained to that specific department. You could try user or role based access constraints within your DBMS but I'm not sure how SDE will like that.

Re: Allow privledges to be set for feature classes within a feature dataset

JakeSkinner — Fri, 16 Apr 2010 18:08:03 GMT

As a workaround, you can use the 'sdelayer -o grant' command to accomplish this. Ex:

GIS.Vector.Topology (feature dataset)
-GIS.Vector.Boundaries (feature class)
-GIS.Vector.Tax_Districts (feature class)

If I want to grant another user, ie 'Raster', to be able to just view & edit the 'Boundaries' feature class the command would be:

C:\> sdelayer -o grant -l boundaries,shape -U raster -A SELECT,INSERT,UPDATE,DELETE -i 5151 -D GIS -u vector -p vector

The Raster user will not be able to view or edit the 'Tax_Districts' feature class.

Re: Allow privledges to be set for feature classes within a feature dataset

JasonEklund — Tue, 20 Apr 2010 16:52:27 GMT

Agree completely. Our GIS is setup so that all our County Departments manage their own data in our SDE database which is managed by myself (GIS Admin). I have to adjust our feature datasets to allow for proper permissions among departments instead of structuring to fit with topologies and geometric networks.

Re: Allow privledges to be set for feature classes within a feature dataset

FuadAlShunnag — Sun, 25 Apr 2010 07:11:23 GMT

Yes , this will be very helpful

Re: Allow privledges to be set for feature classes within a feature dataset

AndrewRudin — Mon, 03 May 2010 16:43:14 GMT

We have over 600 layers used for reference of some kind. So we use datasets for organization like alot of users do. I think there should be two different types of datasets, one would just be to organize data for easy browsing. The second would be the traditional dataset as is, that is required for advanced geodatabase features like topology and geometric networks.

Re: Allow privledges to be set for feature classes within a feature dataset

RayChilcote — Wed, 11 Aug 2010 17:01:36 GMT

Agree. Working for the military a few years back, we asked for this. Our pitfall was data organization by data content (SDSFIE). This breaks the potential (and likely) of shared topology requirements when there are two separate owners of data. Let alone that being in the same dataset then dictates the same precision.

Overall, this would be a nice advancement.

Re: Allow privledges to be set for feature classes within a feature dataset

IanStack — Mon, 27 Dec 2010 20:50:08 GMT

I agree. We have FeatureClass level data that participate in a geometric network therefore are all part of a single Feature Dataset. Different groups are considered data owners for different FeatureClasses and we would like to be able to control editing privs as appropriate. The goal is to prevent inadvertent editing of data they aren't responsible for without implementing workflows that need to be managed and maintained.

Has anyone confirmed that command line sdelayer -o grant permissions on a FeatureClass circumvent the Dataset level permission management as suggested below by JSkinn3? Seems like if that works, why can't those permissions be granted via ArcCatalog?

Re: Allow privledges to be set for feature classes within a feature dataset

MikeSharp — Thu, 20 Oct 2011 11:02:26 GMT

Great idea!

Re: Allow privledges to be set for feature classes within a feature dataset

SteveWagner — Thu, 26 Jan 2012 20:43:26 GMT

We have the same problem. We need to grant differnet permission within a feature dataset. This would be a great help to us.

Re: Allow privledges to be set for feature classes within a feature dataset

MarceloMarques — Mon, 24 Nov 2014 17:12:04 GMT

I have the same problem and would like the default featuredataset behavior to change regarding permissions.
Case 1: a featuredataset with serveral featureclasses contain very large featureclasses (300 million rows) with partioned tables/indexes, only few editor shall be able to edit the large featureclasses, while the remaining editors need to have read-only access, the workaround would be to move the large featureclasses to a separate featuredataset, but because those a large featureclasses this will require to reload the data which takes a very long time.
Case 2: an electric utility has a featuredataset with a geometric network and wants to grant read-access to transformers to certain editors, while other editors shall have read-write access.

FAQ: Can different privileges be granted to feature classes within a feature dataset ?
http://support.esri.com/index.cfm?fa=knowledgebase.techarticles.articleShow&d=25830

Re: Allow privledges to be set for feature classes within a feature dataset

MarceloMarques — Mon, 24 Nov 2014 17:12:29 GMT

Case Study
Business Rule: the database administrator is asked to change the permissions for an editor user, the editor user shall have read-write access to all featureclasses inside a featuredataset except for 1 featureclass which shall have read-only access.
Problem: in ArcMap the editor user cannot edit any featureclasses that reside inside the featuredataset after the privilege change.
Details:

the database administrator grants “select,insert,update” privileges to all featureclasses inside a featuredatabaset to the editor user, expect for 1 featureclass which grants only the “select” privilege
user launches ArcMap and opens ArcCatalog and connects as the editor user to the geodatabase
user brings the read-only featureclass into ArcMap TOC and tries to start editing, it returns a warning message as expected
user removes the read-only featureclass from TOC
user brings a read-write featureclass from the same featuredataset as the read-only featureclass into TOC
user tries to start editing and also returns a warning message and is not able to start editing
user complains to the database administrator
database administrator changes the permissions of the read-only featureclass,grants select, insert, update, delete to the editor user again
user closes and opens ArcMap
user brings the featureclass that was read-only into TOC and now it can start editing
user removes the featureclass from TOC
user brings the featureclass the same read-write featureclasses (step5) and now it can start editing as well

Conclusion: seems ArcGIS Desktop is checking the privileges at the featuredataset level, if an editor user does not have “select, insert, update, delete” on all featureclasses inside the featuredataset then the editor user is not able to start editing.
Issue: this does not allow flexibility for database administrators to manage privileges for different editor users
Workaround: database administrators can move read-only featureclasses to a separate featuredataset, however if featureclasses participate in topology or geometric networks for example this will not be viable workaround.

Re: Allow privledges to be set for feature classes within a feature dataset

MarceloMarques — Mon, 24 Nov 2014 17:12:54 GMT

FAQ: Can different privileges be granted to feature classes within a feature dataset ?
http://support.esri.com/index.cfm?fa=knowledgebase.techarticles.articleShow&d=25830

Re: Allow privledges to be set for feature classes within a feature dataset

MarcGalle — Tue, 08 Jan 2019 22:46:31 GMT

Unfortunately this is by software design which is why you need to consider grouping feature classes within datasets not just by topology but by business rules. Hence when migrating database to a new platform you can reconstruct it properly according to roles which you can apply permissions to.

This idea would probably require a whole new re-engineering of the Geodatabase by ESRI?

(NOTE: It would be useful for users to see how much time/complexity would be involved for voting our priorities)

Re: Allow privledges to be set for feature classes within a feature dataset - Status changed to: Closed

SSWoodward — Wed, 07 May 2025 18:11:52 GMT

Feature datasets are intended for classes that participate in controller datasets that must have common privileges defined.

There are no current plans to allow feature class level privileges to be set on classes within a feature dataset.