SAS 9 Administration Refresher: User Administration

[#1]

SAS analyzes data to produce answers and insights. Whether those insights come from a frequency count or an all-night production job that analyzes millions of rows of data: SAS first must be able to access that data.

In SAS 9, access to data sources is managed through Library References (librefs), which can be defined during a client session or defined in metadata by an administrator for use by the server.

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

During a client session, users can write their own code to connect to a data source, known as an ad-hoc connection to data. The connection can be referenced while the user’s session stays running, and then the connection is removed.

But we want to make things easier for our users! Libraries that are defined in metadata allow the creation of data sources that are easily referenced so that your users don’t need to remember every connection parameter, credential, and path to the different data sources in your organization. Administrators can also apply authorization to these library connections so that Team A might not be allowed to see or modify Team B’s content.

Creating Library References to Data Sources

You will need to gather the connection information for your data sources and register them as Libraries in Metadata. You can do this using SAS Management Console or SAS Environment Manager’s Administration page. These references tell SAS where to go to find the physical location of the data when it is time to connect. I recently published a post about ways to programmatically manage Library and Table Metadata. Go check it out here: Programmatically working with SAS 9 Metadata Libraries as an Administrator

You can see that there are many types of data sources for which we can define libraries. Options exist for SAS data sets, many databases, raw files, and more as evidenced by this screenshot:

For each type of data source an appropriate engine is used to access the data in a manner that works for the data source. Engines are components of SAS software like the Base SAS engine for SAS data sets, or SAS/ACCESS interfaces for reading, writing, and updating other data. Here you can find a list of many common data sources to which SAS can connect, and how to define them: SAS Help Center: Connecting to Common Data Sources. These libraries are associated with a SAS server, making the library visible to users of that server, assuming they have appropriate authorization.

Data Connection Methods and Metadata-bound Libraries

Reminder that the concept with libraries involves defining common connections to data sources for teams. We as administrators go to the effort to apply access controls to these connections, so that they are seen by some groups or hidden from others, but at the end of the day libraries exist to allow someone to get to that data source.

We can use different methods when using LIBNAME statements to create libraries. Depending on the options used, a SAS user can connect directly to a data source or query the metadata for a library name.

Here’s an example of using the native engine with a libname statement:

libname aicom "/mnt/s/vol/42/AIprojectfolder/common/2026/005";

That’s a lot to remember. Alternatively, if an administrator put defined the library in metadata, a user could connect by typing:

libname aicom meta library="AI Team Common Library";

This causes the SAS session to query the metadata server and look for the ‘AI Team Common Library’. If found, the connection to the data source uses the stored connection parameters to access the data source, without the user necessarily needing to know all the details.

Also, while using the META engine to connect, metadata layer permissions are checked when someone tries to access or change a library or table. By using a LIBNAME statement that directly connects to a data source, users can bypass metadata-layer controls. To prevent this, a recommended practice is to ensure you secure data at the storage or database level.

Additionally, beyond host-layer security: there is an option to create Secured Libraries for storing SAS Data sets (sorry, not for databases). These are called metadata-bound libraries, and they have information on their table headers that point to corresponding metadata objects. For access to be granted, the requestor is redirected to the metadata server for an authorization check.

More information found here: SAS Help Center: What is a Metadata-Bound Library?, as well as instructions for how to create metadata-bound libraries, and how to audit them. In the SAS metadata there is a folder named /System/Secured Libraries. You can use either the SAS Management Console or Proc AUTHLIB to bind the physical library to the metadata.

Assigning Libraries

Lastly, when should these connections to data sources occur? Determining when the connection is made is a major consideration for administrators because there can be some considerations involved. Options exist for the administrator to configure the SAS server to connect to the data source at session startup time, or to let the client connect later.

Connecting at session launch is referred to as pre-assigning the library, because the library is established before any code that uses the library is submitted. Pre-assignment can either be configured in SAS Management Console and SAS Environment Manager’s Administration page or written in code in a server autoexec file using LIBNAME statements.

By default, if we do not do anything special, libraries are assigned by the client application, when the user tries to access a library, ad hoc, when they determine a certain data source is needed.

Which to choose? Well, there are a few considerations. Pre-assignment of libraries creates identical connections that all your users have regardless of client application. This might be convenient for certain libraries that are commonly used by many individuals.

Are we dealing with stored processes or pooled workspace servers? Batch programs? If a library is not pre-assigned, the program developer will need to include LIBNAME statements into these programs so that data is accessed when they run.

Do you have many pre-assigned libraries that are all trying to connect at session launch? Waiting for all the connections to be established will add some time before your users can run their code.  Make sure you evaluate when a given library connection needs to occur: is it a data source needed for all users all the time, or one to which they could connect later on demand?

Thanks for reading.

Find more articles from SAS Global Enablement and Learning here.