Pre-Assigned Libraries

[Debi]

I have doubt on Pre-assigned library concepts. When I remove the auto assigning of pre-assigned libraries. i.e. I a m disabling the pre-assigning library option for libbrary A as an Admin. Owner of library A is "Own1".

now, Own1 can see table nos 1-6 in the library A. But, for other user (say, Own2) who is owner of library B; if he wants to see the tables from library A ; he can see only Table 1-3 from that library .

So my question is, why the Own2 can't see all the tables of library A that Own1 can see. And also why he can see only those specifie tables1-3 among all tables.

[JuanS_OCS · Accepted solution]

Hi Debi,

can I understand that you had some pre-assigned libraries and now you changed library A to not be pre-assigned?

I think it is important fisrt to understand the behaviour and relevance of a pre-assigned library. I can guess you already now, but if you you don't please give a look to the following links:

http://blogs.sas.com/content/sgf/2013/05/15/pre-assign-sas-libraries-if-so-which-method/

Understanding pre-assinged libraries: http://support.sas.com/documentation/cdl/en/bidsag/65687/HTML/default/viewer.htm#p1ac6c9mrz0gn2n1spv...

One of the most important concepts is that there are 3 ways to pre-assign a library:

• By native library engine
• By metadata library engine
• By external configuration

And all of those 3 have different ways to work.

In any case, you will need to review on which metadata folder are the metadata tables registered: all the tables in a library are registered on the same metadata folder or on a different one? Different metadata folder can make to inherit the tables the authorizations from the metadata folder.

More things to consider: it is possible that the metadata tables can have different permissions from each other. 

And the other point to consider: of those tables are SAS Base tables, it is possible that in the operating system those users have different permissions. If the tables are on a database, the 2 users could also have different permissions.

As a summary:

- check metadata folders for the tables registered in the metadata

- Authorizations for the metadata folders, libraries and the tables

- Authorizations on the Operatyng system or in the databse.

- Check membership of those 2 users on the metadata groups.

[Debi]

Thanks Juan. It really helps in understanding the concept.

The pre-assigned has been doen in my case is "By native library Engine"

[JuanS_OCS]

Hi @Debi, 

thanks a lot for your feedback. Glad to know that it helps, really.

For what I would expect it might be your next step on configuring the libraries: I don't know if you could find some time to read the input provided by @anja. I personally think it is very usefull for all the basic concerns related to authorizations. Specially the ones related to PUBLIC and SASUSERS (between the both of them I call them :THE WORLD) and the ACTs.

[LinusH]

I just want to ads that if you don't use pre-assign the SAS client will assign the library for the user when called upon. How this is done depends on the client.
For EG: the dynamic assignment is done via the META libname. This means thar meta data registrations and authorization is used. And to discover this, use the guidelines brought to you by @JuanS_OCS.

[anja]

Hi there,

in addition to the great questions/input JuanS listed, may I add some additional considerations such as the Implicit Groups (PUBLIC and SASUSERS) and Access Control Templates (ACTs)

It might be worth checking Authorization Manager in SASMC, DefaultACT, to see if the individual groups or users are listed in here. Also, are there any custom created ACTs?

The way I sometimes approach finding a permission problem is, I start with the "lowest" level, tables, and check permission settings here (implicit vs explicit, white, gray or green background). Same at lib level, same at Folders level.

(White background: explicit permissions, gray background: implicit/inherited permissions, green background: custom ACT is used)

As for PUBLIC or SASUSERS, check whether they might overwrite with implicit permissions. Also, in the User Manager, you could check the group's members, or, resp, the user's properties seeing which groups he is a member of. Maybe it conflicts somehow.

Another thing that comes to mind is the DefaultACT being explicitly assigned to an object.

In the SAS Folders tab:

- right click on Folder and/or Tab, and/or lib

- Properties

- Authorization

- Access Control Template

- Make sure the DefaultACT is not listed in the "Currently Using" column.

Hope that helps.

Anja