topic Re: Synchronize users between SAS Metadata and LDAP in Administration and Deployment

Synchronize users between SAS Metadata and LDAP

th1agol1ma12 — Fri, 10 Nov 2017 13:06:28 GMT

Hello guys,

I need to synchronize my LDAP users with the SAS metadata. I was trying to adapt the code provided by SAS (importad.sas), but due to the lack of knowledge in LDAP functions and SAS programming, I am not able to move forward. I wonder if anyone here has already done this, and if so, if you could share the solution with me.

Details:

- LDAP Oracle 11.1.1.7

- SAS 9.4 M4

Thank you for your attention.

Re: Synchronize users between SAS Metadata and LDAP

Damo — Fri, 10 Nov 2017 13:28:01 GMT

Hi @th1agol1ma12

Usage Note 40628 (Automating the addition of users and groups to a SAS® Metadata Repository) would be a good starting point.

It references the documentation SAS® 9.4 Intelligence Platform: Security Administration Guide and sample code.

Hope that helps.

Cheers,
Damo

Re: Synchronize users between SAS Metadata and LDAP

th1agol1ma12 — Fri, 10 Nov 2017 13:33:42 GMT

Hi @Damo,

Thanks for your response, I started working with this link, however it does not provide many details of the loading process using LDAP, only Active Directory

Re: Synchronize users between SAS Metadata and LDAP

Damo — Fri, 10 Nov 2017 14:12:53 GMT

Hi @th1agol1ma12

I'm not expert but I think LDAP is the protocol used for Active Directory, so instructions should work for you.

Cheers,

Damo

Re: Synchronize users between SAS Metadata and LDAP

th1agol1ma12 — Fri, 10 Nov 2017 18:12:11 GMT

Hi @Damo,

Yes, but I was not successful at running the LDAP server. The return of SAS support was that the script is directed only to AD and that it has no documentation for LDAP

Re: Synchronize users between SAS Metadata and LDAP

th1agol1ma12 — Tue, 14 Nov 2017 15:46:02 GMT

On documentation sended by support: For other formats, the first step is to figure out how to extract the data from your authentication provider. If you have LDAP, you might be able to modify the Active Directory sample for your purposes.

Has anyone made this adaptation yet?

Re: Synchronize users between SAS Metadata and LDAP

saspert — Fri, 02 Oct 2020 16:24:23 GMT

1) Any update/resolution on this issue. From my past experience,

2) In the past, I found myself deleting SAS users manually in metadata who are no longer on the payroll. Would this fix automate this process?

3) What kind of backups do I need to do before trying this?

PS: Can we move this thread to SAS Administrators group from the programming group for more visibility ?

Thanks,

Re: Synchronize users between SAS Metadata and LDAP

Kurt_Bremser — Fri, 02 Oct 2020 18:03:56 GMT

@saspert wrote:

PS: Can we move this thread to SAS Administrators group from the programming group for more visibility ?

Done.

Re: Synchronize users between SAS Metadata and LDAP

Kurt_Bremser — Fri, 02 Oct 2020 19:47:10 GMT

For #2: if you get importad.sas to import users, it will also remove users that no longer exist in LDAP.

Re: Synchronize users between SAS Metadata and LDAP

gwootton — Fri, 02 Oct 2020 21:02:07 GMT

1. The importad.sas program has defaults specific to Active Directory, but as has been mentioned the program uses LDAP to pull from Active Directory so can be modified to pull from another LDAP provider. The differences would be in mapping attributes between LDAP and Metadata. This is defined in the ldapextrpersons and ldapextrgroups macros defined in importad.sas. At the beginning of each is an attrs section that specifies the names of the attributes to pull from LDAP, then there are a series of if statements that say if attrName = one of the LDAP attributes then set the value of metadata attribute to the value. Modifying those two sections allow you to go from Active Directory to another LDAP provider.

2. Once you have importad.sas successfully pulling the information you want from LDAP, you can use Sample Code for User Synchronization to use importad.sas to pull the information from LDAP and compare that with what is in Metadata, removing from Metadata those not present in the LDAP table. This is not a function of importad.sas by itself.

3. I would take a Metadata backup prior to running this in case it removes users that should remain, or adds users you don't want.