topic Re: New Role in Management console - only access data through libraries? in Administration and Deployment

New Role in Management console - only access data through libraries?

missmindi — Tue, 30 Oct 2018 16:30:51 GMT

Hi SAS Admins,

We have a custom SAS security set up and I need to add an additional role for our organization. I need to create a role that only allows users to access and import sas datasets through libraries pointing to specific physical folders on our SAS server. I know how to create the libraries in Management console. I do not want to allow them any other SAS capabilities for this role (they will get those from another role). Can you please help?

Re: New Role in Management console - only access data through libraries?

SASKiwi — Tue, 30 Oct 2018 19:05:19 GMT

If you want to limit SAS users to accessing SAS data through only libraries set up in metadata and not be able to bypass metadata security by defining their own LIBNAMEs then you need to look at metadata-bound libraries:

https://documentation.sas.com/?docsetId=seclibag&docsetTarget=n0tzurc8qfze0vn13z4n6j6mzz14.htm&docsetVersion=9.4&locale=en

I suggest you read the documentation in the link carefully as setting these up is not trivial and it also requires more administration.

Re: New Role in Management console - only access data through libraries?

PaulHomes — Wed, 31 Oct 2018 05:36:29 GMT

You might want to provide some more specific info (examples may help) so community members can give you more targeted assistance. e.g. which SAS version and platform is this for? Are you looking for help with access controls or just SAS roles and capabilities? It sounds like it might be a combination of several things. By role do you mean a SAS "Role" or a generic job role?

As @SASKiwi mentioned SAS metadata bound libraries may help here. You will probably also need to look at access controls in metadata (via ACTs/ACEs for groups on objects), access controls in the file system (UNIX, Linux or WIndows?) and role/capabilities in metadata (to control access to SAS application features) - a multi-layered approach.

If your question is only about SAS roles and capabilities then I would suggest the following resources:

Metadata Roles section (and associated links) in the SAS® 9.4 Intelligence Platform: Security Administration Guide.
Administering Roles section in the SAS® 9.4 Intelligence Platform: Desktop Application Administration Guide.
Assign Capabilities to a Role section in the SAS® 9.4 Management Console: Guide to Users and Permissions.
SAS Global Forum 2010 Paper (324-2010) "Be All That You Can Be: Best Practices in Using Roles to Control Functionality in SAS® 9.2" by Kathy Wisniewski