Warning icon near principal when adding an access control for a caslib using accessControl action

[pavelr]

When I add a Custom Group access control for a caslib using code I get a warning icon near that Custom Group in the "View Authorization" window (Environment Manager-Users-Data Sources-CASLIB-View Authorization) for that caslib. The Custom group exists. Why am I getting this warning (Alert) icon (a triangle with an !) ? The code looks like this:

proc cas;
accessControl.updSomeAcsCaslib /
acs={
{caslib="MYCASLIB",
identityType="group",
identity="My Custom Group",
permType="Grant",
permission="READINFO"}};
run;

quit;

[gwootton]

Is the custom group's ID also "My Custom Group" or just the name? You can check the ID by selecting the group in Environment Manager, or you can visit the /identities/groups?providerId=local REST endpoint for a list of custom groups and their IDs.

[pavelr]

It's both the name and the ID. 

And the users of this custom group cannot access a caslib though access rules are there - only with this triangle alert. If I create the same rule manually - it works. What's wrong with creating these rules using accessControl action?

[gwootton]

The warning icon indicates the defined identity is not found. While Environment Manager will only let you select from a list, the code lets you specify any string so the discrepancy is likely with the group name you are providing.

The permission isn't working for the same reason, the rule is defined for a non-existent identity.

You may wish to use the sas-admin cli to check the name and ID of the group:

sas-admin identities list-groups

[pavelr]

These Custom Groups exist.

[gwootton]

You may wish to copy and paste the name from the sas-admin output or Environment Manager, it could be there are extra white space characters in your code or the group name causing the failure.

[pavelr]

No there are no extra white space characters in the code. I literally copied the Custom Group ID from the Environment Manager and pasted it in the code. And got the same alert.

But it looks like the problem was found. When the group ID has white spaces, I get the alert. When group ID does not have white spaces - no alerts. But why is this? On the other Viya server there is no such problem with white spaces in a Custom Group  ID - no alerts. So, maybe there is some option in Viya that allows or disallows to use IDs with white spaces?

[gwootton]

I'm not aware of such an option. If you see this issue in one environment and not another, it sounds like this may be an issue that was corrected in an update.

[pavelr]

If fact, I've just tested assigning caslib rules manually by: Edit Authorization - Add Identities. I select groups with white spaces in their IDs from the list (!) and it shows this alert - "The principal was not found".

We do not have this issue in other environment which is older than the problematic environment.

[gwootton]

I would recommend opening a technical support track then.