topic How to grant and deny access using SAS EG scripts in SAS Enterprise Guide

How to grant and deny access using SAS EG scripts

roth1 — Tue, 24 Jul 2018 08:33:35 GMT

Hi, my system currently uses scripts to run our batch jobs for EG. However we occasionally encounter table locks due to users accessing the tables therefore resulting in batch job failure. During the re-run of batch job from previous point of failure, we will then use SAS Management console to personally deny user access to the respective tables. We are currently working on the codes to be keyed in SAS EG to grant and deny access for our users through the sas scripts but we are encountering error. Can someone please assist me on how to get it started?

Keyed in this line of code in SAS EG

sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 180-322: Statement is not valid or it is used out of proper order.

When I keyed in proc sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 22-322: Syntax error, expecting one of the following: ;. AUDIT, CC, CLEANUP.

ERROR 76 -322: Syntax error, statement will be ignored.

Thank You.

How to grant and deny access in SAS EG through batch jobs

roth1 — Tue, 24 Jul 2018 08:26:26 GMT

Keyed in this line of code in SAS EG

sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 180-322: Statement is not valid or it is used out of proper order.

When I keyed in proc sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 22-322: Syntax error, expecting one of the following: ;. AUDIT, CC, CLEANUP.

ERROR 76 -322: Syntax error, statement will be ignored.

Thank You.

Re: How to grant and deny access using SAS EG scripts

andreas_lds — Tue, 24 Jul 2018 08:46:25 GMT

Please post code and log your are executing.

Afaik there is no "proc sas-show-metadata-access" - the name violates sas naming rules.

Re: How to grant and deny access using SAS EG scripts

SASKiwi — Tue, 24 Jul 2018 08:50:53 GMT

You are trying to run a SAS batch tool as SAS code - it isn't going to work as it designed to be run from an operating system command line:

http://documentation.sas.com/?docsetId=bisecag&docsetTarget=n0bx2mb5l3iosan15odm1wfpo8bn.htm&docsetVersion=9.4&locale=en

The best way to avoid table locks is to run all of your batch jobs in a production environment where users have read-only access (set up using OS permissions) and this is best done using server-based scheduling.

Re: How to grant and deny access using SAS EG scripts

Kurt_Bremser — Tue, 24 Jul 2018 10:40:51 GMT

You're thinking much too complicated here. If you have a UNIX server, it is extremely easy to get around locked SAS datasets by removing them first from the filesystem before you write them.

Alternatively, set up a time window where all services that could lock datasets (mainly the workspace servers) are stopped, and run your batch processing in that time window.

Denying access to a user will not have ANY effect on a SAS session that was started before that. Open files will stay open until they are closed from within the session or the session is terminated.

Re: How to grant and deny access using SAS EG scripts

Kurt_Bremser — Tue, 24 Jul 2018 10:42:38 GMT

@SASKiwi read-only access doesn't really help. Any user who leaves a Viewtable open will block that dataset against writing.

Re: How to grant and deny access using SAS EG scripts

SASKiwi — Tue, 24 Jul 2018 20:44:00 GMT

@Kurt_Bremser - agreed VIEWTABLE locks datasets regardless of OS permissions.

Re: How to grant and deny access in SAS EG through batch jobs

andreas_lds — Wed, 25 Jul 2018 04:56:21 GMT

Why do you repeat your post?

There is no "proc sas-show-metadata-access" - getting an error when trying to execute a non-existing procedure is somehow expectable.
"sas-show-metadata-access" is an executable and part of the SASPlattformObjectFramework, located on the server, depending on you setup, you don't even have it installed on the server hosting the Workspace Server. So maybe you won't be able to execute that executable even if xcmd is turned on.
@Kurt_Bremser already said: you won't be able to avoid locking of dataset by temporary revoking read-permission.

@roth1 wrote:

Hi, my system currently uses scripts to run our batch jobs for EG. However we occasionally encounter table locks due to users accessing the tables therefore resulting in batch job failure. During the re-run of batch job from previous point of failure, we will then use SAS Management console to personally deny user access to the respective tables. We are currently working on the codes to be keyed in SAS EG to grant and deny access for our users through the sas scripts but we are encountering error. Can someone please assist me on how to get it started?

Keyed in this line of code in SAS EG

sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 180-322: Statement is not valid or it is used out of proper order.

When I keyed in proc sas-show-metadata-access -profile Admin /DemoBranch/DemoFolder;

Error I got from this line of code is

ERROR 22-322: Syntax error, expecting one of the following: ;. AUDIT, CC, CLEANUP.

ERROR 76 -322: Syntax error, statement will be ignored.

Thank You.

Re: How to grant and deny access in SAS EG through batch jobs

Kurt_Bremser — Wed, 25 Jul 2018 05:16:59 GMT

These were originally two separate threads before I merged them. Seems to be an erroneous double-post.

PS just happened to me. I hit the "post" button a second time before the "posting success" page started to load.