topic Grant and revoke privileges with another user in Data Management Questions

Grant and revoke privileges with another user

Marco_AlejandroBonilla — Fri, 24 Oct 2014 20:45:04 GMT

Hi all,

I would like to manage privileges for my feature datasets inside my enterprise geodatabase (10.2-SQL Server) with another user (Not DBO user nor SDE user).

I'm using windows authentification and assigning db_owner permissions to a specific user in a database level using SQL Management Studio, but it doesn't seems to work.

Is there a way to achieve this?

Thanks for your help,

Re: Grant and revoke privileges with another user

StevenGraf1 — Fri, 24 Oct 2014 21:09:20 GMT

You can only apply permissions to the data that the logged in user owns.

For instance: If there is a feature dataset call MyDb."marco".featureclass1, only the user marco can apply permissions.

Steven

Re: Grant and revoke privileges with another user

StevenGraf1 — Fri, 24 Oct 2014 21:11:26 GMT

I don't think their is anyway around it. Maybe @ESRI can provide some insight.

Re: Grant and revoke privileges with another user

AsrujitSengupta — Fri, 24 Oct 2014 22:23:21 GMT

There is an option of "With Grant" which may help in this scenario.

SQL SERVER – Difference Between GRANT and WITH GRANT | Journey to SQL Authority with Pinal Dave

Welcome to SQLServer MVP Blog: Grant vs With Grant option in SQL Server

This is available in the database properties--> Permissions

Re: Grant and revoke privileges with another user

RussellBrennan — Fri, 24 Oct 2014 22:39:20 GMT

The WITH GRANT option is only available from the database using database level tools. I would not recommend using this privilege to manage privileges for data in an enterprise geodatabase, especially when data is contained in a feature dataset. There are many cases (too many to list) where an ArcGIS dataset is not just one table but many tables in the underlying DBMS. If you use database tools to manage privileges on these datasets and happen to miss one of the underlying tables you will run into issues reading and writing this data. This can lead to data corruption and a lot of sadness. Please stick to managing privileges for datasets with Esri tools.

The recommended approach to this is to load data using a 'headless' user. This user could be a database user or an OS authenticated user that isn't associated to someone specific in your organization. Loading data as this user will allow you to manage privileges using this user.

Hope this helps,

Russell

Re: Grant and revoke privileges with another user

Marco_AlejandroBonilla — Thu, 30 Oct 2014 19:30:17 GMT

I've decided to manage all the privileges with only one account as recommended, but I think this topic could be useful for enterprise gdb management, hope in the future we could use something like that.

I'll mark all your comments as helpful, thank you very much for your answers and interest