Restricting Job Scheduling Access in SAS Viya

[freshstarter]

Hello,

We have a requirement in our SAS Viya environment where only a limited set of groups ( mainly SAS administrator ) should be able to schedule jobs through SAS Studio or SAS Environment Manager.

I tried modifying the authorization rules in SAS Environment Manager for the /scheduler and /SASjobexecution object URIs. Instead of granting permissions to the Authenticated Users group, I granted permissions only to the SAS Administrators group. However, non SAS Admin users are still able to schedule jobs through SAS Studio.

Could you please let me know the complete list of object URIs that need to be restricted to control job scheduling access for specific groups?

Thanks in advance.

[gwootton]

Rather than modifying the existing rules granting access you should disable them and create new ones granting the access you want, as the default rules are bootstrapped when the services start, so restarting of services would overwrite your changes.

The ability to actually schedule a job for future execution is driven by create permission on the /scheduler/jobs object URI, but this would not impact the ability to run a job "now" (/jobExecution/jobRequests/<job_request_id>/jobs, /jobExecution/jobs) or create a job (/jobExecution/jobRequests) or flow (/jobFlowScheduling/flows). Updating a flow's schedule is controlled with Update permission on on the flow /jobFlowScheduling/flows/<flow_id>, but pushing that schedule is done with a call to /jobFlowScheduling/flows/<flow_id>/scheduled, and that call would fail if you already blocked permission to /scheduler/jobs, though this could result in the flow having a schedule defined that is not reflected in scheduler.