%MDUIMPLB macro to load exiting users to existing groups - What am I missing?

[JayK]

I want to add a user to a group using the %MDUIMPLB  macro on SAS 9.4M3. I created my grpmem table and populated it with the gpkeyid and memkeyid of the group and user - just one row of data.

See sample code:

%mduimpc();

/* Create the grpmems table. */
data &idgrpmemstbla;
%defineidgrpmemscols;
infile datalines delimiter=',' missover;
input grpkeyid memkeyid;
datalines; 
MYUSERGROUP,MYID
;
* Load the information from the work library into the metadata server. */;

%mduimplb();

Several attempts to load this association into metadata have failed with two errors on different occasions:

- "There is an illegal character in the name" : There are no special characters or spaces in both keyids. Also, the values in the columns are of short lengths.

 - "The idgrps and persons are either missing or have no records": I ran the %MDUEXTR macro to create the tables. I also filtered both tables to the one row containing the group and person respectively. 

Anyone come across any of these issues or know how I can resolve?

Suggestions welcome

[JuanS_OCS]

Hello @JayK,

I work quite often with the user sync macros, and I personally find a bit hard to help you properly with this question. Normally the only way is to see all the data, the script, and the error messages as a whole. So, for now, only a few things I can say, although probably you already know.

- Those macros work with something named Canonical Tables, because they require to have a very specific format in order to work. If you deviate from the format, they won't work ( http://documentation.sas.com/?docsetId=bisecag&docsetTarget=p1o31lg0trorn8n1rketxxe1jbr1.htm&docsetV... ). 

- Explained on very few words, those macros basically "download" the users and groups from the metadata on canonical tables, they will compare them with the origins of the users/groups (which might be from AD, LDAP or csv, etc) which will have to be as well on canonical form and contain the full set of external users you will have on the metadata, and in the end, it will generate some more canonical tables, for adding, deleting and for updating users/groups.

- Finally, I thing it will help you to know the exact set of users or groups that are failing and how.  That macro you are using ( http://documentation.sas.com/?docsetId=bisecag&docsetTarget=p0vj488njpcgmrn19c9ekymlq6hc.htm&docsetV... ) is capable of generating a "log" table named mduimplb_failedobjs if you set the mduimplb_failedobjs  macro variable.

Hope it helps.

Kind regards,

Juan

[Kurt_Bremser]

I'd say you should populate all variables defined in %defineidgrpmemscols.

[JuanS_OCS]

Hello Bart, @bheinsius,

I think there are no better guides as Apache's or the SAS one:

https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html

http://documentation.sas.com/?docsetId=bimtag&docsetTarget=n0y2fq741xmw8nn1btstcnwnq3jj.htm&docsetVe...

In order to keep it simple, I also think that, for what you want to achieve, most probably a reverse proxy is way too much for what you want to achieve. Meaning there are many other possible solutions:

- If you or your project feel more comfortable with another Web Server (IIS, or anything else), please use it, it will help with configuration. Otherwise, you will need a good Apache admin, or a Web Developer, they know well this stuff.

- The next step of simplification: perhaps you can just use rewrite and redirect https://httpd.apache.org/docs/2.4/rewrite/remapping.html +  https://httpd.apache.org/docs/2.0/misc/rewriteguide.html

- And then even another step for simplification. If the reverse proxy you are looking for is only for managing alias redirection, not security or whatsoever, perhaps you can just speak with the network guys. They should be able to create a redirect and even rewrite rules on a alias to another alias, directly on the routing/network system, without further effort from your side.

I hope it helps,

Kind regards,

Juan

[JuanS_OCS]

Hello Bart, @bheinsius,

I think there are no better guides as Apache's or the SAS one:

https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html

http://documentation.sas.com/?docsetId=bimtag&docsetTarget=n0y2fq741xmw8nn1btstcnwnq3jj.htm&docsetVe...

In order to keep it simple, I also think that, for what you want to achieve, most probably a reverse proxy is way too much for what you want to achieve. Meaning there are many other possible solutions:

- If you or your project feel more comfortable with another Web Server (IIS, or anything else), please use it, it will help with configuration. Otherwise, you will need a good Apache admin, or a Web Developer, they know well this stuff.

- The next step of simplification: perhaps you can just use rewrite and redirect https://httpd.apache.org/docs/2.4/rewrite/remapping.html +  https://httpd.apache.org/docs/2.0/misc/rewriteguide.html

- And then even another step for simplification. If the reverse proxy you are looking for is only for managing alias redirection, not security or whatsoever, perhaps you can just speak with the network guys. They should be able to create a redirect and even rewrite rules on a alias to another alias, directly on the routing/network system, without further effort from your side.

I hope it helps,

Kind regards,

Juan

[JayK]

Hello @JuanS_OCS @Kurt_Bremser

Thank you for the feedback. I have included some more details.

I have populated the grpmems canonical table with the right columns and in the right format. . as defined usingh the %defineidgrpcols macro.

Here are the two scenarios which I tested:

1) Full code:

/* Initialize the macro variables that create canonical tables. */

%mduimpc();

 /* Create the grpmems table for user/groups association to add to Metadata. */

data &idgrpmemstbla;

%defineidgrpmemscols;

infile datalines delimiter=',' missover;

input grpkeyid memkeyid;

datalines;

MYGROUP,MYID

;

* Load the information from the work library into the metadata server. */;

%mduimplb();

 

See attachment MDUIMPLB_error_log_1.txt for full error log.

2) I populated the idgrps and persons canonical tables, filtering them down to just the relevant user and group.

Full code:

 /*To extract existing metadata content */

%mduextr(libref = work);

 /*Filter idgrps and person tables to include only relevant group(s) and user(s)*/

data work.person;

set work.person(where=(name="MYID"));

run;

data work.idgrps;

set work.idgrps(where=(name="MYGROUP"));

run;

/* Initialize the macro variables that create canonical tables. */

%mduimpc();

/* Create the grpmems table for user/groups association to add to Metadata. */

data &idgrpmemstbla;

%defineidgrpmemscols;

infile datalines delimiter=',' missover;

input grpkeyid memkeyid;

datalines;

MYGROUP,MYID

;

* Load the information from the work library into the metadata server. */;

%mduimplb();

See attachment for MDUIMPLB_error_log_3.txt for full error log.

I am not sure what I am missing in the code or process.

Suggestions much appreciated.