A privileges granted to a user for enterprise geodatabase layer,

[JamalNUMAN]

A privileges granted to a user for enterprise geodatabase layer,

I couldn’t figure out how a user can “see” layers stored in enterprise geodatabase while this user is not granted any privileges.

1. The access type of the enterprise geodatabase (Q.mdf) is “public”

1. The “Ali” user is not given any privileges to the “communities” layer

1. Nevertheless, “Ali” can see the “communities” layer (as the “Q” enterprise database is accessed by Ali)

What might be the issue here?

How Could Ali access the “communities” layer while he has not given any privileges to it?

Thank you

Best

Jamal

[SharonLitteral]

Jamal,

Did you ever figure this out?  I am experiencing a similar problem.

Thank you,

Sharon

[JakeSkinner]

Check that the user is not granted db_owner privileges using SQL Server Management Studio.  Or, you can create a feature class when connected as the 'ali' user.  If the owner of the feature class is DBO, then this user has db_owner privileges.

[SharonLitteral]

No, not db_owner.  Any other suggestions?

[AsrujitSengupta]

Is it a database login or a Windows Authenticated login that you are using?

Is the login part of any Group? ?

Also as Sol suggested, can you please confirm what permissions this login has?

[JamalNUMAN]

Hi all,

Let’s take another example

1. This is the current situation for the “Q” database

1. “Hasan” is added as a user to the “Q’ database

cont....

[JamalNUMAN]

1. Without granting “Hasan” any privileges to any layer, Hasan is able to “see” all the layers stored in the “Q” database

What might be the issue here? Is this a normal behavior?

How Hassan can see all the layers stored in the “Q” despite the fact that he is not granted any privileges to any layer?

[AsrujitSengupta]

When you are using the "Create Database User" tool,  certain permissions are automatically granted to the new login.

ArcGIS Help 10.1 ‌

CREATE TABLE

CREATE PROCEDURE

CREATE VIEW

VIEW DEFINITION

However, the above 4 permissions should not automatically allow the new login to preview any existing data.

-----

Try creating the new login from the database end,Map it to the database and check if the behaviour is still reproduced.

[JamalNUMAN]

Thanks Asrujit,

The “add database user” tool enables the user to access the database itself (Q) but not any of its content (layers). This user still needs to be granted permissions at the level of each layer stored in the database to be able to access them.

Am I correct?

In the current behavior, the database user doesn’t need to be granted particular privileges to access the layers stored in the database!

[AsrujitSengupta]

Yes, you are right. Permissions\privileges have to be granted separately for previewing the layers.

Did  you try creating a new login at the database end and then mapping it to the database? Did it show the same behaviour?