Impacts deployment of metadata-bound libraries

[ZO_zo]

Hello,

I have to create metadata bound libraries and MLE preassignment for all of our traditional libraries. And since we have users who are currently working through these traditional libraries and that production processes also require them, what could be the impacts. But also in terms of backups, what are the limits.

Thanks.

[gwootton]

Binding a library to metadata means the datasets will be encrypted and the encryption key is stored in Metadata and only made accessible to users with permission to read the library.

If any processes are currently using these data sets without an established connection to Metadata, the processes would no longer be able to read the datasets and would need to be modified to connect to metadata first (as a user with permission to read the tables)

More information on Metadata-Bound Libraries can be found here:

Metadata-Bound Libraries
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1nesjvtxu7783n1pveml8ct4txk.htm

[ZO_zo · Accepted solution]

Thank you Gwootton for your quick reply.

I understand that it will not be possible for other applications to request the tables without authenticating to the abilities.

But if there are users who make SAS Base and that MBL have been set up with a type of MLE preassignment, should the libraries be declared in the autoexec for direct access?

Or we do asynchronous processing (without going through a client like Enterprise Guide) that uses the data from these libraries, do we have to adapt the configuration?

[Patrick]

@ZO_zo The docu under the link shared is pretty clear.

"should the libraries be declared in the autoexec for direct access"

They should be defined in SAS Metadata. But even if accessed via a libname in code authentication will still go via metadata.

As a consequence a user can't create a new table structure or modify an existing table structure without keeping SAS metadata in sync. This also means that you can't just copy the physical data as files to a new environment (i.e. as part of a migration).

You will also have to test how this works with a DR environment. Not sure what's in this table header info and how it "knows" to which metadata server to connect. I guess it will depend on your DR setup (like same domain names or not) if things just will work smoothly.

If AES encrypted make sure you keep a copy of these passwords in some password vault. 

[Kurt_Bremser]

When a library is defined as metadata bound, a small file containing the path to the metadata object is placed in the directory. This directs a SAS process which wants to use the library to the correct location, so it can retrieve the key (if the current user has the necessary permissions).

[ZO_zo]

Thank you for your input.