topic Can I create a rule that is applied to multiple Object URIs (URIs containing a specific substring) in SAS Viya

Can I create a rule that is applied to multiple Object URIs (URIs containing a specific substring)

RobWanders1 — Wed, 15 Nov 2023 15:53:10 GMT

Hi,

I have made some rules on Viya that allow members of a self-made User Admin group (UG_UserAdmin_<group1>) to manage another usergroup (UG_<group1>).

Object uri

Principal

Setting

Permissions

Description

/identities/groups/UG_<group1>/userMembers/*

UG_UserAdmin_<group1>

Grant

Create, Update, Delete

UG_UserAdmin_<group1> can add or remove members of the

UG_<group1> group

/identities/groups/UG_<group1>

UG_UserAdmin_<group1>

Grant

Read

UG_UserAdmin_<group1> see the UG_<group1> group

We have sets of rules like this for many different User Groups & corresponding User Admin Groups. This works like intended, but I would like to create a Global User Admin Group, that can administer all User groups. I know I can make this Global User Admin Group member of all individual User Admin Groups, but in some cases a User group does not have a User Administrator group, but I still want the Global User Admin Group to be able to administer this group. Allowing the Global User Admin Group to administer ALL groups would not be an option either, because the Global User Admin Group should only be allowed to administer a selection of the groups.

Is it possible to create a rule that is applied to Object Uri's following a certain naming convention. For example, I would like to apply a rule to every Object uri containing a certain substring ("/identities/groups/UG_" in this example)

Re: Can I create a rule that is applied to multiple Object URIs (URIs containing a specific substrin

gwootton — Wed, 15 Nov 2023 17:55:12 GMT

I don't think you can add a wildcard next to a prefix in the Object URI.
I would try using the Object URIs /identities/groups/*/userMembers/* and /identities/groups/*, then add a condition on the request URI containing UG_. For example something like:
requestUri().contains('/identities/groups/UG_')

Re: Can I create a rule that is applied to multiple Object URIs (URIs containing a specific substrin

RobWanders1 — Thu, 16 Nov 2023 08:33:27 GMT

Thanks for your reply! Your solution didn't quite work, but in the documentation about rule conditions here I found this table:

FunctionDescriptionType

contentType()	Content type of the target (for example, `application/vnd.sas.credential.domain+json`).	String
contentLength()	Length of the request.	long
uri()	URI of the target.	String

And it seems like I need to use uri() in my condition instead of requestUri(). I modified the rule to uri().contains('/identities/groups/UG_') and it works now.