How to Display Different Data per User in an Embedded Dashboard

[Nadia_Matsiuk]

Hello!

Is there a way in ArcGIS Enterprise 11.4 to configure access to our applications based on the user?

For example, we want to create a single map displaying points for different regions. In Dashboard, we will set up a simple interface with a map and some numerical indicators. Then, in Experience Builder, we will embed this Dashboard using an iframe.

Let’s say we have 10 users. We want each user to see only the data for their specific region.

Are there any methods to filter data based on who is accessing the interface?

We can consider any solutions. For example, custom widgets, ArcGIS REST JS. Anything that can help.

Thank you very much!

[berniejconnors]

Add a filter to the dashboard for the regions. The user can set the filter so they only see the relavent data.

https://doc.arcgis.com/en/dashboards/latest/get-started/filter-data.htm 

Or, create one dashboard for each user and apply a different filter in each dashboard.

Bernie.

[David_McRitchie]

In addition, you might be interested in using URL parameters. This would let you modify the URL so that the app only displays specific features, extents. A customised URL could be sent to each of your users to filter data for specific areas, or editors.

Hope that helps,

David

[Nadia_Matsiuk]

@David_McRitchie , thank you for your help!
Without this hint, I would have spent much more time figuring out which methods could work for this task. I explored and understood how URL parameters work for ArcGIS Dashboard. I successfully integrated this into Experience Builder dev using the embed widget.

I also realized that URL parameters can be used similarly for Experience Builder applications. I believe this is exactly what we want to implement in our projects!

At this stage, I am setting the necessary data_filter in the URL bar, which successfully filters my interface. However, I see that users could simply change the parameter values and retrieve results for other data. To prevent this, I am using the embed widget in Experience Builder, which embeds my Experience Builder interface. This way, users cannot modify the URL parameters to intentionally or accidentally access other data.

However, we have one issue. I am also considering a custom widget that will check who is accessing the page upon loading (likely using SessionManager.getInstance()) and verify whether they have selected their correct region. If everything is correct, the interface will be displayed and filtered accordingly to their assigned region.

Could you please advise if this approach is vulnerable in terms of user data security? Is it possible to track this request to SessionManager using F12 developer tools and exploit it for malicious purposes? In general, are we thinking correctly, or should we change our approach to implementing this solution in terms of web security?

Thank you very much!