topic Re: ERROR: User does not have appropriate authorization level ... in Administration and Deployment

ERROR: User does not have appropriate authorization level ...

shoin — Sat, 30 Apr 2022 20:14:26 GMT

This should be the most easier to chase issue but it is not. A regular puzzle.

Context

SAS scheduled batch job
Same job in EG executes w/o an issue, when scheduled reports a failure
Libname in log shows "Libref JNDL was successfully assigned ..."
Navigate from file explorer to the said path = yes
UNC path used
The target physical folder JNDL_LD in path is accessible, the user has special permission --> full control could be seen in advance security tab of the folder

ODD

/*This failed*/

libname jndl "\\faris\studies\2022\imaging_ai\JNDL_LD";

data jndl.fnl;
   set xyz;     /* a simple step formatting dates */
run;

ERROR: User does not have appropriate authorization level for file JNDL.FNL.DATA

/* down few steps of the same code, note the set statement */

data final;
   set jndl.fnl ;    /*did this not error out above ...huh */
    ... more format type steps
run;

NOTE: There were 100 observations read from the data set JNDL.FNL

This does not make sense to me, I have checked the user's file system permission and user has "special permissions" on JNDL_LD physical folder and viewing 'advance setting' the full permission = full control.

I am looking for any tips ideas to what else to check ...

Meanwhile, preparing to read, write in different simple step scheduled code mimicking R & W to JNDL_LD.

TIA

Re: ERROR: User does not have appropriate authorization level ...

Kurt_Bremser — Sat, 30 Apr 2022 20:20:57 GMT

Most probably, the dataset is already there and was created by another user. And only this user has write permission on the dataset file.

Re: ERROR: User does not have appropriate authorization level ...

Tom — Sat, 30 Apr 2022 22:34:48 GMT

Having permission to read but not to write is not unusual.

Is SAS running on Windows operating system? Windows file systems can have very complex permissions. Someone once created a write only directory for me: that was very hard to use.

Is everyone using Enterprise Guide to submit the SAS code? Are they connecting to the same SAS server? Or are some using SAS directly? Or running on their local machine?

Is there a dataset with that name in the folder already? What are the permissions on that file? Who is the owner?

Are you using managed librefs that are created automatically by SAS when your session starts? Or did all of the test runs have to execute their own libname statement to define the libref?

Re: ERROR: User does not have appropriate authorization level ...

Sajid01 — Sun, 01 May 2022 12:50:26 GMT

Hello @shoin
Your two codes are not identical. In the following you are reading data. Indicates you have read permissions.

data final;
   set jndl.fnl ;    /*did this not error out above ...huh */
    ... more format type steps
run;
NOTE: There were 100 observations read from the data set JNDL.FNL

In the following you are creating a file, The error nessage is clear. It says you do not have permission to write permissions to that folder.

libname jndl "Assuming that \\faris\Astudies\2022\imaging_ai\JNDL_LD";
data jndl.fnl;
   set xyz;     /* a simple step formatting dates */
run;
ERROR: User does not have appropriate authorization level for file JNDL.FNL.DATA

Assuming that \\faris\ represents a remote server \ storage location,

contact your System Administrators for assistance. Typically SAS Adminsitrators can check for permissions but the OS/AD level changes may be required depending upon how these are done at your organization.

Re: ERROR: User does not have appropriate authorization level ...

CHandberg — Sun, 01 May 2022 16:19:57 GMT

It could be because you use Integrated Windows Authenticaton in the connection profile.
Uncheck IWA and type username and password. It is important that you use the domain in the username eg mydomain\myuser.
The reason is that you “loose the domain” when you “jump to the next server” using UNC-path with IWA.

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 17:46:59 GMT

@Sajid01, thank you for your reply. The two steps were listed to show that the first step has a comment that states the previous step to the one listed 'failed' yet that step showed data read.

Yes, second step shows write error. However, when run interactive through an EG session, the same code is executed properly w/o any error.

The issue occurs when run as batch and or when scheduled (via sas scheduler). That is the issue I am trying to find an answer to and not finding any resolution. I have asked Server admin and looked in detail at the 'security' permissions applied on the UNC share and 'effective' permission and they translate to 'full permissions' for the user running it in EG as well as batch. A regular Sherlock saga.

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 17:49:44 GMT

Hello Chris, thank you for the suggestion. As I replied to Sajid01 above, "The issue occurs when run as batch and or when scheduled (via sas scheduler). That is the issue I am trying to find an answer to and not finding any resolution. I have asked Server admin and looked in detail at the 'security' permissions applied on the UNC share and 'effective' permission and they translate to 'full permissions' for the user running it in EG as well as batch. " --> is the real problem. I will ensure we do not have IWA selected (we have not implemented SSO / IWA in this environment).

This is the 2nd such issue I am dealing with. The other one is for hdisk MS error 58, simple error (authorization) yet everyway one checks it does not make sense.

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 17:55:39 GMT

*** Update ***

In troubleshooting, found the following:

No authorization issue when pgm is run via EG (same UNC path)
Issue occurs same step when run as batch
New:
1. In the same UNC path if the same dataset exists (or a file) the "not authorized" error occurs. However, the first new write it does not.

For AD and file system security the owner ID has "full permission" also confirmed with effective permission list.

Is there a SAS option that affects the said behavior of not overwriting an existing dataset? (better to ask than to wonder).

TIA

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 18:00:07 GMT

Hi Kurt, yes indeed that is what we found that the dataset was there and it could not be over written (I just posted detail replies and did not see yours till now, lol). I did not check who owned it, I will do so now. It is a WIN file system (unc file share).

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 18:04:43 GMT

- Yes WIN OS
- when using EG no issue, even target pre-existing dataset gets over-written, when run in batch (scheduled via SAS schedule manager) this error occurs (No IWA no token ID that runs object spawner)
- Group owns and permissions are for the owner 'full permissions' and other group member R,W,E,M,L
- Libnames are created in the sas pgm (I will check again), some via autoexec.sas

Much thanks for your time and suggestions.

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 18:05:56 GMT

BTW, same code via EG executes and overwrites the pre-existing dataset in the UNC path, only in batch it errors on the same step.

TIA

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 18:30:29 GMT

quick update, the user is the same who tries with EG (successful) and batch (fails with authorization error) and this user has 'full permission' on the said folder's parent

Re: ERROR: User does not have appropriate authorization level ...

Sajid01 — Mon, 09 May 2022 18:41:28 GMT

As I understand it, the batch job too is running from the desktop and you have a local installation.
If that is indeed correct, mount the remote location and assign a drive letter. For example "X".

Thus if \\faris is mounted at the drive X on your local desktop, then the libname would be

libname jndl "X:\studies\2022\imaging_ai\JNDL_LD";

For all practical purposes the remote location behaves as a local drive. It should work with both EG and in batch mode.

Re: ERROR: User does not have appropriate authorization level ...

shoin — Mon, 09 May 2022 20:24:49 GMT

Thank you @Sajid01. This is a server-client setup (EG on user's laptop, connecting to SAS server which has been presented the UNC path).

Re: ERROR: User does not have appropriate authorization level ...

SASKiwi — Tue, 10 May 2022 02:58:36 GMT

It sounds like further diagnosing of your SAS environment is required to get a resolution of this problem. Raising a Tech Support track in this case should help if you haven't done so already. I assume you are using the same user account to both connect to SAS via EG and to schedule the same job in batch mode.

Re: ERROR: User does not have appropriate authorization level ...

Sajid01 — Mon, 09 May 2022 23:35:51 GMT

I fully agree with @SASKiwi . This issue requires a greatere understanding then we have from the posts and ticket with SAS Tech Support is the best thing to do.