topic Re: Rules and authorizations in SAS Viya in Administration and Deployment

Rules and authorizations in SAS Viya

JuanS_OCS — Wed, 17 Oct 2018 10:16:46 GMT

Hi,

the identity, authorizations and rules in SAS Viya is definetely a very exciting world. While for most of actions the GUI is OK, there are many cases where the CLI or Rest-API interfaces can help greatly. This is the area I am mostly exploring at this moment.

I have a question with Darrel, where @ShelleySessoms is helping me in communications with him.

https://communities.sas.com/t5/Administration-and-Deployment/Join-us-for-our-next-SUGA-Webinar-on-October-9/m-p/504349/highlight/false#M14679

In parallel, I saw a very related and interesting question open by @mimran and being answered by Super_FREQ @Madelyn_SAS with lots of information.

https://communities.sas.com/t5/Administration-and-Deployment/How-to-grant-or-restrict-user-access-in-SAS-Viya-environment/m-p/503863

But I have a problem, after having a profile, successfully login in (with my user which has capabilities as SAS Administrator as well), I can do many operations, but the following command returns a list, but empty, only the headers

/opt/sas/viya/home/bin/sas-admin --output text authorization list-rules

Is it possible that the command won't return the rules that are set by default with a Viya installation?

It would be great to see everything.

I feel very curious about your insights. specially Darrel's ( @ShelleySessoms ) and @Madelyn_SAS 's.

Thank you in advance!

Kind regards,

Juan

Re: Rules and authorizations in SAS Viya

alexal — Wed, 17 Oct 2018 12:24:50 GMT

@JuanS_OCS,

That command should list the authorization rules from /authorization/rules. What do you see if you open https://<SAS_VIYA_FQDN>/authorization/rules?

Re: Rules and authorizations in SAS Viya

ShelleySessoms — Wed, 17 Oct 2018 12:28:57 GMT

Darrell says, "I assume I’m doing the same things he is. I’m seeing all the rules when I run the CLI command as a SAS Administrator." He suggests contacting tech support. Since @alexal is on the thread, you're good there. Thanks!

Re: Rules and authorizations in SAS Viya

PaulHomes — Thu, 18 Oct 2018 00:53:05 GMT

Hi @JuanS_OCS,

When I was doing some work with the REST API, I was also seeing a filtered list of rules returned (dozens instead of hundreds), which appeared to be related to not opting in to the assumable group SASAdministrators. I just tried the CLI when logged in as an admin and it returned hundreds of rules. When logged in as a normal user it returned less than 50 rules. I don't see any CLI option to opt in/out of assumable groups so perhaps double check you are logged in as a member of SASAdministrators?

Cheers
Paul

Re: Rules and authorizations in SAS Viya

JuanS_OCS — Thu, 18 Oct 2018 07:03:53 GMT

Thank you, @ShelleySessoms, @alexal and @PaulHomes !

@alexal, @PaulHomes,

From the RestAPI URI:

if I log in, with my user, without assuming SAS Administrator, I indeed get a fre rules.
if I log in, with my user, assuming SAS Administrator, I get more rules. Not sure if it is the full set. but at least larger quantity.

From the CLI:

When I log in, with my user, I have no option to assume SAS Administrator role.
The list of rules is completely empty.

@alexal, could you please check this? I checked by now 4 different installations of Viya 3.3, at customers are at my server, and all of them give same results.

@PaulHomes, agreed! A prompt or parameter in CLI to assume, or not, Custom Groups, at least SAS Administrator, would be great.

That one goes to the ballot right away.

Re: Rules and authorizations in SAS Viya

alexal — Thu, 18 Oct 2018 12:20:55 GMT

@JuanS_OCS,

Here is what I see on my SAS Viya 3.3 server:

Re: Rules and authorizations in SAS Viya

JuanS_OCS — Fri, 19 Oct 2018 08:26:28 GMT

THank you @alexal

Maybe there is a difference, on how my user is configured, or how I do log in, from what you do.

Could you please share your user set up and login process?

Re: Rules and authorizations in SAS Viya

alexal — Fri, 19 Oct 2018 10:52:10 GMT

@JuanS_OCS,

Sure.

Re: Rules and authorizations in SAS Viya

JuanS_OCS — Sun, 21 Oct 2018 14:58:50 GMT

Hi @alexal,

thank you. So I see I am doing nothing different than you, unless that loging with a created profile does make a difference.

Tried also without profile, and I am getting the same, on several Viya environments.

Re: Rules and authorizations in SAS Viya

alexal — Tue, 23 Oct 2018 11:25:42 GMT

@JuanS_OCS,

I would like to review an output from a command shown below:

/opt/sas/viya/home/bin/sas-admin --verbose authorization list-rules