How to Display Different Data per User in an Embedded Dashboard

[Nadia_Matsiuk]

Hello!

Is there a way in ArcGIS Enterprise 11.4 to configure access to our applications based on the user?

For example, we want to create a single map displaying points for different regions. In Dashboard, we will set up a simple interface with a map and some numerical indicators. Then, in Experience Builder, we will embed this Dashboard using an iframe.

Let’s say we have 10 users. We want each user to see only the data for their specific region.

Are there any methods to filter data based on who is accessing the interface?

We can consider any solutions. For example, custom widgets, ArcGIS REST JS. Anything that can help.

Thank you very much!

[berniejconnors]

Add a filter to the dashboard for the regions. The user can set the filter so they only see the relavent data.

https://doc.arcgis.com/en/dashboards/latest/get-started/filter-data.htm 

Or, create one dashboard for each user and apply a different filter in each dashboard.

Bernie.

[David_McRitchie · Accepted solution]

In addition, you might be interested in using URL parameters. This would let you modify the URL so that the app only displays specific features, extents. A customised URL could be sent to each of your users to filter data for specific areas, or editors.

Hope that helps,

David

[Nadia_Matsiuk]

@David_McRitchie , thank you for your help!
Without this hint, I would have spent much more time figuring out which methods could work for this task. I explored and understood how URL parameters work for ArcGIS Dashboard. I successfully integrated this into Experience Builder dev using the embed widget.

I also realized that URL parameters can be used similarly for Experience Builder applications. I believe this is exactly what we want to implement in our projects!

At this stage, I am setting the necessary data_filter in the URL bar, which successfully filters my interface. However, I see that users could simply change the parameter values and retrieve results for other data. To prevent this, I am using the embed widget in Experience Builder, which embeds my Experience Builder interface. This way, users cannot modify the URL parameters to intentionally or accidentally access other data.

However, we have one issue. I am also considering a custom widget that will check who is accessing the page upon loading (likely using SessionManager.getInstance()) and verify whether they have selected their correct region. If everything is correct, the interface will be displayed and filtered accordingly to their assigned region.

Could you please advise if this approach is vulnerable in terms of user data security? Is it possible to track this request to SessionManager using F12 developer tools and exploit it for malicious purposes? In general, are we thinking correctly, or should we change our approach to implementing this solution in terms of web security?

Thank you very much!

[David_McRitchie]

Glad that was useful Nadia, good idea on using the embedded widget to prevent users from seeing other parts of the data layer.

The one thing I would flag with this approach that is users could pull the URL from web traffic. This would be a concern if any of the data needs to be private, in which case the usage of layer views would be advised.

In regards to Web Security this is not my area of expertise so I would discuss this with someone more knowledgeable. From my reading of SessionManager.getInstance() I presume it will be using a token to communicate between the Server and Client so I would ensure token best practices are followed (such as ensuring tokens expire within an appropriate timeframe.

If someone were being malicious in this instance, then they could pluck a token from the network traffic and use it to spam requests against the service. 

For this query I would recommend putting this on the ArcGIS SDK for JavaScript forum. 

Let me know if you have any other questions and I'll be glad to look 😊

David