topic Allow access only to a given group for a SASContent folder and deny to authenticated users in Administration and Deployment

Allow access only to a given group for a SASContent folder and deny to authenticated users

Edoedoedo — Fri, 22 Sep 2023 09:04:38 GMT

Hi,

I have a folder in the SASContent like /SASContent/Projects/SecretProject.

I need to restrict all grants for this specific path only to the group "SpecialGroup".

I can a new rule to grant "SpecialGroup" everything for that path without problems.

But the "Authenticated Users" principal is present everywhere with READ grant on /SASContent and convey, and hence the SecretProject folder inherits the READ grant for "Authenticated Users": I cannot deny that, otherwise I would lock everyone out.

How can I secure that path and only that from "Authenticated Users", still keeping the general READ grant on all /SASContent and convey for "Authenticated Users" BUT on the SecretProject folder?

Using Viya 2023.x

Re: Allow access only to a given group for a SASContent folder and deny to authenticated users

gwootton — Fri, 22 Sep 2023 12:49:17 GMT

You could use a conditional prohibit read on authenticated users, with the condition "!groupsForCurrentUser.contains('SpecialGroup')", be sure SAS Administrators is a member of the Special Group.

Re: Allow access only to a given group for a SASContent folder and deny to authenticated users

angian — Wed, 27 Sep 2023 03:36:52 GMT

If you need to hide any members under SASContent then you do not want to use Read Convey at that level. You can't break convey, and it should only be used when all children should inherit the grant. This paper shows some examples with explanations. Written for 3.5 but the same applies...

Understanding Security for SAS® Visual Analytics 8.2 on SAS® Viya®

Re: Allow access only to a given group for a SASContent folder and deny to authenticated users

Edoedoedo — Wed, 27 Sep 2023 09:49:38 GMT

Thanks, so the caveat was just not to apply "read convey" at SASContent level, so in the subfolder the authenticated users does not have the read permission by default, it seems much cleanerò