View vs. Edit Permissions?

[Anonymous User]

I don't see a way to constrain who can edit versus who can only view a hosted service.  Is there a way to make certain users view-only?
Thank you!

[Anonymous User]

Even if you do not allow the Public to view your services, this still creates a problem within your own organization.  We have many overlapping interests where Group A needs to edit something that Group B should only view. This seems to hinder both Organization and Public levels of publication.

[LeoDonahue]

That is where the multiple web maps come into play.

I have the same issue with a similar workflow.

Data creators using Collector aren't allowed to edit the status of a certain attribute field.  So on their map, I configure the popup to not have that field.

The Data editors/reviewers have that attribute field in their popup so they can update the status of said point.

I had to create three web maps for this project. 
WebMap 1 for data creators
WebMap 2 for data editors/reivewers
WebMap 3 read only web map showing the status as the editors chose, and used a filter to show only the approved status values.
WebApplication - linked to WebMap3.

Viewers don't get WebMaps, they should only get WebApps (ESRI Basic Viewer) with editing option disabled.  Those users should belong to a group where the WebMap and WebApp are only shared with those groups respectively.

This is how we edit data in the field and let other users "see it" without being able to edit it.

The key is everything has to be shared within your organization or group.

[Anonymous User]

Leo, thanks for the feedback.  The testing I have done suggests that the methods you describe can be defeated by a clever user in the "read-only" group.  Have you shown a different result?  And, are you using AGOL hosted services, or your own ArcGIS for Server services?  Thanks again!

[LeoDonahue]

Leo, thanks for the feedback.  The testing I have done suggests that the methods you describe can be defeated by a clever user in the "read-only" group.

Can you elaborate?

Didn't see the second part...

Well, I "can" use my own ArcGIS Server for services, but this application was for someone else, so they wanted it in the AGOL hosted services because they wanted to be able to update the FGDB schema, edit the map settings, etc...

[LeoDonahue]

Are you saying that if you publish a WebMap with editing disabled, and add that WeMap to say the ESRI Basic Viewer and disable the editor option there and share those two items with a specific group that the users in that group can still edit the feature service?

How?

[Anonymous User]

They log in to Arcgis.com, click Groups, enter their group, and instead of going to your application, they open the web map you used to create it.  They have to be granted permission to see it, or they can't use the application.  And they can edit the features in the web map.

[LeoDonahue]

But you can click the drop down arrow to the right of the layer in that web map and choose disable editing, save the map, and then they can't edit it, right? 

Are you saying that a user can change that setting if they don't own the content?  Really? 

I just demo'd our app today and we had the customer login with their account and they couldn't get access to the layer configuration properties because I published the content under my login, I was the owner of the map, feature service and web app.  I had to change ownership of the content to their login in order for them to be able to do things like configure the popup in the web map.

[Anonymous User]

But you can click the drop down arrow to the right of the layer in that web map and choose disable editing, save the map, and then they can't edit it, right? 

Are you saying that a user can change that setting if they don't own the content?  Really? 

Yes.  The read-only user, who owns nothing and has only user credentials, can go into the read-only group, and open the web map with the "editing disabled" layer, and click the drop down arrow, and Enable Editing.

And, as a sidebar, I share your incredulity, and more than anything am hoping to be corrected.  I look forward to seeing if you can replicate my experience.

[LeoDonahue]

I am an administrator in my organization.

I need to find a regular user to test this with.  But, I'm being told here that what you experience is currently normal.

However, I swear that yesterday when I was looking at my content, through a regular user's login, they couldn't change anything.  Maybe I was wrong.


If it is true that regular AGOL users can re-enable editing on a web map that they don't own, then that is a problem.  All the more reason to roll your own web editng maps. 

I would have thought the fact that users who don't own content shouldn't get access to change map settings of someone else's content would have been the norm.  That would also fix the problem.

However, what if... you create a lame duck user account.  That user saves a copy of your web editing map. Then you assign this map created by the lame duck user to a web app (ESRI Basic Viewer) and let your other read only users see that web app?

[LeoDonahue]

Forget it...


See this