SAS Viya supports Python or R language code in SAS programs as well as in CAS, MAS and multiple other of its components.
Typically Python and R code support is enabled for all users but some customers prefer to selectively grant access to only specific users of the SAS Programming Run-time. You can do this by enabling the LOCKDOWN access methods needed for Python and R code only in selected compute contexts, rather than globally for the compute server or for all programming run-time servers. And of course you can manage which groups of users, or which individual users, have access to use a compute context.
Read on to see how.
Since they can vary slightly between releases, the full set of steps for configuring open source language integration into your version of SAS Viya are documented in a README.md file in your deployment assets, at $deploy/sas-bases/examples/sas-open-source-config/README.md. The instructions in that README refer to several other sets of instructions that when followed together collectively guide you through the overall process to enable Python and R for all SAS Viya programming run-time users (and also in all CAS, MAS etc. sessions), which is what most customers want.
My colleagues and I have written a number of articles here in an attempt to make the process of setting up and managing open-source programming languages and their configuration easier:
Some customers have a good reason to limit access to Python and R to only a subset of their users. For example customers might wish to limit access to sensitive data or systems, to harden their SAS Viya environment by granting access to advanced features only as needed, to allow the administrator to reserve access to additional compute resources for users with the greatest need, or allow a group of users to experiment with open-source language integration in SAS programming run-time servers before rolling the capability out more widely.
SAS Administrators can do this by following all the usual steps to enable the open source programming languages as normal, but altering one step in the process.
For the step in which you enable the LOCKDOWN access methods needed for the open source programming languages from the SAS programming run-time, instead of enabling the access methods for all users of compute, connect and batch sessions by adding a kustomize overlay based on the example in sas-bases/examples/sas-programming-environment/lockdown/enable-lockdown-access-methods.yaml to your site-config files, skip that step or reverse it if you already followed it and instead add a LOCKDOWN statement to the autoexec code block for one or more compute contexts, to enable the required lockdown access methods only in those compute contexts.
Users running SAS compute sessions under the compute contexts which have the access methods enabled will be able to use Proc Python and Proc R. Users running SAS compute sessions under other compute contexts will be unable to run those procedures, and will see an error message explaining why.
The Details
If you configure SAS Viya for Python integration, you'll see there are multiple steps to follow to enable everything to work.
The instructions include a step in which you modify the LOCKDOWN configuration in your programming run-time, to enable the access methods required to allow SAS compute, connect and batch servers to talk to the Python and R runtimes. The access methods you need to enable depend a little on what you intend to allow your users to do. As the $deploy/sas-bases/examples/sas-open-source-config/README.md explains, you must enable python and python_embed access methods for most, if not all, Python integration points in order to bypass LOCKDOWN restrictions. The socket method is also required to enable PROC PYTHON and the Python Code Editor.
The standard instructions then refer you to documentation to Enable Lockdown Access Methods, which in turn walk you through the steps to
- copy an example kustomize overlay from sas-bases/examples/sas-programming-environment/lockdown/enable-lockdown-access-methods.yaml to your deployment's site-config directory structure
- modify the copied file to enable the python, python_embedand socketaccess methods
- add a reference to the copied and modified file to your kustomization.yaml file, and then
- perhaps after following other steps, redeploy SAS Viya so that these changes take effect
Doing this enables Python in the SAS Programming Run-time for all users.
Instead of following those steps to enable the access method globally, omit or undo those steps in the process, so that the python, python_embed and socket access methods are no longer enabled (globally for all programming run-time sessions). If you change your site-config files or kustomization.yaml to undo the step, remember that you need to redeploy SAS Viya before those changes will be effective.
Next, identify the compute context(s) in which you want to enable users to be able to access Proc Python and Proc R from their SAS code. In only these contexts, add a line to their autoexec code block as follows to enable the access methods in compute sessions started under only these compute contexts:
lockdown enable_ams=PYTHON PYTHON_EMBED SOCKET;
Note: LOCKDOWN statements are only effective in an autoexec code block for a programming run-time server or compute context. Lockdown statements are not allowed in user code, after the compute or connect session, or the batch job has entered the locked-down state. This means only SAS Administrators can modify the configuration of LOCKDOWN. If you try to run a LOCKDOWN statement in user code, you will get an warning message explaining:
WARNING: The LOCKDOWN statement was not executed. Set the LOCKDOWN system option and add the LOCKDOWN statement to an AUTOEXEC file
or to the INITSTMT statement.
Note: The python, python_embedand socketaccess methods necessary for using open source programming languages are disabled out of the box, and you can enable them either with an overlay based on the one described above (and by redeploying SAS Viya) or with a LOCKDOWN statement in an autoexec code block. But you cannot enable them globally and then disable them selectively for certain compute contexts - there is no LOCKDOWN DISABLE_AMS statement which would do that, but we don't really need one.
Note: You may notice a file called disable-lockdown-access-methods.yaml in your deployment assets, under sas-bases/examples/sas-programming-environment/lockdown/. However, it is not relevant to the python, python_embedand socketaccess methods; it can be used to disable other access methods which are enabled by default.
SAS Administrators can make new compute contexts in a SAS Viya deployment as needed, and rather than modifying an existing, widely-used compute context with the LOCKDOWN enable_ams statement above, most will prefer to make a new compute context for users who need access to Proc Python and Proc R.
Compute contexts are accessible to all authenticated users by default, but they have a field which allows you to restrict access to a list of groups or individual users. This works, but it does leave users able to see compute contexts which they are not allowed to use, for example, in the compute context dropdown list in SAS Studio, or in the Compute Context tab in the Project Settings for a project in SAS Model Studio. It is possible to remedy this, making compute contexts only visible to users who are allowed to see them. The following articles explain how you can do that:
And finally, if you wish to script the process of adding a statement to an existing compute context's autoexec code block without overwriting existing statements in its autoexec code block, see my article Add statements to an existing SAS compute context autoexec for an example of how to do that.
See you next time!
Find more articles from SAS Global Enablement and Learning here.
