adding a meta user to a meta group

[Azeem112]

Hi everyone,

I've around 600 meta users in SAS EGRC 6.1 in the platform in SAS 9.4.

I want to add those users to a meta-group. for this, I'm using code below

libname current '/tmp/temp1';   /* for the current metadata */

libname addgrps '/tmp/temp2';  /* current augmented with the changes */

libname updates '/tmp/temp3';  /* for the updates created by the mducmp macro */


options metaserver=abc

        metaport=8561

        metauser='sasadm@saspw'

        metapass='xyz123'

        metaprotocol=bridge

        metarepository=foundation;


%mduextr(libref=current);


proc copy in = current out = addgrps;
/*copy the current data to the directory for the target */
run;

data investigators_1;
set current.person;
where name in ('5806036');
rename objid = memkeyid;
keep objid;
run;


data investigator_group_1;
set current.group_info;
where name='Enterprise GRC: Incident Investigation';
rename id = grpkeyid;
keep id;
run;


proc sql;
create table grpmems as
select * from investigators_1, investigator_group_1;
quit;


proc append base = addgrps.grpmems data = grpmems;
run;


/* use the mducmp macro to create the updates data */
%mducmp(master=addgrps, target=current, change=updates)

/* validate the change data sets */
%mduchgv(change=updates, target=current, temp=work, errorsds=work.mduchgverrors)

/* apply the updates */
%mduchgl(change=updates);

For the final updated I tried both %mduchgl and %mduchglb but with both, I'm not able to get the desired results. I test it with one user. 

Any suggestions that how can I resolve the error or another approach that I should try to achieve this.

Thanks.

[ChrisNZ]

Moved post to the Administration group.

[Solo2342]

I see that you created a grpmems table for the addgrps library, did you also create the other tables in that location as well that are typically generated by the importad program. This includes the person and idgrps table. A grpmems table without having the associated persons may not work. If you would like to continue to work with me on this, feel free to open a Technical Support Track via the link below. I would be glad to troubleshoot this concern with you.

https://support.sas.com/en/technical-support/contact-sas.html

[VishnuSagarPerni]

Hello Solo2342,

I am in a similar situation, can you please let me know what was this solved. I have the grpmems table ready and when trying to use %mduimplb(); It throws me errors.
 

[Solo2342]

When Group Memberships are not being applied, I have noticed the following

1. The group already exists in Metadata, in that case you would need to use the User Synchronization process to updating existing users and groups, more information at the link here

2. The grpmems table contains memberships to groups that are not in the idgrps table. In that case, check idgrps and grpmems table to ensure that the Unique Key for the group matches a group in the idgrps table. 

3. If you are getting the following error 

ERROR: The method is not directed at a repository. (The Reposid parameter is blank.)

This problem occurs when the KEYID value an identity group (the default value is the distinguishedName for the group) is greater than 128 bytes. A workaround  is to use DATA step logic to truncate the KEYID value for groups to 128 bytes within the canonical tables prior to running the MDUIMPLB macro.

For example, you can add the following steps immediately prior to the MDUIMPLB macro call, this is based on the importad.sas sample program:

Usage Note 40628: Automating the addition of users and groups to a SAS® Metadata Repository

data adir.grpmems;
length grpkeyid $ 128;
set adir.grpmems;

data adir.idgrps;
length keyid $ 128;
set adir.idgrps;

run;

[VishnuSagarPerni]

Hello,

Great thanks for your prompt response on this. 

What we are trying to achieve is following: 

1.There is a users group in LDAP. Ex: abcd group containing user1, user2,user3, and user4.

2. These 4 users who are part of this abcd group will be extracted into a txt file(using unix script) which then will be used to create a SAS data set. Ex: abcd.sas7bdat looks like below: 1 variable(userid) with 4 records.

userid

user1

user2

user3

user4

3.With %mduextr(libref=current); I've extract the current Metadata.

4. Got list of abcd group users' keyid from current.logins table. Updated Ex: abcd dataset looks like below:

userid	keyid
user1	AS875.4728DS
user2
user3	AD484.6468RT
user4	AS784.7854GR

Meaning: user1, user3, and user4 are SAS Users/ have Identities in Metadata. And are the only ones who needs to be part of SAS Meta group  (we will get to that in following step).

5. To align with current.grpmems table: Added variable grpkeyid (with gepkeyid value of a group that these users need to be part of) (gepkeyid value of a group is read from current.group_info table (id variable in current.group_info table is = grpkeyid in current.grpmems table)), dropped records with missing keyid values and renamed keyid to memkeyid. Updated Ex: abcd dataset looks like below:

grpkeyid	memkeyid
A5246F67.A20000SP	AS875.4728DS
A5246F67.A20000SP	AD484.6468RT
A5246F67.A20000SP	AS784.7854GR

6. Ran abcd dataset against current.grpmems table to filter records that are not already part of current.grpmems table. Assuming row1 and row3 already exist in current.grpmems table: Updated Ex: abcd dataset looks like below:

grpkeyid	memkeyid
A5246F67.A20000SP	AD484.6468RT

7. Exported abcd dataset to a txt file: adbc.txt below:

A5648E54.A50000SP AD484.6468RT

Steps until here are completed, Now, we'd like add this above record to grpmems table so that user becomes part of SAS Meta Group. I see taking different paths leading into different errors.

Can you let me know how I can proceed here to have these changes made?

Thank you!

Regards,

Vishnu Perni