Public access has been denied

[dirks]

I get this error message when I try to log in to VA:

Public access has been denied.

Public users are not allowed to access this SAP application. The current user has been signed out.

Logging in with my admin account works.

Can anyone help me please?

[Kurt_Bremser]

You need a userid that is specified in SAS metadata. This puts it (automatically) in the group SASUSERS. All other userid's are automatically assigned to group PUBLIC, which has very low privileges.

[dirks]

Thanks, but where do I do that? I have a user in SAS which I use for DIS, EPG etc.

*edit* I just checked, apparently I am in the SASUSER Group as well as in PUBLIC.

I m also in SAS Administrators and SAS System Services.

[SASKiwi]

You also need a SAS VA specific role added to your user account otherwise you wont be able to get in. Check these out in SMC:

[dirks]

I have put myself into every Visual Analytics group, just to get it to work. Still I am not able to log in.

[PaulHomes]

You may also want to consider that authentication for VA on the mid-tier may be configured differently to the authentication that is being done for the desktop clients like DI Studio etc. For example VA could be configured for trusted web authentication and the format of the fully qualified userid that is being used to query metadata for your identity when logging into VA may be different to the one that is being found when you are using DI. That can result in a (denied by default) PUBLIC-only user for you when using VA.

I would approach this by finding a user for which a VA login works then, in SAS Management Console User Manager, compare the configuration of that user with yourself. Looking on the accounts tab for that user do they have a single login listed or multiple? Is one in DefaultAuth and another in Web? Does this match the setup for your own user? Are the userids in the same format?

[PaulHomes]

BTW you shouldn't need to be in the SAS System Services group. That's a group for the SAS Trusted User service account to get broad read access to metadata. You will already get that (and more) from your membership of the SAS Administrators group.

[dirks]

---

@PaulHomes wrote:

BTW you shouldn't need to be in the SAS System Services group. That's a group for the SAS Trusted User service account to get broad read access to metadata. You will already get that (and more) from your membership of the SAS Administrators group.

---

I can't remove myself from the SAS System Services group. I get the error that the group is inherited.

[PaulHomes]

That sounds like the message you get when you try to remove an inherited access control from the Authorization tab. Are you trying to remove SAS System Services from the Authorization tab of your user? To remove yourself from the SAS System Services group remove it from the right hand list on the Groups and Roles tab for your user identity instead.

[dirks]

---

PaulHomes wrote: 

I would approach this by finding a user for which a VA login works then, in SAS Management Console User Manager, compare the configuration of that user with yourself. Looking on the accounts tab for that user do they have a single login listed or multiple? Is one in DefaultAuth and another in Web? Does this match the setup for your own user? Are the userids in the same format?

---

I have one user that works. I ve put myself in exactly the same groups.

The account has only one login listed. It is DefaultAuth, same as mine. It matches mine. Both have the same format.

[PaulHomes]

In that case I would start tracing things through the log files looking in the SAS Metadata Server log file and the various mid-tier log files. I would suggest that it might be a good idea to contact SAS Technical Support for this issue.

[dirks]

I will do that. Thanks for you help Paul!