BookmarkSubscribeRSS Feed
🔒 This topic is solved and locked. Need further help from the community? Please sign in and ask a new question.
sergie89
Quartz | Level 8

Hello All,

 

We've a little bit garbage in our SAS environment with naming convention of groups in SAS Management Console.

We are looking for a solution (efficient way) which makes possible to rename the metadata definition of group objects.

 

Does anyone have experience with this ?

 

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
boemskats
Lapis Lazuli | Level 10

Hi,

 

This should work, and it is an efficient way of updating these names. However, it requires a disclaimer:

 

In SAS 9.3, it used to be possible to update the names of user and group objects within Management Console (I even think that you'd still be able to do this if you got your hands on a version of SASMC 9.3). However, SAS removed this ability in 9.4, and I'm assuming they have good reason for doing so - probably because the name is used as a key in some user sync routines, or in one of their solutions (which is where I imagine @JuanS_OCS's question comes from). What this code does therefore is override the restriction put in place by SAS in Management Console 9.4, and as such I guess it is 'not supported' (edit: just re-read Simon's reply, it's not supported; no need to guess).

 

With that said, I've updated these attributes many times before on our environments with no consequence, and I can't think of any reason why doing this would ever be harmful. However, as when running any code that updates metadata, make sure you back up repository before running this.

 

I hope the code it's self explanatory:

 

data changenames;
  length oldname newname $256.;
  infile datalines dsd;  
  input oldname $ newname $;
  datalines;
  Some old group name, Shiny New Group Name
  Some other group name, Shinier New Group Name
  Another old group name, Another New Group Name
;
run;

data identitygroups(keep=uri oldname newname rc);
  length uri $256;
nobj=1; n=1; set changenames; do while(nobj >= 0); nobj=metadata_getnobj(cats("omsobj:IdentityGroup?@Name='",oldname,"'"),n,uri); rc=metadata_setattr(uri,"Name",newname); n=n+1; end; run;

 

Keep in mind that with this code, any group names that aren't matched in the oldname var will stop the loop from iterating and leave the remaining values unchanged. It also won't let you rename a group to another group which already exists, which is a good thing (just tested & observed in 9.4m3).

 

Nik

View solution in original post

4 REPLIES 4
SimonDawson
SAS Employee

Certain parts of the group and user object can be edited. There are some parts where the value is immutable inside SAS Management Console. If a value is immutable inside SAS Management Console then it is not supported to change them.

 

For those types of situation you might be best off to plan to migrate to a new security model that is a bit more sensible. 

 

This paper still to this day is one of the best on Metadata security.

https://support.sas.com/resources/papers/proceedings11/376-2011.pdf

 

Try plan to migrate slowly to model that aims to follow the best practices outlined in the paper.

JuanS_OCS
Amethyst | Level 16

Hello @sergie89,

 

exactly as @SimonDawson said.

 

A question, as your users and groups created manually in the metadata server, or by a sync script, taking them from a csv, AD or LDAP?

boemskats
Lapis Lazuli | Level 10

Hi,

 

This should work, and it is an efficient way of updating these names. However, it requires a disclaimer:

 

In SAS 9.3, it used to be possible to update the names of user and group objects within Management Console (I even think that you'd still be able to do this if you got your hands on a version of SASMC 9.3). However, SAS removed this ability in 9.4, and I'm assuming they have good reason for doing so - probably because the name is used as a key in some user sync routines, or in one of their solutions (which is where I imagine @JuanS_OCS's question comes from). What this code does therefore is override the restriction put in place by SAS in Management Console 9.4, and as such I guess it is 'not supported' (edit: just re-read Simon's reply, it's not supported; no need to guess).

 

With that said, I've updated these attributes many times before on our environments with no consequence, and I can't think of any reason why doing this would ever be harmful. However, as when running any code that updates metadata, make sure you back up repository before running this.

 

I hope the code it's self explanatory:

 

data changenames;
  length oldname newname $256.;
  infile datalines dsd;  
  input oldname $ newname $;
  datalines;
  Some old group name, Shiny New Group Name
  Some other group name, Shinier New Group Name
  Another old group name, Another New Group Name
;
run;

data identitygroups(keep=uri oldname newname rc);
  length uri $256;
nobj=1; n=1; set changenames; do while(nobj >= 0); nobj=metadata_getnobj(cats("omsobj:IdentityGroup?@Name='",oldname,"'"),n,uri); rc=metadata_setattr(uri,"Name",newname); n=n+1; end; run;

 

Keep in mind that with this code, any group names that aren't matched in the oldname var will stop the loop from iterating and leave the remaining values unchanged. It also won't let you rename a group to another group which already exists, which is a good thing (just tested & observed in 9.4m3).

 

Nik

sergie89
Quartz | Level 8

Hi @boemskats,

 

Thank you for your reply. This answer is what we need.

@JuanS_OCS the groups are created manualy. Unfortunately, the previous administrator has not thought about the name standards for group objects. So we will fix this issue to create more clearity for the administrators, because the envirinoment is growing by number of users. 

 

@boemskatsWe are using version 9.3 M3 of SAS. I can try to use your SAS code on our test environment. 

 

Thanks again! 

suga badge.PNGThe SAS Users Group for Administrators (SUGA) is open to all SAS administrators and architects who install, update, manage or maintain a SAS deployment. 

Join SUGA 

CLI in SAS Viya

Learn how to install the SAS Viya CLI and a few commands you may find useful in this video by SAS’ Darrell Barton.

Find more tutorials on the SAS Users YouTube channel.

Discussion stats
  • 4 replies
  • 1521 views
  • 3 likes
  • 4 in conversation