See the blog post mentioned in this announcement, it will redirect you further to several articles and presentations useful for clarifying your goal : https://communities.sas.com/thread/78382 The default implementation of permissions - also called "Security Model" - in SAS metadata is quite liberal or all-inclusive: implicit groups (SASUSERS or even PUBLIC) are granted almost every permission, perhaps even WM (WriteMetadata) on root Folders. Its a kind a compensation for a hierarchy of security rules based on "No explicit rule equals Denial applied by default" . If no explicit grants were allowed to SASUSERS or PUBLIC, then at the first launch after installation, there would be a complete deadlock which would require either to create new (explicit) Groups , grant them permissions (the best approach but tedious) or grant rights to implicit groups SASUSERS or PUBLIC at once (unsafe but easier to handle). You would like to implement a more restrictive (=safer) Security Model based on explicit permissions exclusively granted to accounts already registered in metadata. Go ahead, that's the best way to go imho. This would require a more lenghty process of drafting your specifications, identifying your group memberships beforehand, assigning common resources (servers, folders, SAS clients) to specific groups , creating custom Roles etc., in short : customize your Security Model . Personally, I was able to go all the way to an "ex-ex" exclusively explicit Security Model back in 9.1, even Denying basic ((ReadMetada) permissions to SASUSERS in the default permission set (Foundation default ACT). But, unfortunately, I wasn't able to do it in 9.2 and 9.3 so easily. Inheritance rule prevented me to block SASUSERS altogether because of (1) the unified hierarchy of folders where the SASUSERS permission assigned at the folder root level ( Authorization Manager / Ressource / By application / SAS Folder) cannot be fully controled and (2) the Content Server counterpart hierarchy, root folder, requiring specific additional assignments ... I'd be very much interested if anyone had much success "squaring the cycle" in 9.3 or 9.4. :smileyconfused:
... View more
![SASGF 2020 [Virtual] Attendee](/html/@A53A708409112314CE528E074D4C8C1F/badge_icons/badge_sasgf20_attendee.png "SASGF 2020 [Virtual] Attendee"){kind=icon}
