ERROR: User does not have appropriate authorization level ...

[shoin]

This should be the most easier to chase issue but it is not.  A regular puzzle.

Context

• SAS scheduled batch job
• Same job in EG executes w/o an issue, when scheduled reports a failure
• Libname in log shows "Libref JNDL was successfully assigned ..."
• Navigate from file explorer to the said path = yes
• UNC path used
• The target physical folder JNDL_LD in path is accessible, the user has special permission --> full control could be seen in advance security tab of the folder

ODD

/*This failed*/

libname jndl "\\faris\studies\2022\imaging_ai\JNDL_LD";

data jndl.fnl;
   set xyz;     /* a simple step formatting dates */
run;

ERROR: User does not have appropriate authorization level for file JNDL.FNL.DATA

/* down few steps of the same code, note the set statement */

data final;
   set jndl.fnl ;    /*did this not error out above ...huh */
    ... more format type steps
run;

NOTE: There were 100 observations read from the data set JNDL.FNL

This does not make sense to me, I have checked the user's file system permission and user has "special permissions" on JNDL_LD physical folder and viewing 'advance setting' the full permission = full control.

I am looking for any tips ideas to what else to check ...

Meanwhile, preparing to read, write in different simple step scheduled code mimicking R & W to JNDL_LD.  

TIA

S

[Kurt_Bremser]

Most probably, the dataset is already there and was created by another user. And only this user has write permission on the dataset file.

[shoin]

Hi Kurt, yes indeed that is what we found that the dataset was there and it could not be over written (I just posted detail replies and did not see yours till now, lol). I did not check who owned it, I will do so now. It is a WIN file system (unc file share).

[shoin]

BTW, same code via EG executes and overwrites the pre-existing dataset in the UNC path, only in batch it errors on the same step.

TIA

[shoin]

quick update, the user is the same who tries with EG (successful) and batch (fails with authorization error) and this user has 'full permission' on the said folder's parent

[Sajid01]

As I understand it, the batch job too is running from the desktop and you have a local installation.
If that is indeed correct, mount the remote location and assign a drive letter. For example "X".

Thus if \\faris is mounted at the drive X on your local desktop, then the libname would be 

libname jndl "X:\studies\2022\imaging_ai\JNDL_LD";

For all practical purposes the remote location behaves as a local drive.  It should work with both EG and in batch mode.

[shoin]

Thank you @Sajid01. This is a server-client setup (EG on user's laptop, connecting to SAS server which has been presented the UNC path).

[Tom]

Having permission to read but not to write is not unusual.

Is SAS running on Windows operating system?  Windows file systems can have very complex permissions.  Someone once created a write only directory for me: that was very hard to use.

Is everyone using Enterprise Guide to submit the SAS code?  Are they connecting to the same SAS server?  Or are some using SAS directly? Or running on their local machine?

Is there a dataset with that name in the folder already?  What are the permissions on that file? Who is the owner?

Are you using managed librefs that are created automatically by SAS when your session starts?  Or did all of the test runs have to execute their own libname statement to define the libref?

[shoin]

*** Update ***

In troubleshooting, found the following:

1. No authorization issue when pgm is run via EG (same UNC path)
2. Issue occurs same step when run as batch
3. New:
   1. In the same UNC path if the same dataset exists (or a file) the "not authorized" error occurs.  However, the first new write it does not.

For AD and file system security the owner ID has "full permission" also confirmed with effective permission list.

Is there a SAS option that affects the said behavior of not overwriting an existing dataset? (better to ask than to wonder).

TIA

S

[shoin]

- Yes WIN OS
- when using EG no issue, even target pre-existing dataset gets over-written, when run in batch (scheduled via SAS schedule manager) this error occurs (No IWA no token ID that runs object spawner)
- Group owns and permissions are for the owner 'full permissions' and other group member R,W,E,M,L
- Libnames are created in the sas pgm (I will check again), some via autoexec.sas

Much thanks for your time and suggestions.

[Sajid01]

Hello @shoin 
Your two codes are not identical. In the following you are reading data. Indicates you have read permissions.

data final;
   set jndl.fnl ;    /*did this not error out above ...huh */
    ... more format type steps
run;
NOTE: There were 100 observations read from the data set JNDL.FNL

In the following you are creating a file, The error nessage is clear. It says you do not have permission to write permissions to that folder.

libname jndl "Assuming that \\faris\Astudies\2022\imaging_ai\JNDL_LD";
data jndl.fnl;
   set xyz;     /* a simple step formatting dates */
run;
ERROR: User does not have appropriate authorization level for file JNDL.FNL.DATA

Assuming that \\faris\ represents a remote server \ storage location, 

contact your System Administrators for assistance. Typically SAS Adminsitrators can check for permissions but the OS/AD level changes may be required depending upon how these are done at your organization. 

[shoin]

@Sajid01, thank you for your reply. The two steps were listed to show that the first step has a comment that states the previous step to the one listed 'failed' yet that step showed data read.

Yes, second step shows write error. However, when run interactive through an EG session, the same code is executed properly w/o any error.

The issue occurs when run as batch and or when scheduled (via sas scheduler). That is the issue I am trying to find an answer to and not finding any resolution. I have asked Server admin and looked in detail at the 'security' permissions applied on the UNC share and 'effective' permission and they translate to 'full permissions' for the user running it in EG as well as batch. A regular Sherlock saga.

[CHandberg]

It could be because you use Integrated Windows Authenticaton in the connection profile.
Uncheck IWA and type username and password. It is important that you use the domain in the username eg mydomain\myuser.
The reason is that you “loose the domain” when you “jump to the next server” using UNC-path with IWA.

[shoin]

Hello Chris, thank you for the suggestion. As I replied to Sajid01 above, "The issue occurs when run as batch and or when scheduled (via sas scheduler). That is the issue I am trying to find an answer to and not finding any resolution. I have asked Server admin and looked in detail at the 'security' permissions applied on the UNC share and 'effective' permission and they translate to 'full permissions' for the user running it in EG as well as batch. " --> is the real problem. I will ensure we do not have IWA selected (we have not implemented SSO / IWA in this environment).

This is the 2nd such issue I am dealing with. The other one is for hdisk MS error 58, simple error (authorization) yet everyway one checks it does not make sense.

[SASKiwi]

It sounds like further diagnosing of your SAS environment is required to get a resolution of this problem. Raising a Tech Support track in this case should help if you haven't done so already. I assume you are using the same user account to both connect to SAS via EG and to schedule the same job in batch mode.