Metadata Bound Libraries issue

[Lenvdb]

We have a large collection of encrypted SAS Folders, which our userbase can read and write datasets to.

As these folders are using SAS encryption, we keep a number of Metadata bound libraries for this use.

Until last Friday our Users were able to write SAS Libraries to these encrypted folders without any issues.

We use SAS9.4 (M2) , EG7.1 running on SAS Compute Win 2012 R2 servers. (fairly standard setup)

After the most recent Metadata Server restart, our users are no longer able to add datasets to these encrypted Metadata bound folders:

NOTE: Metadata-bound library permissions are used for TESTA.TEST3.DATA.

ERROR: Could not add the secured table object to the secured library

NOTE: The SAS System stopped processing this step because of errors.

I still can using my SAS Admin creds. It creates a dataset with success here, and registers it in Metadata - all good.

And after it is created in Metadata they (The users) can then access it and overwrite it successfully.

Checks done:

• I have already checked the User Group in metadata to see they have full Read Write permissions to this Library.
• It also aligns with their Windows AD permissions having full RW access.
• I checked that no ACT's have been set to restrict access for them.
• I checked all roles and capabilities in SAS Administration group to see what I can add to the Metadata User group, but it does not seem to help.

Has anyone had issues with this (or similar) recently? If so, how did you resolve it?

Kind regds

Len @ HEFCE

[Patrick]

@Lenvdb

And that after a simple SAS Metadata Server restart? What I would be doing:

1. Take a Metadata backup

2. Restart the server

3. If not resolved call SAS TechSupport

It appears there is a repair statement which eventually could help:

http://support.sas.com/documentation/cdl/en/seclibag/66930/HTML/default/viewer.htm#n1gpkwbnzx0jh0n1g...

Or: Do you have a recent enough SAS Metadata Backup you could try?

[PaulHomes]

Hi Len,

You mentioned you checked the permissions on the library and they had full read write access. Which library did you check and which permissions were you checking? Did you check the Secured Library object or a traditional SAS Library object? For the Secured Library were you looking at the additional permissions: Create Table, Alter Table etc. Also, how are you assigning the library - is the base engine being used directly or are you using the Metadata Libname Engine with the METAOUT option?

From the error message you posted, and the fact that you didn't have any problems as an administrator, I was thinking it looked like it could be an issue with the permissions on the Secured Library object. There is more info on the permission requirements for this in the Permissions for Metadata-Bound Data section of the SAS 9.4 Guide to Metadata-Bound Libraries (and several other sections too). To add a Secured Table to a Secured Library the Create Table permission is required (Alter Table when overwriting an existing table). Interestingly WriteMetadata is not required on the Secured Library (as it is in many other instances when linking a new object to an existing object). However, when I just I tested a missing Create Table permission I got a different (and very helpful) error message (in SAS 9.4 M4): 

NOTE: Metadata-bound library permissions are used for SECLIB.TABLE.DATA.

ERROR: USERID as Identity Name is not authorized to create data set SECLIB.TABLE.DATA. Create Table permission is required.

So unless the error message has changed between M2 and M4 it doesn't look like this is the issue. I'll still post this comment though just in case it's useful to others who read this thread in future. 🙂

It would probably be worth sending this one on to SAS Technical Support if you haven't done so already.

Cheers

Paul

[Lenvdb]

Thank you Paul and Patrick.

We picked up through testing and Process of Elimination late yesterday that all the folders encrypted and added to our Metadata bound repository BEFORE the latest Metadata Restarts last Friday evening seem to have a problem.

New folders that were added and encrypted since last Friday's restart seem to have no problems, and those users can freely add new encrypted datasets at will.

I have logged a call with SAS Tech Support and will mention this to them.

Len

[PaulHomes]

Thanks for the update Len. If you're able to identity the underlying problem and find a solution with SAS Tech Support please post back here as I, and I imagine othes too, would be keen to find out the resolution. Cheers Paul

[Lenvdb · Accepted solution]

Hi Paul.
The solution: I inadvertently modified the Default ACT. I had to make sure that the Default ACT for SASUSERS must always have ReadMetadata and WriteMetadata checked.