How to remove a principal from a SAS Content folder permission
If you want to remove a principal from the authorization window of a SAS Content object there are several possibilities. They are either GUI based and might involve a lot of clicks or use several command line calls which might not be available to everyone.
This post will introduce a new method of deleting the permissions on an object for a principal that appears in the SAS Content object authorization list.
Topics discussed
- Basics on permission settings
- How to delete a principal the new way
- How to delete a principal the old way
Basics on permission settings
If we look at the permission screen for a SAS Folder available from the SAS Content page in SAS Environment Manager it will look like this:
Screenshot from SAS Content page in SAS Environment Manager prior to 2024.11
The line for the principal "Application Administrators" is highlighted.
These permission settings are represented by two rules. In the screenshot below, there is a filter applied to show only the rules where the principal "Application Administrators" is used. There are many more rules related to this principal which are not shown below.
By default the column "Container URI" is not shown, you can display it by clicking the "Manage Columns" tool.
The first line in the table above, where the Container URI has a value, are the permissions (Read, Add) that are inherited from this folder to its child objects. The second line in the table above, where the Object URI has a value, are the permissions (Read) that apply to the folder directly.
How to delete a principal the new way
With SAS Viya Stable 2024.11 there is a new SAS Content page available that will make this a lot easier. The same functionality is already available since LTS 2023.10 in the new SAS Visual Analytics home page.
You are then presented with the new permission window. If you want to edit the permissions, click the Edit button. The screen below will be shown.
Note the two new buttons in the top right. They have the following function:
- The double +: Add direct grants for all permissions for the selected principal
- The minus: Delete all direct settings for the selected principal
When you click on the minus button:
- All direct permissions for the principal are deleted
- The rules associated with the deleted direct permissions are deleted.
How to delete a principal the old way
To delete a principal from the "Edit Authorization" window you can set all the permissions to none. This has to be done for each permission that has a direct setting. This can take a while depending on how many permissions have a direct setting.
Another way of doing it, find the right rule and delete it. Using the Rules page in SAS Environment Manager you can easily search for a given folder like this:
This will then allow you to choose a folder, the corresponding Object URI will be returned. Choose the principal as well, the appropriate rule should be displayed. You can now delete this rule:
Repeat the above for the Container URI.
Summary
Deleting a principal and its direct permission settings of a SAS Content object has become very easy using the "Edit Authorization" window available with the new SAS Content page in SAS Environment Manager 2024.11. For earlier versions use the SAS Visual Analytics homepage available with LTS 2023.10.
References
To learn more about the General Authorization System, see these posts
Simple general authorization patterns
Updating SAS Viya general authorization permissions using the sas-viya command line
Find more articles from SAS Global Enablement and Learning here.
