topic Re: SAS Dataset securization, row level in Administration and Deployment

SAS Dataset securization, row level

W1ndwaker — Fri, 27 Oct 2023 10:27:00 GMT

Hello,

We're trying to solve a problem related to the security of the data within a sas dataset (.sas7bdat file), we have a bunch of tables on a directory on a linux system, and we have different bussines segregation info in the datafiles, we would like to know if there is a solution to allow sas to restrict the access to this data for different users, for example: dataset clients, has information about clients from different geographies and i need to let user1 to get data from french clients and user2 spanish clients.

Data is segregated by a column with the nacionality of the client. without separating the dataset into 2 datasets, is there a way to restrict this dataset access?

thanks

Re: SAS Dataset securization, row level

AhmedAl_Attar — Fri, 27 Oct 2023 11:12:48 GMT

Hi @W1ndwaker

If you are using Base SAS, then this feature is not available out of box and you'll have to fudge it somehow. Here is a response from 2018 about the same request

code to implement row level security to data set using enterprise guide

Alternatively, you may want to try out SAS Federation Server if that's an option?

Hope this helps

Re: SAS Dataset securization, row level

W1ndwaker — Fri, 27 Oct 2023 12:06:07 GMT

Hi @AhmedAl_Attar

Federation server doesn't seems to be my best option, but reading on the post you gave me i found something that can work out, seems tricky but possible!

I'll work on it and see if i can get a solution on my own that fits the situation, in this case i'll try to post it here.

meanwhile will be hearing new comments.

Thanks!

Re: SAS Dataset securization, row level

LinusH — Fri, 27 Oct 2023 14:20:34 GMT

Do you have metadata server in your deployment?

If so, you could use meta-bound libraries to impose row level access.

However, this is not supported in Viya, so if you are planning to migrate soon you should look for other options.

Like, having data stored in a database that support row level security.

Re: SAS Dataset securization, row level

carl_sommer — Fri, 27 Oct 2023 14:48:58 GMT

Do you have metadata server in your deployment?

If so, you could use meta-bound libraries to impose row level access.

However, this is not supported in Viya, so if you are planning to migrate soon you should look for other options.

Like, having data stored in a database that support row level security.

FYI, if you are looking for information on metadata bound Libraries, here's the documentation link and a link to a 2018 SAS Global Forum paper:

SAS Help Center: SAS® 9.4 Guide to Metadata-Bound Libraries, Second Edition

A Programming Approach to Implementing SAS® Metadata-Bound Libraries for SAS® Data Set Encryption

Also, Viya supports Row Level Security for CAS tables.

Carl Sommer - SAS Technical Support

Re: SAS Dataset securization, row level

SASKiwi — Sat, 28 Oct 2023 23:54:59 GMT

How are you identifying client nationality? As long as that data is available in SAS, one solution would be to create views of your datasets containing a WHERE condition for nationality. Allow clients to only use the views to access the data by password-protecting the underlying real datasets. The views can contain the password to read the real tables, but that would not be available to the clients so they can bypass the views.

Re: SAS Dataset securization, row level

W1ndwaker — Mon, 30 Oct 2023 07:21:53 GMT

That doesn't fully works, since you can describe de view, and if the user is advance ha can define it again without the where.

Re: SAS Dataset securization, row level

W1ndwaker — Mon, 30 Oct 2023 07:28:21 GMT

In this case we use plain files, maybe it's a good point to move to metadata server and try this method of access control.

Re: SAS Dataset securization, row level

W1ndwaker — Mon, 30 Oct 2023 07:30:38 GMT

sorry didn't read your message full, yes that's maybe another solution, it can take a while to deploy since we need to redo all the programing arround views but can be good to investigate.

Re: SAS Dataset securization, row level

SASKiwi — Mon, 30 Oct 2023 19:00:28 GMT

@W1ndwaker - I was thinking a DATA step view might be worth looking at. You can't do a DESCRIBE on those.

Re: SAS Dataset securization, row level

W1ndwaker — Tue, 31 Oct 2023 07:16:33 GMT

I did the research on this, you can do it, with:

data view=view;
describe;
run;

but also, on data step view you cannot include the libname, so it has to be mapped previously, with this any user may take a look on the library and query the data by itself.

I know it's a tricky situation, and there is no correct answer, many of those or the convination are the solution