I have a map service with Features Access capabilities enabled on ArcGIS Server 10.3. This map service is protected using ArcGIS Server tokens.
I would like to have two categories of users with different permissions:
Users Category 1: Users that can create/delete/edit/query data using Features Access REST API. For this I use the Editor Tracking
Users Category 2: Users that can only query specific data
- User_A_Editor (Category 1)
- User_A_Viewer (Category 2)
User_A_Viewer would be able to only query data created by User_A_Editor. User_A_Viewer won't be able to create any data.
I know there is a possibility with Features Access coupled with Editor Tracking to restrict editing/deleting/query to features created by the user, but it seems I can't prevent a user of the Category 2 to create new feature or to query data created by any other users of the Category 1.
I was thinking to create a Geoprocessing Service that will be used as a kind of proxy for any REST queries made to this map service. So in the client application, all queries would be made to the GP service instead. This GP will verify if the user is allowed to do such REST query, and if yes, the GP will call the REST API and return the result to the client. But in reality, that won't prevent a wise user to use the REST API in a way not wanted as it will always be accessible.
Is there any solution?