topic Re: A privileges granted to a user for enterprise geodatabase layer, in Data Management Questions

A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Wed, 06 Aug 2014 20:23:35 GMT

A privileges granted to a user for enterprise geodatabase layer,

I couldn’t figure out how a user can “see” layers stored in enterprise geodatabase while this user is not granted any privileges.

The access type of the enterprise geodatabase (Q.mdf) is “public”

The “Ali” user is not given any privileges to the “communities” layer

Nevertheless, “Ali” can see the “communities” layer (as the “Q” enterprise database is accessed by Ali)

What might be the issue here?

How Could Ali access the “communities” layer while he has not given any privileges to it?

Thank you

Best

Jamal

Re: A privileges granted to a user for enterprise geodatabase layer,

SharonLitteral — Fri, 03 Oct 2014 13:40:55 GMT

Jamal,

Did you ever figure this out? I am experiencing a similar problem.

Thank you,

Sharon

Re: A privileges granted to a user for enterprise geodatabase layer,

JakeSkinner — Fri, 03 Oct 2014 13:55:47 GMT

Check that the user is not granted db_owner privileges using SQL Server Management Studio. Or, you can create a feature class when connected as the 'ali' user. If the owner of the feature class is DBO, then this user has db_owner privileges.

Re: A privileges granted to a user for enterprise geodatabase layer,

SharonLitteral — Fri, 03 Oct 2014 14:14:37 GMT

No, not db_owner. Any other suggestions?

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Fri, 03 Oct 2014 15:23:17 GMT

Is it a database login or a Windows Authenticated login that you are using?

Is the login part of any Group? ?

Also as Sol suggested, can you please confirm what permissions this login has?

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Fri, 03 Oct 2014 16:55:38 GMT

Hi all,

Let’s take another example

This is the current situation for the “Q” database

“Hasan” is added as a user to the “Q’ database

cont....

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Fri, 03 Oct 2014 16:57:35 GMT

Without granting “Hasan” any privileges to any layer, Hasan is able to “see” all the layers stored in the “Q” database

What might be the issue here? Is this a normal behavior?

How Hassan can see all the layers stored in the “Q” despite the fact that he is not granted any privileges to any layer?

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Fri, 03 Oct 2014 17:16:40 GMT

When you are using the "Create Database User" tool, certain permissions are automatically granted to the new login.

ArcGIS Help 10.1 ‌

CREATE TABLE

CREATE PROCEDURE

CREATE VIEW

VIEW DEFINITION

However, the above 4 permissions should not automatically allow the new login to preview any existing data.

-----

Try creating the new login from the database end,Map it to the database and check if the behaviour is still reproduced.

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Fri, 03 Oct 2014 17:53:08 GMT

Thanks Asrujit,

The “add database user” tool enables the user to access the database itself (Q) but not any of its content (layers). This user still needs to be granted permissions at the level of each layer stored in the database to be able to access them.

Am I correct?

In the current behavior, the database user doesn’t need to be granted particular privileges to access the layers stored in the database!

Re: A privileges granted to a user for enterprise geodatabase layer,

SharonLitteral — Fri, 03 Oct 2014 17:55:08 GMT

We are using Windows Authentication and direct connect to the database.

Yes, they are a member of a lot of nested groups. However, we denied

access through SQL to a single table with a group that contains all domain

users. We then used ArcCatalog and changed privileges for another group

that the user belongs to to allow select. At this stage, we can see the

feature classes in the ArcCatalog tree view, but when we click on any

feature class in the feature dataset, it gives an error message box. The

message states that we have insufficient privileges on the feature class

where we denied access. Our dba has tried removing and adding db security

groups and Active Directory groups with select table granted back to the

single table with the same result. This user does not have a db login but

is a member of several nested groups that can connect to the db.

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Fri, 03 Oct 2014 18:06:51 GMT

Yes, you are right. Permissions\privileges have to be granted separately for previewing the layers.

Did you try creating a new login at the database end and then mapping it to the database? Did it show the same behaviour?

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Fri, 03 Oct 2014 18:09:24 GMT

Its a bit confusing and maybe taking a look at your configuration will help in clearing things out. How about contacting ESRI Tech-Support...maybe that'll help and be a faster way of troubleshooting this.

Re: A privileges granted to a user for enterprise geodatabase layer,

SharonLitteral — Fri, 03 Oct 2014 18:15:18 GMT

ESRI Tech Support cannot have access to my domain so I will continue to troubleshoot myself.

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Mon, 06 Oct 2014 21:39:09 GMT

Thanks guys for the useful input.

Hi Asrujit,

Could you please try to add a user to an SQL database from the ArcGIS in your environment. Do you have the same behavior?

Hi Sol,

As we add a user to the database from the ArcGIS, there is no option to “revoke”.

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Wed, 08 Oct 2014 17:19:54 GMT

Thank you Sol. This is useful

Hi Asrujit:

I couldn’t figure out the equivalent tool of the “add user” of the ArcGIS in the SQL server manager?

I tried the one in the screenshot below but couldn’t find how to apply password

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Wed, 08 Oct 2014 17:48:28 GMT

You need to create the new login under Security at the Instance level, not under the Database security.

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Thu, 09 Oct 2014 06:14:59 GMT

Thanks Asrujit,

“amjad” has been added, but he can see nothing.

Please, have a look in the screenshot below.

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Thu, 09 Oct 2014 14:13:50 GMT

You need to Map "Amjad" to the required database.. using the "User Mapping" option in Login properties..

Re: A privileges granted to a user for enterprise geodatabase layer,

JamalNUMAN — Thu, 09 Oct 2014 16:51:40 GMT

Hi Asrujit,

Adding a user from the “SQL Server Management Studio” reproduces the same behavior.

As “Amjad” is added from the “SQL Server Management Studio”, he is able to Access and EDIT the content of the Q database (he is given permission and privilege’s in one hit!). The ArcGIS doesn’t show that Amjad is given any privileges; nevertheless, Amjad is able to Access and Edit the data!

What might this indicate for?

Re: A privileges granted to a user for enterprise geodatabase layer,

AsrujitSengupta — Thu, 09 Oct 2014 23:40:08 GMT

Can you list the permissions that shows up for the new user in the database properties.