Read-only SAS Studio users

[mprikolota]

Hi everyone,

For our SAS Viya installation (Version LTS 2023.10) we would like to configure a custom user group with Read-Only permission to SAS Studio, i.e. such users should be able to open and view SAS datasets and other files on the SAS Server, but not allowed to write and execute SAS code.

We tried creating a new rule in Environment Manager for "/SASStudio/**" object URI with Read permission. The Users are able to log in, but they don't see any content.

Does anyone know how to configure it correctly?

Many thanks in advance!

[Tom]

Huh?  Not sure that is going to be possible.  And why would you want that?

If you want the datasets to be readonly  that would make sense.

For that you can use the ACCESS=READONLY option when issuing the LIBNAME statement that defines the libref you want them to use to point to the datasets.  Or better change the file permissions of the directory where the actual dataset files live.

[mprikolota]

Basically I was hoping to make use of "Data Viewer" feature of SAS Studio by non-programmers, i.e. to mimic SAS Universal Viewer in Viya.
The dataset files (sas7bdat) are already protected in the storage, but I miss a data viewer tool in SAS Viya.

[gwootton]

SAS Studio uses a compute server running as the requesting user to perform these actions (reading SAS data sets, viewing file system contents), which would also be used to run any SAS code.

If you do not want users to be able to write and execute SAS code, they should not have access to SAS Studio at all.

[mprikolota]

Is there any alternative in SAS Viya to view SAS7BDAT files?

[SASKiwi]

SAS Visual Analytics for Viya enables you to view SAS datasets but they would all need to be loaded into a CAS library for this to happen. It might also be possible to load datasets into CAS when selected although I don't have Viya to test that.

[BrunoMueller · Accepted solution]

There is a rule that looks like this, see below. By default Authenticated Users is the principal type. If like in the example below you assign a certain group, only members of this group can run programs. Other users will receive an error when they try too.

There is a similar rule for background processing using the ObjectURI /studio/sessions/*/background/submissions. By default Authenticated Users are allowed to do this.

This might help, however you still have the complete SAS Studio GUI available which might be a bit to much for the casual data viewer. Also what was mentioned before about ACCESS=READONLY is important.

As an alternative have a look at https://datacontroller.io It might just do what you need (I do not have personal experience with it).