How to redeploy in Flow Manager with different account?

[Mixer]

Hi All,

I have a job which was deployed with personal account by a formal employee. I need to redeploy the job a service account that we just set up. What is the best way to do it? I am very new to SAS so if you can provide step by step that would be fantastic.

Thank you for your help.

[JuanS_OCS]

Hello @Mixer,

Just to deploy/schedule, you only will need to change the account (including the password) within the group you have defined as LSF/Scheduling usergroup you have defined on your SAS Management Console, and have your user included in this group. Then every SAS user in this group will schedule jobs using that account.

However, if your intention is to change the service that actually runs LSF, the best you can do is to additionally grant that account:

- Grant the Local (or Group) Security Policies and pre-installation checklists as of https://support.sas.com/documentation/cdl/en/biig/60946/HTML/default/viewer.htm#a003069268.htm

- Add the service user in the js.conf within your Process Manager configuration (conf) directory.

- Include this user in the Local Administrator group (not required but preferably)

- Change the services to be started with that account https://www.bsc.es/support/LSF/9.1.2/print/lsf_admin.pdf

- Restart services and start scheduling

For additional information: https://www.bsc.es/support/LSF/9.1.2/print/lsf_security.pdf

[Mixer]

Hi Juan,

Thank you very much for your response.

In the Flow Manager (please see attached picture), I have the first job which was deployed by user ABC. All I need is that redeploy this job with sassupport account.

Would you please tell me how to do this?

Thank you again.

[JuanS_OCS · Accepted solution]

2 options:

1. recommended one: in SAS Management Console, you register the sassupport account and password the the group you have for scheduling (that account will have the same Authentication Domain as set in the Platform Process Manager server in the Servers SMC plug in.

2. You can just register a new SAS user in SMC, and in the accounts tab you can register the sassupport  account and password with the Authentication Domain as set in the server previously mentioned. I recommend you register the account a second time on the same tab, but with the DefaultAuth and you won't require to type in the password this time.

Once you have done this, log in SAS Management Console with this account (if you went for option 2) or with any user within the group (if you went for option 1). Then, go to the Schedule Manager plug in and Schedule the flow again to the Process Manager (your scheduler).

Authentication Domains: http://documentation.sas.com/?docsetId=bisecag&docsetTarget=p1du6ccnyjmlkdn1pwc9q11m088w&docsetVersi...

Setting Up Scheduling Using Platform Suite for SAS: http://documentation.sas.com/?docsetId=scheduleug&docsetTarget=n0kfnm2wel8gxfn147dlt17mpeu3.htm&docs...

[jklaverstijn]

I apologize for coming back to an accepted solution but this one is not airtight. It will only work if the account used to reschedule has administrative powers in LSF. If an arbitrary user tries to redeploy a flow that is already scheduled by another arbitrary user, this will not work as described. A warning will be issued by SMC and two flows with the same name but different users will now exist in Flow Manager. As the message indicates the existing flow needs to be removed by hand as it was not overwritten. The current scheduling user does not necessarily have that privilege. Only an LSF administrator or the owning user can remove a flow. This has to be done using the Flow Manager application that is part of your SAS distribution.

Hope this helps,

- Jan.

[JuanS_OCS]

Well, I think that point was clear on the last document linked (Users chapter), however it is a good point, since perhaps a bit hidden.

Last bit, then, would be to make that new user a Flow Manager Administrator (LSF Administrator, as you remarked, @jklaverstijn ), through the js.conf file. After changed the list, Process Manager service must be restarted in a moment when no job would need to be triggered at that time.

# --------------------------
JS_ADMINS=domain\sa_lsfadmin
# --------------------------
# REQUIRED.
#
# Specifies the administrators who run Process Manager.
# To specify a list, separate the names with a comma without any space.

# --------------------------
#JS_CONTROL_ADMINS=
# --------------------------
# OPTIONAL.
#
# Specifies the administrators who have global privilege to
# control the flows and jobs in Process Manager.
# To specify a list, separate the names with a comma without any space.

[Mixer]

@jklaverstijn My different user does not have admin powers in LSF. I just deployed a new flow with that different user, so this was not an overwritten process per se. Therefore, I had to remove the existing flow in Flow Manager by using the formal account.

[jklaverstijn]

A flow once scheduled by a user is tied to that user. Unless you have a full LSF license, the one that comes with SAS limits your possibilities somewhat. For starters you cannot change flow definitions from Flow Manager. Rescheduling a flow as someone else would at best result in two flows with the same name but different users. The old one would still be there.

In your case, assuming you cannot logon as the former (assuming you ment "former" when you said "formal") user, you can unschedule the existing flow using administrative accounts and re-schedule as someone else. Unscheduling can be done from SAS Management Console as a user with administrative powers (eg sasadm@saspw). You will likely be prompted (sasadm@saspw usually has no account on the OS) for a logon to the Platform scheduling server. Use lsfadmin or some other account that is defined as an LSF Administrator. This takes care of removing schedule info both from metadata and LSF. Once that is done, reschedule with another account.

Sometimes things don't go as planned. It can happen that a flow is unscheduled as far as the metadata are concerned but it still exists in LSF. This conflict can be a pesky one. Use lsfadmin or equivalent to remove the flow directly in Flow Manager.

There are many pointers in the response from @JuanS_OCS on how to tie accounts to a authentication domain directly or via a group membership. As you have already scheduled quite some flows we can only hope you figured this one out by now.