Deploy jobs in SAS MC

[Evelina]

Hi,

When I want to deploy a job in SAS MC, I'm getting error:

The job 'program' was not deployed because of the following reason: 
Unable to save the metadata.

I've all permissions, WMM (write member metadata); in SAS MC(https://communities.sas.com/t5/Administration-and-Deployment/Reg-Role-creation-in-SAS-MC-to-access-o...).

I compared my permissions in SAS MC with my colleague who can deploy a job and we have the same.

Where ever location I select getting the same error, even under my own folder.

Could someone help me why I can't deploy a job?

[JuanS_OCS]

Hi there @Evelina,

the first thing, perhaps you can get additional information of the specific location that cannot find write permissions in the metadata, if you enable debug mode in SMC http://support.sas.com/kb/43/157.html

Second, there might be a hotfix for it:

- what maintenance of SAS do you have?

- I see this issue might happen on M0 and M1, and was fixed in M2 http://support.sas.com/kb/52/862.html

- But also if it was previously deployed with DI, in SMC might fail, found in M1 and fixed in M4: http://support.sas.com/kb/56/998.html

And last but not the least, did you try to deploy the job with a SAS metadata unrestricted account? Not the best, but it can tell you at least if it is only permissions, or a bug that can be fixed in the software.

[Evelina]

Thanks @JuanS_OCS for your reply. I'm using SAS 9.4 M4(maintenance 4). I've asked someone with unrestricted permission and it works fine to deploy the same job.

I should wait for our administrator who is on vacation( I don't have permission to change files on server) 🙂

[SASKiwi]

I suggest you check if your user name is in the default SAS Administrator metadata group or not. This should give you the right permissions, particularly the ability to save metadata.

[Evelina]

Thanks @SASKiwi , I checked the system and I have it:

[jklaverstijn]

Hi Evelina,

What you show us is the Authorization tab. That shows the authorizations for the metadata object that contains your account. The groups and Roles is what you probably want to check. There you see what your authorizations are based on your group memberships and roles.

Although it will certainly help I would not recommend to make you a member of the SAS Administrators group. That group is meant to be used for SAS Administrators as it provides unrestricted access. Addressing authorization issues by removing all restrictions is not a good practice.

Consult with your administrator and have him/her look at metadata server logs as needed the way @JuanS_OCS suggested. Administrators have quite a few more tools available to troubleshoot this than mere morals.

Hope this helps,

- Jan.

[DavidStern]

Now that you know that someone else using your environment can deploy the job, you know it's almost certainly not a bug in your version of the SAS software. There is almost certainly just something you don't have WriteMetadata permission for in metadata. That would be consistent with the original error message ("Unable to save the metadata.").

Making someone who is not responsible for the stable operation of your SAS deployment and is not trained in SAS administration a SAS Administrator is a bad idea. In the longer term, when your SAS Administrator is back from vacation, you might ask if their security model includes content administrators: The case for content and data administrators. But from reading the discussion, my guess would be that something much simpler can solve this problem.

In your original post, you wrote "I compared my permissions in SAS MC with my colleague who can deploy a job and we have the same." Which metadata folders or other objects did you compare permissions for? The folder containing the job that you are trying to deploy? The folder where the deployed job metadata object is to be created? The Application Server Context under which the deployed job will run (e.g. this might be "SASApp", which is found under SAS Management Console > Server Manager > SASApp)?

I believe you need (or a group you belong to needs) WriteMetadata permission on the Application Server Context (the default one is called SASApp) in order to be able to deploy jobs. This might not be obvious to someone who isn't an experienced administrator.

For reference, see the my paper "GEL Recommended SAS 9.4 Security Model Design - Data Integration v1.1.pdf", which is attached to Five papers on Recommended SAS 9.4 Security Model Design (part 2 of 2). In that paper, see section 9.1.2 "Apply ACTs to the DI ACTs and to SASApp", Table 8, which explains "Reason: DI Developers need Write Metadata access to SASApp in order to create/modify data libraries, save stored processes in source code repositories, deploy jobs in deployment directories etc. SASBatch accounts need Write Metadata permission on SASApp in order to deploy jobs." I wonder if you have checked your WriteMetadata permission on SASApp, and compared it to your colleague who can deploy the job?

Best wishes,

David