Issue while removing a certain group from Library 'Authorization' Tab and Folder having it

[Amitkmr1979]

Dear Friends,

I was asked to create a separate group with few people added to it, who can only access the sensitive data in the new library created.

I created new group, new library, added the required people and granted them full access sans administer. 

The problem is when I create a new library some of the groups are automatically getting added with couple of them which has full access. We are able to remove deny all role for analysts, but for another group when I try to remove or deny all (Read/Write Meta data, checkinmetadata, read, write create, delete) I get the below message:

And when I try to remove the group I get below message

Please can you advise why is this happening and how can I remove or deny permission for that particular role?

Best Regards

[PaulHomes · Accepted solution]

Hi,

The 2nd screenshot is telling you that you cannot remove the group from the list because it appears from either a parent object in the inheritance path or via an applied ACT. You cannot remove the group here but you can change it's permissions (if appropriate). If you really want to remove the group from the list then it needs to be removed from the auth tab on a parent object or the permission pattern of an applied ACT (but that could have a very big impact).

The 1st screenshot I suspect is because you are denying permissions to non-implicit groups (i.e. not PUBLIC or SASUSERS) and it results in a conflict where you yourself would no longer have the ability to see the object. A best practice is to only ever deny permissions to PUBLIC or SASUSERS and then grant back to the groups that require access. See rule #3 in https://support.sas.com/resources/papers/proceedings11/376-2011.pdf. You may also want to have a look at the GEL Golden Rules at https://communities.sas.com/t5/SAS-Communities-Library/Golden-Rules-for-Security-Model-Design/ta-p/3...

I hope this helps.

Cheers

Paul

[Amitkmr1979]

Thanks Paul,

I just got to know that it could be applied through ACT or inherited from parent folder which I do not want to change. 

I am looking to create an ACT and then add the group for whom I want to give permission to sensitive data. 

Thanks very much for your links below.

Without SAS community I would have struggled ages 🙂