Setting permission on feature dataset with sdelayer don't work

[gismoe]

I want to set permissions on a feature dataset but this results in an error message:
Error: Layer not found (-20).

This is may command:

sdelayer -o grant -l FDS,SHAPE -U FDS_EDIT -A SELECT,UPDATE,INSERT,DELETE -i 5153 -s SERVER -u ADMIN -p xxxxxx

Setting the permission with ArcCatalog works very well but i want to create a batch to rebuild all my permissions.

[vangelo]

None of the ArcSDE command-line utilities will access any of the geodatabase extensions
like domains or feature datasets (implemented outside the ken of ArcSDE). You can use
Python to script geodatabase management via ArcGIS (more so at 10.0 than with earlier
releases), or manage the indiviual dataset member tables via 'sdetable -o grant'.

- V

[gismoe]

Thank you.

Can you please post an example how to set a permission with a python-script?
We use Arcgis Server 9.3.1

What the difference between setting a permission with

sdelayer -o grant -l featureclass,SHAPE -U FC_EDIT -A SELECT,UPDATE,INSERT,DELETE -i 5153 -s SERVER -u ADMIN -p xxxxxx

or

sdetable -o grant -t -featureclass -U FC_EDIT -A SELECT,UPDATE,INSERT,DELETE -i 5153 -s SERVER -u ADMIN -p xxxxxx

[vangelo]

In theory, there is no difference between using 'sdetable' and 'sdelayer'. I use 'sdetable'
because it is the proper context (permissions are a property of a table), and because I
don't need to know the geometry column name, and because it's less typing. It is possible
that using 'sdelayer' could, by design, fail to set raster support table permissions if both
SE_SHAPE and SE_RASTER columns existed in a table (I would hope it wouldn't, but I only
use 'sdetable', so I wouldn't know). 'sdelayer -o grant' should have been deprecated
at 8.1 and eliminated by 9.0, but doing so would have broken a lot of scripts.

- V

[gismoe]

Thank you very much for your detailed answer.
If there is no difference i will use sdetable in future because it supports feature classes and feature datasets.

[vangelo]

'sdetable' only supports tables, not feature classes or feature datasets. It just so happens
that feature classes are modeled as tables, so 'sdetable' can be used on feature class names,
but feature datasets are not modeled as tables, so you can't refer to them at all with 'sdetable'.

If you fail to grant the same permissions for all the tables comprising a feature dataset, ArcGIS
will only acknowledge the minimum permission held in common (logical AND), even if that means
no permission at all. All in all, you'd be better off using Python (if it has the requisite hooks at
9.3.1, which it likely does; I just don't use ArcGIS all that much).

- V

[russellb]

Hi Gismoe,

This python script should work to set the permissions appropriately. Just swap out the path to your server connection info, FDS name and username.

# Purpose: Change user privileges on a dataset

# Create the Geoprocessor object
import arcgisscripting
gp = arcgisscripting.create(9.3)

try:
    # Set the name of the feature dataset, feature class, or table to change privileges on.
    objName = 'ADMIN.FDS'
    # Set the name of the user or role to grant privileges to.
    username= 'FC_EDIT'

    # Process: Update user privileges
    gp.ChangePrivileges("Database Connections/Connection to Server.sde/" + objName, username, "GRANT", "GRANT")

except:
    # If an error occurred while running a tool, print the messages
    print gp.GetMessages()

Hope this helps,
Russell