[mapguide-users] Permissions Model, restricting layers and error logging

[Dave Wilson]

Currently if an Author wants to deny a user from seeing a layer in a map they have to remove permissions on the Feature Source that the layer is built on. The result is that the layer appears in the legend, but fails to load and generates an error in the server error log. If the Author removes permissions from the layer an error occurs and the Map fails to load. This may be as designed, but it is not logical.

Ideally Authors might want to remove permissions on the layer so that at runtime it is not processed and is in effect invisible to the user. No security errors should be logged because the failure to process is intentional. If they were to be logged we would likely need to enhance our Error logging mechanism to create classes of errors such as Error, Warning or Information. That way Permission type errors could be Warnings. Administrators would then need the option to filter out the Types of errors that get logged because it's possible that with a large number of users the many Permissions Warnings could be logged effectively spamming the logfiles.

This is almost in contradiction to our need to provide feedback to the end user when a layer fails to load for some reason. I can see cases where actual errors such as feature source not found are communicated to the user via the legend in the map for example. The user could click on the legend entry and get error details perhaps. In MapGuide 6.5 we would render an X over the icon in the legend to indicate it failed. Of course if the user uses a new Flexible/Fusion Layout where the legend is not visible we might need another mechanism to indicate a failure.

The concept of applying our permissions model to resources should be extended to Groups in a Map. Authors should be able to set permissions on a Group in a Map and deny access to users or User Groups to control whether the group is even visible to the end user in the Map. I think to properly implement the Permissions enhancements we should combine those changes with the Error logging enhancements.

Has anyone desired such functionality or alternately built maps on the fly to add layers based on what their uses have rights to? I'm curious if the suggested improvements would be worthwhile and alleviate current grief.

Regards,
Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.osgeo.org/pipermail/mapguide-users/attachments/20080529/17d71e55/attachment.html