Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

In ArcGIS Online For Organizations, how does one publish a hosted feature service that is shared with Everyone for viewing, while restricting editing to specific users or groups, and different kinds of editing for different groups?

In the help at the end of Editor permissions for feature services under Configuring multiple tiers of access it says

If you need to support multiple tiers of users, each requiring different operations, the recommended approach is to create one service for each level of user. For example, you could create a Professors service that might have all operations allowed. Along with that, you could create a less-privileged Students service with only Create, Query, and Upload operations allowed.

Which is great, that's what I need to do. However what is left out is how to reconcile the multiple Feature Services so that when the Professors create new features the Students see the new records, and vice versa.

The web browser management Create Service wizard allows you to use one feature service as a source for a new one, but only the data model is used (symbol definitions, field names & types, etc.) while the actual features are left behind, the new service is blank. This is the intended behaviour.

share|improve this question
    
are you wanting it in the same web map? If you don't care about having more than one map. Each feature service also contains a map service one map with the feature service and one with the map service = editing control. –  Brad Nesom Apr 12 '13 at 17:43
    
@brad, no they don't need to be in the same map. However a Feature Service needs to be shared to be included in a web map, and once that happens people can bypass the map and go straight to the Feature Service irregardless of what share settings are set in the Web Map Service. –  matt wilkie Apr 12 '13 at 17:51

3 Answers 3

up vote 3 down vote accepted

We had an extended conversation with some Esri Canada folks about this a couple of months ago. There is no secure method to govern simultaneous edit and read-only privilege roles in ArcGIS Online (at present). The best one can do is obscure the location of the editable service, as per Brad and Bmearns answers here, and then enable Track Editor. This would be followed with periodic scheduled reviews of the records and removal of those not made by someone authorized to do so.

If a secured and editable feature service is needed, you need to run your own ArcGIS Server somewhere else with sharing and editing locked down as needed, and then a read-only service exposed to ArcGIS Online.

This does allow utilizing the massive uptime, content distribution network caching, cpu/memory scaling, and so on of the ArcGIS Online infrastructure for widespread public read only consumption with edit access on a more meagrely apportioned and less costly machine. You are not going to get both in one place, with ArcGIS Online.

share|improve this answer

I have set up groups.
One group is an edit group. In that group the editable map (with feature service) is shared.
The group is private and I invite only the editors to it.
Another group is for non-editors and I invite other members to it.
In that group my map service (non-editable) webmap is shared.
It works a bit like assigning permissions and roles.

share|improve this answer
    
This isn't effective as the edit/non-edit permissions are controlled at the group level. Anybody can bypass your groups and go straight to the edit-enabled feature service. In effect they create their own group that has whatever permissions they like. The underlying feature service is either open or closed, without any gradation between. See Ben Mearn's answer and commentary. –  matt wilkie May 7 at 15:41
    
then they aren't a contractor anymore because they are fired. Also they don't have an ioda of access on the service without the webmap. –  Brad Nesom May 7 at 16:03
    
Can't fire someone who doesn't work for you. I added a feature to Ben's edit-restricted group from a personal public account, essentially it's an anonymous edit. I didn't need or use his webmap to do it. –  matt wilkie May 7 at 16:06
    
I can fire a contractor. All my groups are not public, all my data is not public, There are no globally shared services. You can't edit my webmap. I don't even tell contractor there is a webmap. "I" provide ios login info and control username password. so they make an edit, I punt their user. –  Brad Nesom May 7 at 16:19
    
If the feature service is not open to public at all, then the issue I describe doesn't apply. However if the FS is displayed in a public map, any public map, and at the same time the FS is edit-enabled for anyone at all, then anonymous users can create/edit/delete data in the FS with minimal effort. In the case where the FS is never displayed in any fashion outside the authorized group, the data can still be edited anonymously, but the effort to discover the fs-ID in order to get to it is non-trivial. The door is changed from concealed to hidden, but it isn't locked. –  matt wilkie May 7 at 17:58

(edited 5/7/15)

Not ideal, but achieves collaborative editing and public viewing/not editing.

  1. make editors administrators under the organization
  2. make layer non-editable but share publicly
  3. administrators can "add as editable layer" for web admin and do disconnected/syncronized editing on Desktop

I was not able to recreate the correct permissions using roles, but this will work for us, since the number of editors is small and I trust them.

Something like what Brad suggested worked for me

  1. Sign into account with publisher permissions
  2. My Content > Add Item > From my computer > (check) Publish this file as a feature layer
  3. My Content > [Feature Layer] > Edit > (check) Enable editing and allow editors to ...
  4. My Content > [Feature Layer] > Share > Everyone
  5. My Content > [Feature Layer] > Add layer to [new] map
  6. On the map > share with everyone, disable editing on layer if it is enabled for some reason, save, publish through web application with share if desired
  7. Groups > Create group, add users to have edit permissions to group
  8. My Content > [Feature Layer] > Add layer to [new] map with editing enabled
  9. Share this map with the group just created for editors
share|improve this answer
    
A person moderately knowledgeable about how Arcgis Online services work, or even just willing to spend a lot of time pushing buttons and following links, can still go direct to the globally shared editable feature service (exposed in step 4) from their own map, which they have full control over. The procedure outlined here makes it inconvenient to get to an editable place but it doesn't forbid it. It provides a measure of protection, but it is not secure. –  matt wilkie Apr 2 at 19:10
    
Matt, check out my feature service at udel.maps.arcgis.com/home/… . On an account that isn't in the group with an editable layer, I'm not able to view or edit this. When I add that account back to the group I am able to view/edit again. The web application built from this feature service is at: udel.maps.arcgis.com/apps/webappviewer/… ... this may be a case where functionality has changed via subsequent updates? –  Ben Mearns Apr 3 at 12:45
    
I'm interested in following through on this, please ping me at matt.wilkie@gov.yk.ca. I confirm that attempting to view item details of the FS link above fails with 404 not found, ditto for "Buildings" and "Parking" layers from with the app. I'd like to go over the details of your configuration as compared to mine (screenshot etc.). Thanks! –  matt wilkie May 1 at 23:00
    
Found a way in. Look at "Buildings" feature service. There's a new record with NAME=Fake Building made by matt, to the north east off Old Paper Mill road. i.imgur.com/hi03EqU.png. Is this feature service supposed to locked from public editing? –  matt wilkie May 1 at 23:26
    
and here's a screenshot in your own app: i.imgur.com/ROeNA48.png –  matt wilkie May 1 at 23:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.