SAS 9.4 TS1M7, WIN x64 server
Issue: How do I stop some tables to appear in EG (8.x) for a pre-assigned MS SQLSRVR Database library?
Details:
1. A service ID is used to access a SQL DB, a sas sqlsrvr SAS library is created with a group (db-access). Only db-access group member access/view the said library.
2. Library is pre-assigned.
3. Library has a mix of tables and views
4. Currently only few views are 'registered' in metadata (out of 200 views and tables by design)
5. All views and tables appear in SAS EG session for all members of db-access group, we want only views to appear in the EG session.
6. The db-access group has explicit RM and appropriate grants and 'deny' for all other in metadata > 'Authorization'
Any idea how to set this up? My own thought is that since the access is via a service ID, we could ask DBA to remove READ GRANTS for the tables for the service ID. I wanted to get your opinion to see any simpler method exists.
Thank you in advance (TIA)
-S
Controlling access via user account permissions is easiest and bombproof. You can control access via metadata permissions but that can be bypassed unless you lockdown all SAS libraries so I wouldn't recommend it.
For the views to work, the underlying tables must also be accessible to the SAS session, so you cannot "hide" them.
These are Synapse views.
SQL views are executed when used, in the context of the calling process. So this process needs to have access to the tables used in the view.
If you need to restrict access to certain parts of data, create separate tables, not views
The SAS Users Group for Administrators (SUGA) is open to all SAS administrators and architects who install, update, manage or maintain a SAS deployment.
SAS technical trainer Erin Winters shows you how to explore assets, create new data discovery agents, schedule data discovery agents, and much more.
Find more tutorials on the SAS Users YouTube channel.