Sharing in SAS Drive (part 1)

[#1]

SAS Drive is a new web application in Viya 3.4. It provides end-users with a way to find and organise their content, and it enables them to share some of their content with each other, using a simple user-friendly interface, without involving the SAS Administrator.

It all feels quite new, and having looked more closely at sharing in SAS Drive over the past few days, I believe I have a better perspective on it than I did initially.

In this first of two posts, I'll describe how I think (and am told) SAS Drive is positioned in our range of SAS Viya products, and how the new Sharing feature is intended to be used. There is, and will be, more official material on this subject - this is just my take on it.

In a more detailed subsequent article, we'll look at some concrete examples of Sharing in action and discuss what SAS administrators need to know about it to keep their users and the boss happy. But for this post, let's develop a shorter, high-level overview.

Sharing in SAS Viya is potentially a little bit of a confusing term. It could currently mean at LEAST three separate things:

1. SAS Drive is a brand new web application, which has a novel software feature not available, or even visible, anywhere else in the SAS Viya 3.4 visual interfaces (for now). It allows users to share content - usually their own - with other users or groups who they think might want to see it, in a rules-based way. Those users can re-share content with others. Under the covers, it uses an enhanced version of the general authorization system share with the rest of Viya for securing everything from folders to reports to application functionality (but not CAS data). This post is about this new software feature.
2. SAS Visual Analytics reports have an action menu, with lots of options on it, from a little vertical ellipsis top right. One of those options is a menu item group called 'Share report', with two menu items below it: 'Email...' and 'Link...'. This provides the user with a way to send someone a URL link to their report. This is not the subject I am discussing in this post, and I wonder if in time we will call this feature in Visual Analytics something else to avoid confusion with the Sharing feature in SAS Drive.
   • As an extension of the same thing, individual objects within SAS Visual Analytics also have a menu, from which you can choose 'Share object...' to obtain a URL which links to the individual object in the report. Again, not what this post discusses.
3. SAS Viya also has Projects, to which you add members. SAS Drive has a tab for Projects, which are like-named groups of references to objects such as Data Plans and Reports which are (presumably) united by some common topic or piece of work. A project's owner(s) can add members to the project, to 'share' the project with them. But the user interface doesn't use the word 'sharing' in this context, which helps reduce that potential for confusion.

The point of sharing in SAS Drive

So. The SAS Drive sharing feature. What is it all about?

The documentation for SAS Visual Analytics 8.3 introduces SAS Drive like this (the emphasis is mine):

SAS Drive is a hub for the SAS Viya applications, and enables you to easily view, organize, and share your content from one place.

The availability of the features in SAS Drive depends on the applications that have been installed, and the features and permissions that have been specified by your administrator.

With thanks to Scott Leslie for his take on this, the new sharing feature in SAS Drive is intended to allow users to let other people see or edit content saved in their own personal folder. They can do this at their convenience, without needing a SAS Administrator to provide an 'official' shared folder, secured with appropriate permissions. Sharing allows a user to give other users or groups read-only or read-and-edit access to their work, ad-hoc without needing any pre-planned, bureaucratic, formal structure. It's a democratization of security, which as you can imagine has some obvious potential benefits and challenges.

Figure 1: Hamish can share his work with any other user or groups when he wants to, without asking a SAS Administrator to update the security model's folder structure or permissions design. Hazel can similarly share her work as she wishes.

Think for a moment about the convenience you may have come to expect from good examples of other modern, collaborative web applications. Perhaps you have worked with colleagues using shared OneNotes, Slack, Google Docs or Office 365. You may use GitHub or Gitlab if you're a coder. I'm sure you can think of others, but a common characteristic is easy, transparent collaboration on documents, code or whatever shared work product you and your team or colleagues create. Now, some of those applications let multiple users work on the same document or object at the same time, and we don't have a way to allow SAS users to do that. But users can at least grant each other access to things in their own 'My Folder'. It's a start! And at least some of our customers expect this sort of capability in our software.

We have not really had anything like SAS Drive sharing in a SAS product before, or at least, not to my knowledge. Sharing in this sense presents SAS Administrators with a huge opportunity to free up their time for other work, but it also potentially presents a bit of a security concern and maintenance burden. We'll examine both in more detail in part 2 of this article.

However, staying with the high-level view for now, customer organisations can and should still have formal security models, with carefully-designed and formal folder structures that reflect the business organization and its work, secured with group-specific permissions. ALL our customers expect that capability in our software, and it's good and still there. Sharing is meant to fill a need for spur-of-the-moment collaboration which doesn't need so much rigor. It is quick and is meant to speed up teamwork and the free exchange of ideas between end users.

We should emphasize here that sharing content like reports, data plans or SAS code doesn't weaken the access controls for CAS data, and SAS administrators can see and if necessary remove shares of which they don't approve.

Some customers will love it. Some will have mixed views. Some may hate it and will be relieved to hear that you can very easily turn it off globally (but not for only some users). We'll discuss that in the follow-up to this article.

To conclude this part, sharing in SAS Drive could be viewed as a feature that users of a modern collaborative web applications expect; a hygiene factor which we need to stand up well against competitor applications, and a necessary tool which allows users to decide themselves how to collaborate and exchange their work with each other, without having to involve a distressed, distant or disinterested SAS Administrator.

Let's continue to part 2 of this article, where we see SAS Drive sharing in action.

[paulkaefer]

This sounds great! I assume access to shared links will also be controlled by organization network policies? I.e., links could be public and/or only accessible within an organization's network?

[DavidStern]

Thanks for your question @paulkaefer. Sharing in SAS Drive isn't really sharing links to other artefacts in SAS, as URLs. It is a means of making objects visible, and accessible to other users inside the SAS Drive visual interface. Take a look at the part 2 post, and I think you'll see how it looks, and that should answer your question.

You mention the organization's network policies in your question; sharing doesn't change anything about the networking set up, but perhaps you mean the organization's authorization (or security) model. As discussed at some length in part 2, sharing DOES alter the organization's security model, and it I think it will be popular in organizations which have relatively open, less formal security model designs. Very formal organizations will want to know about Sharing, and may wish to consider disabling it, to prevent users from sharing their own content with each other, or 'publicly' with anyone who is an authenticated user and is in an existing group, ad-hoc. I explain how to do that in part 2. Users cannot share content with 'everyone', or 'guest', or 'authenticated users' in SAS Drive - I tried that as one of my experiments, described in part 2 - those constructs are not in the list of individual users or groups with whom you can share an object.