AnsweredAssumed Answered

A privileges granted to a user for enterprise geodatabase layer,

Question asked by Jamal432@gmail.com on Aug 6, 2014
Latest reply on Oct 12, 2014 by Jamal432@gmail.com

Like • Show 0 Likes0
Comment • 20

I couldn’t figure out how a user can “see” layers stored in enterprise geodatabase while this user is not granted any privileges.

The access type of the enterprise geodatabase (Q.mdf) is “public”

The “Ali” user is not given any privileges to the “communities” layer

Nevertheless, “Ali” can see the “communities” layer (as the “Q” enterprise database is accessed by Ali)

What might be the issue here?

How Could Ali access the “communities” layer while he has not given any privileges to it?

Thank you

Best

Jamal

No one else has this question

Outcomes

20 Replies

litterals Oct 3, 2014 6:40 AM
Mark Correct
Correct Answer
Jamal,

Did you ever figure this out? I am experiencing a similar problem.

Thank you,

Sharon
Like • Show 0 Likes0
Actions
- jskinner-esristaff @ litterals on Oct 3, 2014 6:55 AM
  Mark Correct
  Correct Answer
  Check that the user is not granted db_owner privileges using SQL Server Management Studio. Or, you can create a feature class when connected as the 'ali' user. If the owner of the feature class is DBO, then this user has db_owner privileges.
  Like • Show 0 Likes0
  Actions
  - litterals @ jskinner-esristaff on Oct 3, 2014 7:14 AM
    Mark Correct
    Correct Answer
    No, not db_owner. Any other suggestions?
    Like • Show 0 Likes0
    Actions
    - asengupta-esristaff @ litterals on Oct 3, 2014 8:23 AM
      Mark Correct
      Correct Answer
      Is it a database login or a Windows Authenticated login that you are using?
      
      Is the login part of any Group? ?
      Also as Sol suggested, can you please confirm what permissions this login has?
      Like • Show 0 Likes0
      Actions
      - Jamal432@gmail.com @ asengupta-esristaff on Oct 3, 2014 9:55 AM
        Mark Correct
        Correct Answer
        Hi all,
        
        Let’s take another example
        
        This is the current situation for the “Q” database
        
        “Hasan” is added as a user to the “Q’ database
        
        cont....
        Like • Show 0 Likes0
        Actions
        Jamal432@gmail.com @ Jamal432@gmail.com on Oct 3, 2014 9:57 AM
        Mark Correct
        Correct Answer
        Without granting “Hasan” any privileges to any layer, Hasan is able to “see” all the layers stored in the “Q” database
        
        What might be the issue here? Is this a normal behavior?
        
        How Hassan can see all the layers stored in the “Q” despite the fact that he is not granted any privileges to any layer?
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ Jamal432@gmail.com on Oct 3, 2014 10:16 AM
        Mark Correct
        Correct Answer
        When you are using the "Create Database User" tool, certain permissions are automatically granted to the new login.
        ArcGIS Help 10.1
        
        CREATE TABLE
        
        CREATE PROCEDURE
        
        CREATE VIEW
        
        VIEW DEFINITION
        
        However, the above 4 permissions should not automatically allow the new login to preview any existing data.
        -----
        Try creating the new login from the database end,Map it to the database and check if the behaviour is still reproduced.
        Like • Show 0 Likes0
        Actions
        Jamal432@gmail.com @ asengupta-esristaff on Oct 3, 2014 10:53 AM
        Mark Correct
        Correct Answer
        Thanks Asrujit,
        
        The “add database user” tool enables the user to access the database itself (Q) but not any of its content (layers). This user still needs to be granted permissions at the level of each layer stored in the database to be able to access them.
        
        Am I correct?
        
        In the current behavior, the database user doesn’t need to be granted particular privileges to access the layers stored in the database!
        
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ Jamal432@gmail.com on Oct 3, 2014 11:06 AM
        Mark Correct
        Correct Answer
        Yes, you are right. Permissions\privileges have to be granted separately for previewing the layers.
        
        Did you try creating a new login at the database end and then mapping it to the database? Did it show the same behaviour?
        Like • Show 0 Likes0
        Actions
        Jamal432@gmail.com @ Jamal432@gmail.com on Oct 6, 2014 2:39 PM
        Mark Correct
        Correct Answer
        Thanks guys for the useful input.
        
        Hi Asrujit,
        
        Could you please try to add a user to an SQL database from the ArcGIS in your environment. Do you have the same behavior?
        
        Hi Sol,
        
        As we add a user to the database from the ArcGIS, there is no option to “revoke”.
        Like • Show 0 Likes0
        Actions
        Jamal432@gmail.com @ Jamal432@gmail.com on Oct 8, 2014 10:19 AM
        Mark Correct
        Correct Answer
        Thank you Sol. This is useful
        
        Hi Asrujit:
        
        I couldn’t figure out the equivalent tool of the “add user” of the ArcGIS in the SQL server manager?
        
        I tried the one in the screenshot below but couldn’t find how to apply password
        
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ Jamal432@gmail.com on Oct 8, 2014 10:48 AM
        Mark Correct
        Correct Answer
        You need to create the new login under Security at the Instance level, not under the Database security.
        Like • Show 1 Like1
        Actions
        Jamal432@gmail.com @ asengupta-esristaff on Oct 8, 2014 11:15 PM
        Mark Correct
        Correct Answer
        Thanks Asrujit,
        
        “amjad” has been added, but he can see nothing.
        
        Please, have a look in the screenshot below.
        
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ Jamal432@gmail.com on Oct 9, 2014 7:13 AM
        Mark Correct
        Correct Answer
        You need to Map "Amjad" to the required database.. using the "User Mapping" option in Login properties..
        Like • Show 0 Likes0
        Actions
        Jamal432@gmail.com @ asengupta-esristaff on Oct 9, 2014 9:51 AM
        Mark Correct
        Correct Answer
        Hi Asrujit,
        
        Adding a user from the “SQL Server Management Studio” reproduces the same behavior.
        
        As “Amjad” is added from the “SQL Server Management Studio”, he is able to Access and EDIT the content of the Q database (he is given permission and privilege’s in one hit!). The ArcGIS doesn’t show that Amjad is given any privileges; nevertheless, Amjad is able to Access and Edit the data!
        
        What might this indicate for?
        
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ Jamal432@gmail.com on Oct 9, 2014 4:40 PM
        Mark Correct
        Correct Answer
        Can you list the permissions that shows up for the new user in the database properties.
        
        Like • Show 1 Like1
        Actions
        Jamal432@gmail.com @ asengupta-esristaff on Oct 12, 2014 2:06 AM
        Mark Correct
        Correct Answer
        “Amjad” has only “connect”, nevertheless, he can View and Edit the data!
        
        Like • Show 0 Likes0
        Actions
      - litterals @ asengupta-esristaff on Oct 3, 2014 10:55 AM
        Mark Correct
        Correct Answer
        We are using Windows Authentication and direct connect to the database.
        Yes, they are a member of a lot of nested groups. However, we denied
        access through SQL to a single table with a group that contains all domain
        users. We then used ArcCatalog and changed privileges for another group
        that the user belongs to to allow select. At this stage, we can see the
        feature classes in the ArcCatalog tree view, but when we click on any
        feature class in the feature dataset, it gives an error message box. The
        message states that we have insufficient privileges on the feature class
        where we denied access. Our dba has tried removing and adding db security
        groups and Active Directory groups with select table granted back to the
        single table with the same result. This user does not have a db login but
        is a member of several nested groups that can connect to the db.
        Like • Show 0 Likes0
        Actions
        asengupta-esristaff @ litterals on Oct 3, 2014 11:09 AM
        Mark Correct
        Correct Answer
        Its a bit confusing and maybe taking a look at your configuration will help in clearing things out. How about contacting ESRI Tech-Support...maybe that'll help and be a faster way of troubleshooting this.
        Like • Show 0 Likes0
        Actions
        litterals @ asengupta-esristaff on Oct 3, 2014 11:15 AM
        Mark Correct
        Correct Answer
        ESRI Tech Support cannot have access to my domain so I will continue to troubleshoot myself.
        Like • Show 0 Likes0
        Actions

GeoNet

The Esri Community

A privileges granted to a user for enterprise geodatabase layer,

Outcomes

Related Content

Recommended Content