OLAP Cube Studio: Adding library

[metalray]

Hi Guys,

I use OLAP Cube Studio and want
to add a new libraray. The whole SAS software is freshly installed.
Adding a new path results in a pop up asking
me to log into SASServer:SASMeta, I tried:

sasadm@saspw

sasvm\sasdemo

but nothing seems to work. The error is:
User SAS Administrator coiuld not log into
SASMeta - Logical Workspace Server.

Why would the administrator not be able to do that?


On http://support.sas.com/resources/thirdpartysupport/v92/appservers/wlunix.html I read:

The SASMeta - Workspace Server should be used for only a few designated administrative tasks.
It is appropriate to defer validation of this server until you have set up the SAS users
who will perform these tasks. This server requires an external account and is available to
only the SAS Administrators group.

When I select SASApp as the server the libraray should be allocated to and then use SASDemo as a workspace sever login it works. Have I done something bad by using SASApp now for the library in Olap Studio???
I find it so confusing to understand. It says it requires an external i.e. Windows Admin account
BUT is only available to SAS Administrators (Internal) ?

[Technolero]

You want all of the work being done on the application server tier, so SASApp would be workspace server to use. Workspace servers require authentication using an external account, that is why the connection using sasadm@saspw won't work. It is an internal account. Internal accounts are only known in SAS metadata. External accounts can be known in SAS metadata and to the operating system host (or other authentication provider). During installation, sasdemo is created in metadata as as well as in the authentication provider (e.g. host, active directory, ldap), so that is why it is successful.

See SAS® 9.2 Management Console Guide to Users and Permissions at http://support.sas.com/documentation/cdl/en/mcsecug/61708/PDF/default/mcsecug.pdf for more information about internal and external accounts.

[metalray]

Hi,

Thanks for the response and the link.
It makes it clearer.

Now, my sasvm\sasdemo is defined as an external account in the Management Studio User List
and it has the rights SAS General Servers, SAS System Services. No internal account sasdemo@saspw
exists.

That means SAS knows about the Windows Admin sasvm\sasdemo and if I give this admin
the rights "SAS Administrators" he/she can also create the physical OLAP cube.

Boy..., this is all so confusing. A non-internal (non-SAS) user that can access metadata and build physical cubes
in SAS OLAP Studio.

Why has sasdemo not been created as a internal user? Because we dont need him/her to
muck around with metadata? -but it is required to build the OLAP cube ("SAS Administrators") right?

[metalray]

Thanks for the clarification and the link.

I now have sasvm\sasdemo demo in the Management Studio User List as a external user with no internal account. Having rights to "SAS General Servers" and "SAS System Services" but ONLY if I give the rights to "SAS Administrators" as well, the user can build the OLAP cube, why is that?

I have a non-internal SAS user that has the rights to "SAS General Servers" and "SAS System Services".

[AngelaHall]

The user still needs to have access to create/edit the OLAP Cubes. This includes both the metadata location as well as the Cube Folder structure on the physical system.

For an additional tip on updating the default security for OLAP within Metadata check my blog post: http://sas-bi.blogspot.com/2010/01/getting-olap-cube-building-to-work.html

For the physical folder structure is defined in the first screen for creating an OLAP cube in the option 'Physical cube path:'. The user must have WRITE access to this folder structure.

~ Angela Hall
http://sas-bi.blogspot.com

[metalray]

Thanks Angela. Your blog is great. Is it not dangerous having an external user that has full meta data administration rights? (just to build olap cubes)

[AngelaHall]

Thanks for taking a look at my blog.

Please note that I never ever ever stated that all external users should have full metadata admin rights. In order to build cubes, you must have rw metadata access on the OLAP Schema. In SAS 9.2 you will find this and only modify this object to allow either a group of users to have rw metadata access. This is far from granting everyone admin rights. The last paragraph in my blog post details how to locate only the OLAP Schema and change the properties for that element.

I would recommend taking a look at the Security Administration Guide:
http://support.sas.com/documentation/cdl/en/bisecag/61133/HTML/default/viewer.htm#/documentation/cdl...

~ Angela
http://sas-bi.blogspot.com

[metalray]

Thanks Angela. I was able to view the cube and after giving the "OLAP Creator Group" also permission to the parent folder they were able to rebuild the cube.

[metalray]

I followed your advise and added a "OLAP Creator Group", put the user internal JohnSmith in it
the group also has the windows admin SAsvm\olapcreator as an external users assigned - so all group members
can create the physical cube)

Then I went to the Resource Manager and gave the group read/write access to the olap schema.


Unfortunately, The user JohnSmith was not able to log into the metadataserver (upon the start of cube studio) nor to
build the cube (second login prompt comes: no host credentials to start sasapp - workspace server*)


*altough I added an external windows admin account to the group the user is part of