What is the right way to check access for all nested groups in SAS Viya?
I have group1 and group2 which is a member of group1. So, group2 should inherit access given to group1.
Part 1. Is there a way to see permissions on objects (caslib, tables) for all nested group (and possibly users)?
When I use:
proc cas;
accessControl.whatIsEffective /
objectSelector={objType="caslib",caslib="mylib"},ReturnDecisionText=true;
run;quit;
I only get group1 in the list (no group2 though it inherits access):
Can I get something like this?
group1 - Authorized (explicit)
group2 - Authorized (inherited)
Part 2. SAS is not showing that a nested group has an access.
When I use:
proc cas;
accessControl.whatIsEffective /
ids={{identity="group2", identityType="group"}},
objectSelector={objType="caslib",caslib="mylib"}, ReturnDecisionText=true;
run; quit;
I get:
though it should be Authorized because group2 is a member of group1 and:
Why it does not show that group2 is Authorized?
Well, I can understand that SAS will not list permissions for all nested groups (Part 1 of my post) though it would be helpful, but why it does not show correct permissions if I ask to show them explicitly (Part 2 of my post)?
For example:
1) create group1
2) create group2 and make it a member of group1
3) grant ReadInfo on some caslib "mylib" to group1
4) Run
proc cas;
accessControl.whatIsEffective /
ids={{identity="group1", identityType="group"}},
objectSelector={objType="caslib",caslib="mylib"}, ReturnDecisionText=true;
run; quit;
5) Run
proc cas;
accessControl.whatIsEffective /
ids={{identity="group2", identityType="group"}},
objectSelector={objType="caslib",caslib="mylib"}, ReturnDecisionText=true;
run; quit;
Should 4) and 5) both show that these groups are Authorized? Yes (to my understanding). Why it shows Authorized in the first case and Not Authorized in the second case?
Well, for me this is misleading.
Also, CAS Server still must know that group2 is a member of group1 because in reality group2 has access (inherited from group1) despite SAS code shows that it doesn't.
I see. But does it mean that accessControl.whatIsEffective what correctly for users (ids={{identity="user1", identityType="user"}}) and NOT correctly for all nested groups (ids={{identity="group2", identityType="group"}}) in case they do not have direct permissions?
What exactly happens when using accessControl.whatIsEffective / ids={{identity="group2", identityType="group"}}...? CAS doesn't check group2's membership? Does it check membership only for users?
Thanks. At least now it is more clear what is happening and why.
Are you ready for the spotlight? We're accepting content ideas for SAS Innovate 2025 to be held May 6-9 in Orlando, FL. The call is open until September 16. Read more here about why you should contribute and what is in it for you!