Creating a database account for the map author

To support integrated security, the author of the map document must have the required database privileges. You will need to define the database account used to author the map document. As the database administrator, create and assign permissions to the user who will author the map:

CREATE USER <map author> IDENTIFIED BY <map author password>
 DEFAULT TABLESPACE <tablespace_name>
 TEMPORARY TABLESPACE <temp_tablespace_name>;

 GRANT CONNECT, RESOURCE TO <map author>;

Refer to Oracle documentation for additional information and requirements for creating users.

Creating database accounts for ArcGIS web service users

For integrated security to work, each ArcGIS web service user must have a corresponding database account. As the database administrator, create database accounts for each user who will access ArcGIS web services. You will also need to grant connect privileges to each user through the map author database account.

CREATE USER <ArcGIS Web user> IDENTIFIED by <ArcGIS Web user>
DEFAULT TABLESPACE <tablespace_name>
TEMPORARY TABLESPACE <temp_tablespace_name>;

GRANT CONNECT,RESOURCE to <ArcGIS Web user>;

ALTER USER <ArcGIS Web user> GRANT CONNECT THROUGH <map author>;

CREATE USER "<domain name>\<user name>" IDENTIFIED by <user name>

For each database account created, grant privileges as desired to correspond to what the user is authorized to do within the Oracle geodatabase. As an example, two roles are defined below to grant permissions to ArcGIS web service users. The first role is defined to allow database selects (permission to view data) on two geodatabase layers and the second role to allow editing on a layer.

--Role for displaying boundary layers
CREATE ROLE sel_boundary_role NOT IDENTIFIED;
GRANT SELECT ON <map author>.States TO sel_boundary_role;
GRANT SELECT ON <map author>.Counties TO sel_boundary_role;

GRANT sel_boundary_role to <user one>;

-- Role for displaying transportation layer
CREATE ROLE sel_trans_role NOT IDENTIFIED;
GRANT SELECT,UPDATE,INSERT,DELETE ON <map author>.Roads TO sel_trans_role;

GRANT sel_trans_role to <user two>;

It is also possible to configure permissions on individual rows (features) and on columns (attribute fields) in the Oracle database. For details, refer to the Oracle database documentation.

Authoring a document and publishing it to ArcGIS Server

You can use ArcMap to create your document. When adding geodatabase resources, you will need to use the credentials of the map author database account described in Defining the map author. Publish the map document to ArcGIS Server. Be aware that map service capabilities such as WMS and KML will enforce the same security restrictions as with standard ArcGIS web services (SOAP/REST).

Enabling integrated security for Oracle

After defining database accounts, you will need to create users and roles in the ArcGIS Server identity store that exactly match the Oracle users and roles. To add a new user, see Adding a new user in Manager. To add a new role, see Adding a new role in Manager.

After creating users and roles in the ArcGIS Server identity store, you will need to configure ArcGIS Server to pass the user identity down to the Oracle database. To enable database integrated security, follow the steps below:

Testing integrated security

Create a web mapping application that consumes the ArcGIS web service created with support for integrated security. Open the web application in a web browser. Only the layers/features that the user was granted permissions to should display in the web application. You can repeat this test by creating a new web mapping application that uses the credentials of a different user.