What Do I Need to Know About SAS® Viya® Security? Q&A, Slides, and On-Demand Recording

[#1]

Watch this Ask the Expert session for an introduction to SAS Viya security and take a deeper look into the new two-tier authorization model introduced with SAS Viya.

Watch the webinar

Join Bala Arunagirinathan as he teaches you about SAS Viya security. Administrators will gain the knowledge and confidence to design and implement a comprehensive security model for their existing or future SAS Viya projects. During this webinar you will learn:

• General authorization.
• CAS authorization.
• File system authorization.

The questions from the Q&A segment held at the end of the webinar are listed below and the slides from the webinar are attached.

Is the security model the same for the latest release of SAS Viya, 2020.1?

Yes, it is the same. SAS Viya 2020.1 is an entirely cloud-based deployment but the application usage and administration is the same.

Where should an Admin start first to implement security?

1. Authentication – bring only the required users from LDAP to Viya (filter)
2. OS level on the filesystem
3. General Authorization for the folder contents
4. CAS Authorization for CAS Libraries

Can I get some links for CLI commands so I can apply via CLI commands?

Here are some resources on the Command-Line Interface:

• https://go.documentation.sas.com/doc/en/calcdc/3.4/calcli/p0kun58h1e13d2n1h5gce5qm8vcq.htm
• https://go.documentation.sas.com/doc/en/calcdc/3.5/calcli/n01xwtcatlinzrn1gztsglukb34a.htm
• https://go.documentation.sas.com/doc/en/calcdc/3.4/calbr/n1e3dfgr1nxlw2n1a0ly06dunrz5.htm
• https://blogs.sas.com/content/sgf/2018/03/08/sas-viya-3-3-command-line-interfaces-for-administration...

Is there a certification for SAS Administration?

Yes, there is a certification for SAS 9.4 and SAS Viya 3.5, but we don’t have one yet for SAS Viya 2020.1. We do have SAS Viya administration training courses.

In new SAS Viya implementation, what trainings are provided to the Super Users/Admins?

Here is the SAS Viya 2020.1 training course.

Do changes to the configuration come under vendor support with the product or is it the responsibility of the client super-user or the admin?

It is the responsibility of the administrator. Any administrative tasks that are being done should flow through the SAS administrator. They should be creating the custom groups and handling security, but they also need to accurately document everything and put it in a pdf file.

Are there any limitations on number of custom groups that can be created in SAS Viya?

No

Where are these permissions being saved, is it in a Postgress Database or a SAS Dataset?

Postgress Database

When I create any group in SAS Viya, is it required to create those same groups in LDAP?

It’s not necessary, but if you have a good relationship with your back-end LDAP admin, you can ask them to create the group for you and put the users in the LDAP. It updates in Viya every 12 hours and then you will see the group there and you can do your admin there.

Can we have nested groups?

Yes, you can have them, but it not recommended. I would keep them at a minimum. It’s easier to troubleshoot the non-nested groups.

I have a custom group with six members that have authorizations on objects and containers. For some reason, these authorizations stopped working. I recreated the group (with a different name but same members and same authorizations) and this group has access. Any ideas how to troubleshoot why the first group doesn't have access? Any risk in deleting the first custom group and keeping the second?

You can delete the first group, but let’s figure out why it’s not working first.

Is there any documentation that shows what would be the equivalent component in GRID vs Viya (example: SAS WRS in Grid vs Viya?). This would help in migration plan, thank you!

Here are some resources that should be helpful:

• https://blogs.sas.com/content/sgf/2018/08/29/sas-grid-manager-and-sas-viya/
• https://blogs.sas.com/content/sgf/2020/09/04/sas-grid-manager-and-sas-viya-a-strong-relationship/
• https://blogs.sas.com/content/sgf/2018/11/07/implementing-sas-grid-manager-and-sas-viya/
• https://www.sas.com/en_us/webinars/sas-grid-manager-sas-viya-a-perfect-pair.html
• https://www.sas.com/content/dam/SAS/support/en/technical-papers/sas9-4-sas-viya-functional-compariso...
• https://communities.sas.com/t5/SAS-Communities-Library/SAS-Grid-Manager-and-SAS-Viya-Use-Cases/ta-p/...

Is Viya 4 out and do you have any documentation on it?

Yes, it is out and we’re calling in Viya 2020.1. You can find documentation here.

How do we control SAS dataset (sas7bdat) access via SAS Environment Manager?

Regarding your question on how to control the SAS dataset permissions, if you are saving your datasets in a filesystem someplace, you need to make sure you set the ACLs permission on the filesystem. Only the users belonging to the groups should be able to Read those datasets. So you will be using the OS commands to secure those datasets. SAS Environment Manager will be used to set the Folder and CASLIB permissions only.

Recommended Resources

Orientation to Authorization

SAS Admin Notebook: Folder Security

Intro to SAS Viya Authorization

Want more tips? Be sure to subscribe to the Ask the Expert board to receive follow up Q&A, slides and recordings from other SAS Ask the Expert webinars.