Is it possible to rename the metadata defintion of objects in SAS Management Console?

[sergie89]

Hello All,

We've a little bit garbage in our SAS environment with naming convention of groups in SAS Management Console.

We are looking for a solution (efficient way) which makes possible to rename the metadata definition of group objects.

Does anyone have experience with this ?

Thanks in advance.

[SimonDawson]

Certain parts of the group and user object can be edited. There are some parts where the value is immutable inside SAS Management Console. If a value is immutable inside SAS Management Console then it is not supported to change them.

For those types of situation you might be best off to plan to migrate to a new security model that is a bit more sensible. 

This paper still to this day is one of the best on Metadata security.

https://support.sas.com/resources/papers/proceedings11/376-2011.pdf

Try plan to migrate slowly to model that aims to follow the best practices outlined in the paper.

[JuanS_OCS]

Hello @sergie89,

exactly as @SimonDawson said.

A question, as your users and groups created manually in the metadata server, or by a sync script, taking them from a csv, AD or LDAP?

[boemskats · Accepted solution]

Hi,

This should work, and it is an efficient way of updating these names. However, it requires a disclaimer:

In SAS 9.3, it used to be possible to update the names of user and group objects within Management Console (I even think that you'd still be able to do this if you got your hands on a version of SASMC 9.3). However, SAS removed this ability in 9.4, and I'm assuming they have good reason for doing so - probably because the name is used as a key in some user sync routines, or in one of their solutions (which is where I imagine @JuanS_OCS's question comes from). What this code does therefore is override the restriction put in place by SAS in Management Console 9.4, and as such I guess it is 'not supported' (edit: just re-read Simon's reply, it's not supported; no need to guess).

With that said, I've updated these attributes many times before on our environments with no consequence, and I can't think of any reason why doing this would ever be harmful. However, as when running any code that updates metadata, make sure you back up repository before running this.

I hope the code it's self explanatory:

data changenames;
  length oldname newname $256.;
  infile datalines dsd;  
  input oldname $ newname $;
  datalines;
  Some old group name, Shiny New Group Name
  Some other group name, Shinier New Group Name
  Another old group name, Another New Group Name
;
run;

data identitygroups(keep=uri oldname newname rc);
  length uri $256;
  nobj=1; n=1;
  set changenames;
  do while(nobj >= 0);
    nobj=metadata_getnobj(cats("omsobj:IdentityGroup?@Name='",oldname,"'"),n,uri);
    rc=metadata_setattr(uri,"Name",newname); 
    n=n+1;
  end;
run;

Keep in mind that with this code, any group names that aren't matched in the oldname var will stop the loop from iterating and leave the remaining values unchanged. It also won't let you rename a group to another group which already exists, which is a good thing (just tested & observed in 9.4m3).

Nik

[sergie89]

Hi @boemskats,

Thank you for your reply. This answer is what we need.

@JuanS_OCS the groups are created manualy. Unfortunately, the previous administrator has not thought about the name standards for group objects. So we will fix this issue to create more clearity for the administrators, because the envirinoment is growing by number of users. 

@boemskatsWe are using version 9.3 M3 of SAS. I can try to use your SAS code on our test environment. 

Thanks again!