Email sending restriction

[shlomiohana]

Hello,

Currently, users in my system can send an email through SAS GUIDE and impersonate someone else in the organization.

For example, I can send an email as if my manager sent it.

I want to limit this option and provide a list of emails that are authorized to be sent.

If I try to send an email that is not on the list, I will get an error.

Is it possible to implement this restriction in SAS?

Thank you very much.

[carl_sommer]

See Fencing in your SAS users with LOCKDOWN - The SAS Dummy   
You should be able to selectively enable email using the LOCKDOWN ENABLE_AMS=EMAIL statement via yoru workspace server autoexec.

Carl Sommer - SAS Technical Support

[shlomiohana]

I currently have lockdown ENABLE_AMS=EMAIL in the autoexec file, how do i implement a restriction?

[carl_sommer]

Can you share your autoexec?  I would suggest some amount of conditional code to decide for whom to provide the enablement for.

Carl Sommer - SAS Technical Support

[gwootton]

SAS allows you to prevent the email access method from being used at all using LOCKDOWN as Carl mentions. I think to limit what addresses can be used as the sender would be something done on the mail server you are using.

[carl_sommer]

That's a good distinction.  While you could conditionally execute the lockdown statement in the autoexec by user, for those allowed to use email, you won't be able to enforce what user the set as the sender.

Carl Sommer - SAS Technical Support

[shlomiohana]

The autoexec file contains:

lockdown ENABLE_AMS=HTTP;
lockdown ENABLE_AMS=EMAIL;
lockdown list;

[thesasuser]

Any restriction on the SAS side will be easy to bypass.
Consider restricting at the SMTP server level. The mail server admin at your place could help.

[Kurt_Bremser]

What others said. This needs to be managed on the SMTP server.