SAS Base Library Authorization

[shivrajpawar98]

Hi All,

Can anyone guide me on how to set up Base SAS Library authorization for individual users on SAS Viya 4? I’d really appreciate your help with this.

Regards,
Shivraj Pawar

[LinusH]

Base libraries uses file system authorizations, so speak to your platform/security team for guidance.

[shivrajpawar98]

Sorry i was not clear, i need this authorization on sas viya 4

[LinusH]

As I understand it, you can set authorizations to libraries inside SAS Viya.

But, this probably won't stop user from accessing the library path directly.

"The data source definitions do not reside in folders and are created with READ permissions for all authenticated users. Operating system permissions to the library physical paths are respected by the Compute server when the libref is assigned. This means that if a user cannot read the file-system directory they will not see the library in their SAS session."

https://communities.sas.com/t5/SAS-Communities-Library/Managing-Connections-to-Data-Sources-and-SAS-...

[gwootton]

In the SAS Viya Platform, Base SAS libraries are made available to compute and CAS by way of volume mounts. For example your data might be on an NFS volume nfs.example.com:/sas-data which is mounted to /sas-data inside the CAS and compute pods.

For CAS libraries, permissions can be set on the CASLIB, but if you are mounting directly onto the compute pods, access would be governed based on file system permissions, which are based on the execution user's POSIX attributes (uid, gid, secondary gids).

The POSIX attributes are either provided to Viya (from LDAP or through bulk-loading), or Viya can generate them.

So to limit access to certain data files you would need to set permissions on those paths in the volume you are mounting, based on the user and group identifiers in Viya.

[Kurt_Bremser]

So Viya does not provide something equivalent to 9.4‘s metadata-bound libraries?

[gwootton]

@Kurt_Bremser Not for base SAS tables directly as far as I'm aware, though you can still password protect and encrypt them programmatically. CAS tables can be encrypted with a key stored in an encryption domain, and protected with permissions.

[Kurt_Bremser]

So how does one solve the issue of encrypting data at rest?

[gwootton]

@Kurt_Bremser using encrypted caslibs and whole disk encryption.

Here is the documentation on Data at Rest encryption on the SAS Viya Platform:
https://go.documentation.sas.com/doc/en/sasadmincdc/v_068/calencryptrest/titlepage.htm