Arcade or JavaScript to limit access to sensitive data

473
3
01-13-2023 03:42 PM
Labels (2)
JwHayes
New Contributor III

All,

We have a customized version of Web App Builder v2.25 on out local server. We have a tax lot layer that provides most fields except owner info. I need to make the owner information available to internal staff and some other partner jurisdictions. This equates to making 4 more fields in the dataset visible to the right people. I have never done this before. I assume there is a way to do this using JavaScript and IP addresses.

I was hoping a combinations of using this article to limit access to the REST endpoint, hiding the published owner information. Find some Arcade logic to identify the Portal suer. If there is a portal user and combine it with the this article on Conditional Field Display in a pop-up to show the owner information when a Portal username is detected, or to hide it if there’s no Portal user. I have had success identifying the users on our AGOL account, but not seeing a way for me to accomplish this using our limited access internal Portal – this is where almost everyone in our organization has a free user account. But I am also not sure if I could make this work with partner organizations, and not sure if there are holes in this method that could be exploited.

This leaves me thinking I will have to do something with IP addresses.  Something like if IP1 or IP2 then show the fields, else do not show. Has anyone done something like this before with WAB? Thanks in advance!

0 Kudos
3 Replies
KenBuja
MVP Esteemed Contributor

Take a look at using Layer Views and Groups. Create a Layer View from your layer that leaves off the ownership information, which would be shared publicly. The original layer would be shared with a group that contains only those who need the full access. Add both layers to a web map and only the public version will be visible to the general public.

For the partners jurisdictions, can you create user accounts for them to view the restricted data?

JwHayes
New Contributor III

@KenBuja,

A colleague was showing me a feature he would like added to my application. This was a little known feature from the legacy application I was replacing. Being new to my position, I had no idea it existed. Turns out the feature was a page that was an excellent solution to my needs, and offered some more feature I was looking for as well. The page gave additional tax lot details details and included ownership information that was already restricted to internal users. It also had links to other enterprise applications. Perfect. I created a new popup link with URL parameters in my application's popup to query the page and that was it - problem solved. Thanks so much for taking the time to provide me with some ideas! I appreciate it.

0 Kudos
JwHayes
New Contributor III

@KenBuja Thanks for the idea. I'll check into it and get back to you.

0 Kudos