SAS VA security - LASR data shared by report with different security profile

[Flamemage]

Hi,

I have reports that need to have different access profiles but they share the same LASR tables. Has anyone experienced similar situation and how have you approached separating the access? I can think of 2 solutions so far which is (1) duplicate the LASR table (with slight name change; (2) create a common location for the LASR tables. I wasn't happy with (1) as it seems to be a solution that consumes memory unncecessarily and neither was I with (2) as this would make the access control of the report and artificial security measure (as you the access to the LASR table is now open).

[Madelyn_SAS]

If all of the users are permitted access to the LASR tables, then why not control security via the reports themselves.

[Flamemage]

No. I need to separate the access of the LASR tables.

[JuanS_OCS]

Hello @Flamemage,

have you already considered the Row-level access security? 

Kind regards,

Juan

[Flamemage]

I came across it early on the investigation but felt it adds-on to the adminstration complexity. I also felt that it would be possible for user to bypass the row level security applied in VA by using code and access the LASR data itself.

[JuanS_OCS · Accepted solution]

Hello @Flamemage,

that would depend a lot on how you set up the row-level security. I am not the expert on that area, I cannot help completely.

However, if you really want/need the strongest security, the best you can do, is to apply your first  guess: duplicate tables/reports and put security on each table and reports. I would also put them on different SAS Folders and put the security at a SAS folder level.

As with any tooling set, it is all a question of what is your priority: reduce space? security? performance? flexibility and easier administration? Once the priorities are clear, you can take some decisions and go for it.

As a side note, I would like to add the fact that, with smaller and uncompressed tables, even if they are multiple, SAS VA works better on performance. The biggest the table, the closer you might be to reach a boundary for VA performance (according to your sizing document).

[Flamemage]

Thanks @JuanS_OCS. Yes, i am leaning toward bespoke tables for report. We are also facing undesirable slowness with VA so maybe this can also help.