grant a user of the ArcGIS server a publisher privileges and prevent him from publishing

[AhmadSALEH1]

Can I grant a user of the ArcGIS server a publisher privileges and prevent him from publishing service or at least do some restrictions on what he can publish?

Regards,

Ahmad Saleh

[RebeccaStrauch__GISP]

Just a thought...I wonder if you could limit the folder they can publish to, and have that folder locked down (admin only viewable). A new service would inherent the folders restrictions.  Then as admin you would share or not. 

I do not know if this will work, but have a similar interest in an answer, so throwing this out there as something to test.  I'm not at my server right now to see if this will work.

[AhmadSALEH1]

Hi Rebecca,

I am afraid that what you mentioned is not applicable here, have you done something similar before ?

Many thanks,

Ahmad Saleh

[RebeccaStrauch__GISP]

Hi Ahmad,

No, I havent tried this but I was hoping it would work. In our shop, only two of us have publishing/admin rights.  This is because we use  Esri Developer Network (EDN) licenses for our developer/test server (and the two of us are the only ones with EDN) and don't want users to publish directly to our production machine. So the two of us are the only ones that create services.

So far, this has worked ok for us, but I can see that this restriction may become an issue as other groups in our agency are starting to have interest in publishing their own services. A workflow in progress, but the above was what I was going to try when /if the time comes....but my choice would be they add a EDN license until the time we can cross the budget threshold when a staging license makes more sense (and that, of course, varies for each customer....we do not have an Enterprise License agreement "ELA").

A question for you: What is the purpose of granting publishing privileges if you don't want them to publish?

I can see a use of not wanting them to publish some services or data....another thought....if the data isn't registered in the data store (by an admin), I wonder if you can prevent the publisher from having the publishing process auto copy the data to the server, maybe using OS folder permissions.  Again, nothing that I have tried....just trying to think out of the box.

[AhmadSALEH1]

Hi Rebecca,

The main purpose of granting publishing privileges and don't want them to publish is to use some tools on the published services such as “Export Map Server Cache” you must have a publisher or  administrator account if you want to use this tool to export the tiles of a published map service! And this need brings up a question is possible to grant a user of the ArcGIS server a publisher privileges and prevent him from publishing service, is it possible to do some restrictions on the publishers role to prevent them from doing things????

Your idea about “prevent the publisher from having the publishing process auto copy the data to the server, maybe using OS folder permissions” is great, but if I think what publishers can do in the manger I wouldn’t gave them this privilege without having any kind of control on them, also the publisher can Register databases and data directories with the server.

Here are a list of the things a publisher is allowed to do in Manager:

• Create and delete folders.
• View, publish, and delete services.
• Start, stop, and edit services.
• Set permissions rules about who can view services.
• Deploy and undeploy server object extensions (SOEs).
• View security configuration settings (for example, which type of role store is being used).
• View available users and the roles to which each user belongs.
• View available roles, the users who belong to each role, and the privileges assigned to each role.
• View and query logs.
• Create KML network links.
• View software authorization information.
• Register databases and data directories with the server.

Many thanks for the help,Best Regards,

Ahmad Saleh

[RebeccaStrauch__GISP]

Hi Ahmad,

I agree with you 100% and have mentioned this in the past to esri staff (maybe it was about ArcGIS Online).  There really should alwasy be a level between Publisher and Administrator.  On the ArcGIS Online they did give use more control over user/publisher/admin privileges, and that is great.  It would be nice to see the same granularity on the AGS side.

Would creating a geoprocessing service work for you with the clip-zip-ship type workflow?  Geoprocessing service example: Clip And Ship—Sharing geoprocessing workflows | ArcGIS for Desktop

Another option, I'm not sure how big your cache is, but what I do for some of our remote staff (i.e. with bad network connections), for layers that don't change often, I copy the entire cache (entire cache folder for a service) to an external drive and ship it to them.  If they are using ArcGIS Desktop (I think starting in 9.x), they can access the cache directly without a service....just like a folder.  Using the bundle/compact version works best...but keep in mind that 10.2.x and 10.3.x have different compact formats, and although 10.3.x is backwards compatible....they aren't forward compatible with the format.

Just some more possible options to think about.

Rebecca

[AhmadSALEH1]

Hi Rebbeca,

Many thanks for  your help, would  creating a geoprocessing service work for you with the clip-zip-ship type workflow work and helpful in exporting a cached image service ?? I have published the extract data task and I have inculded some layers but not a cached image or a service  that contains a mosaic dataset ( I usually share a mosaic dataset in an mxd file then I cache it ).

would the tool work in this case ?

Thanks,