topic Re: Why Not Show Up CAS Allow List In Environment Manager in Administration and Deployment

Why Not Show Up CAS Allow List In Environment Manager

eddieleung305 — Mon, 03 Apr 2023 17:59:49 GMT

I would like to setup Allow List as manual https://documentation.sas.com/api/collections/sasadmincdc/v_014/docsets/evfun/content/evfun.pdf?locale=en but I noticed that the Path List tab not existing.

From the CAS server configuration tab, I only got Superuser Role Membership tab, Caslib Management Privileges tab and Logging tab.

What I problem I want to resolve is :

Cannot add caslib New Connection. It uses a path that is not in the allowlist. Failed to resolve path /export/data/ for caslib New Connection. Cannot add caslib New Connection. It uses a path that is not in the allowlist. The action stopped due to errors.

Anyone has this experience before and can help?

Re: Why Not Show Up CAS Allow List In Environment Manager

gwootton — Mon, 03 Apr 2023 18:53:34 GMT

Did you assume the superuser role before entering the settings menu?

Manage Path Lists (Allowlists and Denylists)
https://go.documentation.sas.com/doc/en/sasadmincdc/v_038/evfun/n0mq74h3dneq5on1l5gn4e5mwwc8.htm#p1obp8jdrwsjd2n17whi7txun5sh

Re: Why Not Show Up CAS Allow List In Environment Manager

ScottMcCauley — Mon, 03 Apr 2023 18:54:04 GMT

The Settings window displays the Paths list tab only after you assume the superuser role. Do that first and you should be able to edit the allow list.

Re: Why Not Show Up CAS Allow List In Environment Manager

eddieleung305 — Mon, 03 Apr 2023 19:09:57 GMT

I am using sasroot to perform the action. I right click on the CAS server cas-shared-default but only 'Configuration' and 'Setting' show in the pop-up menu.

If I click on Setting, then the screen only shows up 'Superuser Role Membership', 'Caslib Management Privileges' and 'Logging'

May I know is it the correct page to assume SuperUser Role? Is it anything wrong I performing the action by sasboot?

Re: Why Not Show Up CAS Allow List In Environment Manager

gwootton — Mon, 03 Apr 2023 19:13:02 GMT

The sasboot user cannot assume the CAS Superuser role, you would need to use a normal administrative account.

Re: Why Not Show Up CAS Allow List In Environment Manager

ScottMcCauley — Mon, 03 Apr 2023 19:23:20 GMT

As Greg indicated, when signed in as a user registered in the SASAdministrators group, you should be able to right click on your CAS server on the Servers page and there you should see the option to Assume the Superuser role.

We do not usually recommend using the sasboot account for administrative tasks after initial configuration steps or except for special cases when a regular administrator user's permissions are insufficient.

Re: Why Not Show Up CAS Allow List In Environment Manager

eddieleung305 — Mon, 03 Apr 2023 19:29:24 GMT

Thank you for the advice, I can set up the allowed list from the Environment Manager.

May I ask one follow up question in validating the setting by Data Preparation and try to load data file from the path of the newly defined allowlist.

The error is below and I am sure the path exists and is assessable by compute node and cas node.

The file or path '/export/homes' is not available in the file system. The action stopped due to errors. property: TKCASTAB_FILE_NOT_FOUND uri: /casManagement/servers/cas-shared-default/caslibs/New Connection/tables path: /SASDataExplorer/ui/datasources/validation traceId: 83f25cd7d44d66e6

Re: Why Not Show Up CAS Allow List In Environment Manager

gwootton — Mon, 03 Apr 2023 19:52:23 GMT

If this is on Kubernetes, the path will need to be mounted into the CAS server pods rather than the node where those pods run, for example using the customization in:
$deploy/sas-bases/examples/cas/configure/cas-add-nfs-mount.yaml