How to enable guest access in SAS Visual Analytics 8.2

[#1]

Guest access is an optional feature that provides anonymous Read-Only access to Visual Analytics content. Essentially, this means you can allow users to view Visual Analytics reports without having to log in.  While guest access is supported in SAS Visual Analytics 7.4, it was not available in Version 8.1.  The good news is, guest access is BACK in VA version 8.2!  The official documentation on how to enable it is located here. 

This article gives a detailed step-by-step guide on how to enable guest access in your SAS Visual Analytics 8.2 Environment:

Step 1: Update configuration in the SAS Environment Manager

1. Log into The SAS Environment Manager as a SAS Administrator at:
                   http://<- your environment url ->/SASEnviromentManager/
   
   
2. From the initial Dashboard page, take note of the value in the dropdown at the top of the "CAS System Health" Section.  This will be needed later in the process.  In the example below, value is: "cas-shared-default"
   
   
   
   
3. Click the "Configuration" Menu on the left hand side of the screen:
   
   
   
   
4. From the dropdown, select "Definitions" and search for the string "sas.logon.provider.guest"
   
   
   
5. Click the Definition "sas.logon.provider.guest". 
   
   From the menu that appears on the right, click "New Configuration":
   
   
   
   
6. In the "New sas.logon.provider.guest Configuration" wizard simply "enable" the property by clicking the slider (when the slider is BLUE, it has been enabled).  Click Save:
   
   

Step 2: Run a series of Unix commands to enable guest access

*For this section, there are commands which will require you to input the value discovered in Step 2 of the "Update configuration in the SAS Environment Manager".  The command examples below use the value "cas-shared-default", and are underlined to assist in spotting them.  

This process involves using the Command Line Interface (or CLI).  To use the CLI, you first must create a CLI Profile and Login to the environment where the command line interfaces are installed.  @Renato_sas also has a great write up on logging in with the CLI in this article, under the "Command Line Interface" section.  These two steps are also documented in these support.sas.com pages:

• Create at Least One Profile
• Use a Profile to Sign In (When signing in, use a user that is a member of the Superuser role)
  
  

Once you have completed the two steps in the links above, submit the following commands on the same machine you logged into with the CLI.  
 

1. Submit: /opt/sas/viya/home/bin/sas-admin authorization facilitate-guest
   The response should be: "Guest access is enabled".
   
   
2. Submit: /opt/sas/viya/home/bin/sas-admin authorization update-rule --id guest-files-2 --object-uri /files/files
   The final response should be: "The rule has been modified".
   
   
3. Submit: /opt/sas/viya/home/bin/sas-admin authorization create-rule --object-uri=/files/files/** --permissions Read --guest --description "Guest Access: Grants permission to a file based on the file’s parent" --condition "isAuthorized(#file?.parentUri)"
   The final response should be: "The authorization rule has been created.".
   
   
4. Submit: /opt/sas/viya/home/bin/sas-admin authorization update-rule --id guest-identities-2 --object-uri /identities/users
   The final response should be: "The rule has been modified.".
   
   
5. Submit: /opt/sas/viya/home/bin/sas-admin authorization create-rule --object-uri=/identities/users/@currentUser --permissions Read --guest --description "Guest Access: Users can see identity information for the current user"
   The final response should be: "The authorization rule has been created.".
   
   
6. Submit: /opt/sas/viya/home/bin/sas-admin cas facilitate-guest --source-file /opt/sas/viya/home/share/guest/ --server cas-shared-default --superuser
   There will be no response from this command
   
   
7. The complete input and expected output from these commands are shown below:
   
   
   
   
8. Submit: /opt/sas/viya/home/bin/sas-admin cas facilitate-guest --server cas-shared-default --superuser
   There will be several responses from this command which are shown below:
   
   
   
9. The next step is to grant access for the guest user to a global caslib.  The following commands grant the recommended access (readInfo, select and limitedPromote) for the guest user to the global caslib "PUBLIC". 
   
   Submit the following 3 commands:
   
   /opt/sas/viya/home/bin/sas-admin cas caslibs add-control --server cas-shared-default --caslib PUBLIC --grant readInfo --guest --superuser
   
   /opt/sas/viya/home/bin/sas-admin cas caslibs add-control --server cas-shared-default --caslib PUBLIC --grant select --guest --superuser
   
   /opt/sas/viya/home/bin/sas-admin cas caslibs add-control --server cas-shared-default --caslib PUBLIC --grant limitedPromote --guest --superuser
   
   The responses are shown below:
   
   
   
   

Step 3: Grant guest access to SAS Visual Analytics content

The next step in the process is to select which reports the guest user should be able to view (without having to log in!). 

1. Log into The SAS Environment Manager as a SAS Administrator at:
                   http://<- your environment url ->/SASEnviromentManager/
   
   
2. Click the "Content" Menu on the left hand side of the screen:
   
   
   
3. Navigate to the folder that contains your report(s).  Right click the folder you would like to grant guest access to and select "Edit Authorization."  In the example below, the Folder "Guest Access" has been selected.
   
   *note: the folder that you are grant guest access to CANNOT be inside your "My Folder" folder
   
   
   
4. At the next screen, click the "+" button and click "Add Guest."
   
   
   
   
5. Grant the guest user, "Read" and "Read (convey)" access.  Click Save.
   
   
   

Step 04: View report(s) without logging in!

 

With the steps above completed, you can now view SAS Visual Analytics reports without having to log in!

1. In a new browser session, navigate to The SAS Report Viewer at:
                   http://<- your environment url ->/SASReportViewer/
   
   Click the NEW Guest Button:
   
   
   
   
2. You can now click the "Browse Reports" button and select content the guest user has been granted access to (via Step 03 of this article):
   
   
3. In the image below, the user opens the folder "Guest Access", Selects the report "CARS Report" and clicks "Open."
   
   
4. The report is displayed (again without logging in!) to the guest user:
   
   

[JuanS_OCS]

Hello @Mike_Drutar,

thank you for the guide, it is great.

Do you have a way to provide direct access for Guest to report or to a dashboard with (favourite) reports? I mean, you provide only a URL and the application will go directly to a list of reports or to one report, without more "clicks".

Also, would this work for every Authentication option as explained by @StuartRogers ? 

And, what for Mobile BI app?

Thank you in advance!

Kind regards,

Juan

[RexDeus9]

Hi,

Is there such steps for VA client 7.3 (server 9.4)?

I think I have everything setup right, but keep getting the dreaded 'The requested data source was not found on the server' with the data set attached to the report.

 H E L P!!!

[r0oki3]

The data source has to be given guest access too.

[nikhilreddy]

Hi, I am facing below error while running Step#2 3 point, below is the error 

/opt/sas/viya/home/bin/sas-admin authorization create-rule --object-uri=/files/files/** --permissions Read --guest --description "Guest Access: Grants permission to a file based on the file’s parent" --condition "isAuthorized(#file?.parentUri)"
The following errors have occurred:

The authorizationRule was not valid.
Http Status: 400
ErrorCode: 1177

Detailed Messages:
correlator: 9f2d953b-495f-45d6-8577-c29768c51dd9
traceId: f22ae2809da448d1
path: /authorization/rules
FieldError: Rule [id=guest-files-3, type=GRANT, permissions=[READ], principal=null, principalType=guest, containerUri=null, objectUri=/files/files/**, mediaType=null, condition=isAuthorized(#file?.parentUri), filter=null, reason=null, description=Guest Access: Grants permission to a file based on the file's parent, isEnabled=true, matchParams=false, isShare=false]: Provided authorization rule is a duplicate of this rule.

>> Do i need to replace the object-uri=/files/files/** with any folder path lets say /public ?

same thing with the 5 point 

/opt/sas/viya/home/bin/sas-admin authorization create-rule --object-uri=/identities/users/@currentUser --permissions Read --guest --description "Guest Access: Users can see identity information for the current user"
The following errors have occurred:

The authorizationRule was not valid.
Http Status: 400
ErrorCode: 1177

Detailed Messages:
correlator: 4803aa8c-2fd6-465b-9e34-5fe4213888db
traceId: 3a3f3f91f484315e
path: /authorization/rules
FieldError: Rule [id=guest-identities-3, type=GRANT, permissions=[READ], principal=null, principalType=guest, containerUri=null, objectUri=/identities/users/@currentUser, mediaType=null, condition=null, filter=null, reason=null, description=Guest Access: Users can see identity information for the current user., isEnabled=true, matchParams=false, isShare=false]: Provided authorization rule is a duplicate of this rule.

>>Do i need to replace Current user with the id ?

Appreciate your suggestions and help!

Thanks

Nikhil

[LucaCampa74]

Hi nikhilreddy in that point I changed in this way:

/opt/sas/viya/home/bin/sas-admin authorization create-rule --object-uri=/folders/folders/** --permissions Read --guest --description "Guest Access: Grants permission to a file based on the file’s parent" --condition "isAuthorized(#file?.parentUri)"

But we have the problem with point 6:

Submit: /opt/sas/viya/home/bin/sas-admin cas facilitate-guest --source-file /opt/sas/viya/home/share/guest/ --server cas-shared-default --superuser

[idziemianczyk]

Hi @Mike_Drutar 

Is it possible to configure guest access without clicking the "Guest" button? When user use report link he simply sees the dashboard without intermediate steps