Grant and revoke dataset privileges

Available with Standard or Advanced license.

If you want to let other database users view or modify the contents of any data in a database, you must grant them the privileges to do so.

You can use the Privileges dialog box or the Change Privileges geoprocessing tool in ArcGIS for Desktop or the ChangePrivileges_management function in a Python script to specify what privileges a user or group has on a specific dataset.

You can grant just select privileges, meaning the user can read and select from but not modify the contents of a dataset. You can also grant update, insert, and delete privileges, which allows the user to modify the contents of a dataset.

The following rules apply to granting and revoking privileges on data in a database or geodatabase:

• Only the table owner can alter privileges on it.
• Only the table owner can drop it or alter its definition; therefore, even if another user has been granted insert, update, and delete privileges on a dataset, that user cannot alter the schema.
• If you are going to grant the insert, update, or delete privilege to a user, you must also grant the select privilege; the user must be able to read the dataset before the user can edit it.
• The dbo and db_owner roles will not appear in the User/Role list for SQL Server databases. These users automatically have full privileges on all data, and you cannot revoke those privileges.
• PostgreSQL login roles or groups that have been granted superuser privileges in the database will not appear in the User/Role list. These users automatically have full privileges on all data, and you cannot revoke those privileges.
• You can only alter a user's privileges on one dataset at a time using the Privileges dialog box. To alter privileges on multiple datasets at once, use the Change Privileges geoprocessing tool or Python function instead.
• Revoking privileges requires an exclusive lock on the dataset; therefore, if another user is connected to the dataset, you won't be able to revoke privileges from users on the dataset.

These rules apply to granting and revoking privileges on datasets in a geodatabase only:

• All feature classes in a feature dataset must have the same user privileges.
• Beginning with ArcGIS 10.1, if new feature classes are added to a feature dataset, or a network or topology is built in the feature dataset, existing user privileges are automatically granted to the new feature class, network, or topology to match the privileges granted on the feature dataset.
• When privileges are granted to a feature class or table that participates in a relationship class, privileges must be granted to both the origin and destination class. If the origin and destination feature classes are within the same feature dataset, they have the same set of privileges since privileges are granted at the feature dataset level. However, when the origin or destination class is not in the same feature dataset, you must ensure the proper privileges are granted to both the origin and destination classes. If the relationship class is either Attributed or has Many to Many cardinality, privileges are automatically propagated to the intermediate table when you assign privileges to the origin class.
• If the dataset is not versioned, you can grant and revoke the update, insert, and delete privileges individually using the Privileges dialog box. For example, you can grant a user select and update privileges, which allows the user to connect to the dataset and alter existing features but does not allow the user to add new features or delete existing features.
• If the dataset is registered as versioned, the privileges that allow a user to modify a dataset (update, insert, and delete) must be granted and revoked as a group.
• If the dataset is registered as versioned, the geodatabase administrator must have full privileges on it. Therefore, you cannot revoke privileges from the geodatabase administrator on versioned datasets.

Use one of the following methods to grant or revoke privileges on datasets you own:

• Privileges dialog box—You can see what privileges a user or group already has on a specific dataset when you use the Privileges dialog box. You can also grant privileges on the dataset to more than one user or group at a time.
• Change Privileges tool—You can grant privileges on multiple datasets to a user or group when you use the Change Privileges tool.
• Python script—Python scripts can be run from Linux machines where ArcGIS for Server is installed. Privileges can be altered on multiple datasets.

Use the Privileges dialog box

You open the Privileges dialog box from the context menu of a database connection in the Catalog tree. This dialog box allows you to choose from a list of users and groups to grant privileges to. It also allows you to grant INSERT, UPDATE, and DELETE privileges on a dataset individually, provided the dataset is not registered as versioned.

1. Start ArcMap or ArcCatalog and double-click the Database Connections folder in the Catalog tree.
2. Connect to the database or geodatabase that contains the data you own and for which you want to grant or revoke privileges.
3. Right-click the dataset, point to Manage, and click Privileges.

   The Privileges dialog box opens.

4. If the user or role whose privileges you want to change is already in the list, check or uncheck the boxes for the privileges you want to grant or revoke, and then click OK to apply your changes.

   Note:

   If you uncheck all the privilege boxes, the user or role will be removed from the list.

5. If the user or role is not already in the list, do the following:
   1. Click Add to open the User/Role dialog box.
   2. If you have privileges in the database to view the system table that lists all users and roles in the database, you can choose the database users or roles you want to add from the list by checking the box next to their names. Otherwise, type the name of the database user, database role, operating system login, or Windows group to which you want to grant privileges. To type multiple users or groups, type the names separated by commas (no spaces).
   3. Click OK to close the User/Role dialog box.
   4. Check the boxes of the privileges you want each new user or role to have and click OK.

Use the Change Privileges tool

You can use the Change Privileges tool in ArcGIS for Desktop to grant or revoke privileges on datasets you own. The tool can be found in the Geodatabase Admin toolset of the Data Management toolbox.

You can change a user's or group's privileges on multiple datasets at once using this tool. Be aware that the Change Privileges tool does not show what privileges the user already has on the datasets. Also, INSERT, UPDATE, and DELETE privileges must be granted as a set, not individually.

1. In ArcGIS for Desktop, connect to the geodatabase or database as the owner of the datasets on which you want to grant or revoke privileges.
2. Open the Change Privileges tool.

   This tool can be found in the Geodatabase Administration toolset of the Data Management toolbox.

3. Browse to your database connection and choose the datasets for which you want to change privileges.
4. Type the name of the user or group whose privileges you want to change.
5. Use the View and Edit drop-down lists to choose the privileges you want to grant to the specified user or group:

   You must grant view privileges if you want to grant edit privileges.

6. Click OK to run the tool.

Use a Python script

If you want to script the granting or revoking of privileges on a dataset you own, you can use the ChangePrivileges_management function in a Python script.

1. First, create a database connection using the CreateDatabaseConnection_management function. You must connect as the owner of the datasets and save the user name with the file.

   In this example, the connection file gdb.sde is created in the /usr/connections directory. The connection is made to the markets database on the dserver database cluster as user eng1.

   import arcpy
   arcpy.CreateDatabaseConnection_management (r'/usr/connections', "gdb.sde", "POSTGRESQL", "dserver", "DATABASE_AUTH", "eng1", "T!i569", "SAVE_USERNAME", "markets")
   

2. Run the ChangePrivileges_management function.

   In this example, view privileges are granted on three datasets to the group readers.

   arcpy.ChangePrivileges_management ("/usr/connections/gdb.sde/markets.eng1.properties,markets.eng1.routes,markets.eng1.demo", "readers", "GRANT", "AS_IS")