topic Re: SASAppCustom for a custom metadata group in Administration and Deployment

SASAppCustom for a custom metadata group

Lenvdb — Mon, 10 Apr 2017 10:13:54 GMT

Hi all

I am stuck and need a magic wand today.

We are working with highly restricted data, for which we had to set up a seperate ringfenced work area, storage etc.

I was advised by SAS Tech Support to create a new custom Workspace Server for them, and then set up separate Metadata User profiles.

Requirements:

Separate Workspace Server

Separate Windows dataset folder located on separate file server

Separate Windows AD User Groups x 2 (LibraAdmins + LibraUsers)

Separate /SASWork folder defined in config file

Implementation:

Restrict access to all other SAS Users / SAS Groups in Metadata to this location and allow only the 2 Groups listed above access to the new Workspace Server SASAppLibra.

I have now set up SASAppLibra.

How do I proceed from here to grant access to the 2 User Groups to this SASApp, and restrict all other Groups from seeing / accessing SASAppLibra?

Is there some documentation available anywhere on this?

Re: SASAppCustom for a custom metadata group

MichelleHomes — Mon, 10 Apr 2017 10:57:24 GMT

Hi There,

I'd spend some time on setting up your access using ACTs. Have a read through the SAS documentation to understand how this can be achieved http://support.sas.com/documentation/cdl/en/mcsecug/64770/HTML/default/viewer.htm#about.htm

You may also like to read @CecilyHoffritz's 2011 SAS Global Forum paper, Best Practice Implementation of SAS® Metadata Security at Customer Sites in Denmark: http://support.sas.com/resources/papers/proceedings11/376-2011.pdf

Furthermore @angieh presented at SAS Global Forum last week a paper that you may find helpful, Getting Started with Designing and Implementing a SAS 9.4 Metadata and File System Security Design: https://communities.sas.com/t5/SAS-Global-Forum-2017/If-you-are-interested-in-SAS-Metadata-Security-read-on/gpm-p/347025#M423

Deny broadly, grant selectively... as suggested at http://support.sas.com/documentation/cdl/en/mcsecug/64770/HTML/default/viewer.htm#p12rsiojalls90n17oaogunw2ca6.htm

Kind Regards,

Michelle

Re: SASAppCustom for a custom metadata group

Lenvdb — Mon, 10 Apr 2017 12:11:29 GMT

Hi Michelle

Yes - it seems ACT's will be the solution here, and I agree with the policy of Deny broadly and grant selectively.

Thanks for your help.

Re: SASAppCustom for a custom metadata group

MichelleHomes — Mon, 10 Apr 2017 12:30:14 GMT

My pleasure. Please mark the question as solved so that it may help others in future too.

Kind Regards,

Michelle