topic Re: Stored Process for Portal but not for Enterprise Guide users in Developers

Stored Process for Portal but not for Enterprise Guide users

deleted_user — Thu, 04 Mar 2010 16:49:06 GMT

Has anyone solved this puzzle?

I'd like to be able to create an SP to be run from the Portal that can report on secure data, and use Stored Process Server to get efficient execution (don't want each query to start its own workspace) but prevent Enterprise Guide users from running their own code on the same Stored Process Server and circumventing data security by running under the server identity.

If I secure the Logical Stored Process server in metadata I can prevent EG users from connecting to it ... but then if one of those users logs on to the Portal they can't run the canned Stored Process because the server is not available to them. If it's available to the Portal I can't see any way to stop the EG user running an SP there.

Is there some way to set up an SP server that the Portal can use, but which EG users can't see?

This is under 9.1.3 by the way, so a 9.2 method won't help (at least not for a while)

I wait in hope,

Steve

Re: Stored Process for Portal but not for Enterprise Guide users

milts — Sat, 06 Mar 2010 06:34:39 GMT

Hi Steve,

Are your EG users also your Portal users? If not, how about creating two groups in SMC? One for your Portal users and the other for your EG users? Then deny read of your SP to the EG group.

Milton

Re: Stored Process for Portal but not for Enterprise Guide users

deleted_user — Sat, 06 Mar 2010 12:13:18 GMT

Hi Milton,

Good idea, but the there is overlap between Portal users and EG users, so I can't segregate them that way.

I was wondering about setting up an SP server running under a different identity (rather than sassrv, something with a bit lower privilege that can't see the data by default) and then use a compiled macro to access the required hidden path, but only if the 'right' _PROGRAM value is present. Seems a bit convoluted, so I was hoping someone had found a better method before I try setting all that up.

Regards,
Steve

Re: Stored Process for Portal but not for Enterprise Guide users

Cynthia_sas — Sat, 06 Mar 2010 15:42:45 GMT

Hi:
I'm not clear on whether it is even POSSIBLE to set up a Stored Process Server that would use an identity other than sassrv. To me, that would be a question for SAS Technical Support. This documentation suggests that it is possible to hide server definitions from certain users:
http://support.sas.com/documentation/cdl/en/bisecag/61133/HTML/default/a003280630.htm

It does not outline a way to bypass the use of sassrv or SAS General Servers group.

cynthia