The SASMeta - Workspace Server should be used for only a few designated administrative tasks.
It is appropriate to defer validation of this server until you have set up the SAS users
who will perform these tasks. This server requires an external account and is available to
only the SAS Administrators group.
When I select SASApp as the server the libraray should be allocated to and then use SASDemo as a workspace sever login it works. Have I done something bad by using SASApp now for the library in Olap Studio???
I find it so confusing to understand. It says it requires an external i.e. Windows Admin account
BUT is only available to SAS Administrators (Internal) ?
You want all of the work being done on the application server tier, so SASApp would be workspace server to use. Workspace servers require authentication using an external account, that is why the connection using sasadm@saspw won't work. It is an internal account. Internal accounts are only known in SAS metadata. External accounts can be known in SAS metadata and to the operating system host (or other authentication provider). During installation, sasdemo is created in metadata as as well as in the authentication provider (e.g. host, active directory, ldap), so that is why it is successful.
I now have sasvm\sasdemo demo in the Management Studio User List as a external user with no internal account. Having rights to "SAS General Servers" and "SAS System Services" but ONLY if I give the rights to "SAS Administrators" as well, the user can build the OLAP cube, why is that?
I have a non-internal SAS user that has the rights to "SAS General Servers" and "SAS System Services".
Please note that I never ever ever stated that all external users should have full metadata admin rights. In order to build cubes, you must have rw metadata access on the OLAP Schema. In SAS 9.2 you will find this and only modify this object to allow either a group of users to have rw metadata access. This is far from granting everyone admin rights. The last paragraph in my blog post details how to locate only the OLAP Schema and change the properties for that element.
I followed your advise and added a "OLAP Creator Group", put the user internal JohnSmith in it
the group also has the windows admin SAsvm\olapcreator as an external users assigned - so all group members
can create the physical cube)
Then I went to the Resource Manager and gave the group read/write access to the olap schema.
Unfortunately, The user JohnSmith was not able to log into the metadataserver (upon the start of cube studio) nor to
build the cube (second login prompt comes: no host credentials to start sasapp - workspace server*)
*altough I added an external windows admin account to the group the user is part of