thanks Paul. The test shows the renaming is still robust as regards associations. I can understand the uniqueness constraint on the User (Person) object name because the object might be linked to different sub-systems therefore uniquely defined : 1. Metadata personal folder's name 2. Content server (WebDAV) corresponding pathname 3. Report's authoring (Responsible party) 4.Comment's ownership (id. ?) 5.Audit/performance/usage trace as stored in the SAS Web Infrastructure Platform Data Server (?) ... But the uniqueness constraint also inexplicably applies  to Groups/Roles names : that's a regression from my point of view because those are not fine-grained 'atomic' objects like users but on the contrary, higher level 'storage' objects.This new requirements means you cannot  change anymore your security model on-the-fly using the SMC User manager, groups & roles names must be carefully planned beforehand. Great.:smileyplain:. ... View more

Thanks for the solution. There are new uniqueness constraints beginning with SAS 9.4 enforced by the SMC User Plug-in : http://support.sas.com/documentation/cdl/en/bisecag/67045/PDF/default/bisecag.pdf You cannot change the name of an existing user, group, or role in SAS Management Console. You can change the display name. :smileyshocked: . so now, back to the metadata data step functions or even proc metadata queries in order to update a simple Group or Role's name ? ... View more

Very puzzling, indeed and illogical at first guess :smileyconfused:. The only way I can think of to get a Read-Only pane in the User Plug-ins logged in with unrestricted privileges would be to have selected the user inside the Members tab of a Group properties windows by clicking on the 'Properties' buttton. This button would then open a second window wich looks almost exactly like the User individual object selected from the User plugin list, except it is a (Read-Only) glimpse on the user's properties. 1.select MyGroup then display Members pane, select a user in the list and click on Properties 2. User properties windows is obviously (Read-Only) as suggested by the title, the attributes are greyed out accordingly Have you tried selecting the user directly in the SMC plug-in or indirectly like the method above ? ... View more

I confirm Peter's most useful post on all and every points : 1) ?CSIDL_PERSONAL on Win 7 resolves to the location of "My Documents" which is sometimes synchronised with a network share (My Documents Synchronized vs My local Documents) 2) the system synchronisation process might conflict with the SAS session updating SASUSER content, especially SAS profile catalog, SAS registry (itemStore) or Template Store. 3) changing ?CSIDL_PERSONAL with ?CSIDL_PROFILE seems like a functional workaround 4) unfortunately Windows Companion Guide 9.2 doesn't include the slightest reference to ?CSIDL_PERSONAL or %USERPROFILE% dynamic environment variables set up for SASUSER location 5) During the very first steps of SAS Windows launching process (eg Scope = Kernel), for instance when the SASV9.cfg is loaded, as a general rule no system environment variable can be expanded with the exception of !TEMP  (= %TMP%) or ?CSIDL_<suffix> . It begins further at the Autoexec or Initstmt levels. Furthermore SAS option value based on dynamic resolution (ex.  -OPTION "&macrovar" , OPTION "%sysget(SYSTEMVAR);) might vary from one option to another . Run proc options with the DEFINE statement to know about it : Proc Options option=<option name> define; run; SASINITIALFOLDER= Option Definition Information for SAS Option SASINITIALFOLDER     Group= ENVFILES     Group Description: SAS library and file location information     Description: Sets SAS's initial working folder. Also changes initial folder of Open and Save                  As dialog to be current working folder.     Type: The option value is of type CHARACTER           Maximum Number of Characters: 260           Casing: The option value is retained with original casing           Quotes: If present during "set", start and end quotes are removed           Parentheses: The option value does not require enclosure within parentheses. If           present, the parentheses are retained.           Expansion: Environment variables, within the option value, are not expanded     When Can Set: Session startup (command line or config) only     Restricted: Your Site Administrator can restrict modification of this option     Optsave: Proc Optsave or command Dmoptsave will not save this option Incidentally, I locked my SASUSER folders more than once because of this and I had to use Sysinternals "Handle" utility to identify the low level SMB/RDP  process involved in the system sync. Even ProcessExplorer (with local admin privileges) could not display the system process Ids.:smileyplain: The CSIDLs dynamic variables are supposed to be deprecated with Vista. They are closely linked to the registry keys stored at : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Meanwhile, starting in 9.4, SAS recommends using new System environment variables for the SASUSER library: 50713 - The SASUSER default location has changed in the SAS® 9.4 sasv9.cfg file for Windows operating environments ... View more

I agree. This can work but this requires also that the same server hostnames referenced in metadata are resolved distinctly - using aliases (?) - inside each environment. ... View more

Unix versions of SAS Metadata command-line utilities, at least up to the 9.3, are coded using Java Spring framework (I have been told). Therefore on Linux/Unix, they require a graphic dummy adapter like Xvfb to run in an headless terminal (eg batch, cron, nohup). On a Red Hat Linux machine (RHEL 5), we use xvfb and this works fine. Install first the Xvfb package. On a RHEL 6 server with a 9.3 metadata server, I did a few tests using xvfb-run command, which seemed to work also (as far as I can remember : it's been quite a while). #!/bin/sh # test rMetadata batch import/export # Syntax : <script> <user> <pwd> xvfb-run -a /tools/list/sas93/SASPlatformObjectFramework/9.3/ExportPackage -host xxxxxxx -port 8561 -user "$1" -password "$2" -domain ldap -package "/home/xxxxx/package_test.SPK" -objects "/p5/Libraries" xvfb-run -a /tools/list/sas93/SASPlatformObjectFramework/9.3/ImportPackage -host xxxxxxxxx -port 8561 -user "$1" -password "$2" -domain ldap -package "/home/xxxxxx/package_test.SPK" -target "/" -noexecute ... View more

Please, try to provide some more extracts from your MDUCHGLB_FAILEDOBJS table : - do you spot any LDAP objets attributes (Name, ID, Description etc.) having "unexpected" values ? For instance, using this synchro code, I had an issue once dealing with Description fields values (extracted from the LDAP directory) which had (balanced) single quotes inside the string (Desc= Profile 'Developers'). This caused a large havoc in the metadata XML request generating code since the code did not protect enough the attributes values (XML attributes use single quotes as boundaries). BTW, to enable the debugging logs in verbose mode, I had to modify some of the Macros : if you run your code on a Unix/Linux machine, be aware that these technical logs rely only on a backslash delimiter for files location and were tested on Windows only ... :smileyplain: Another thing : - in metadata, in the SMC User Manager, have you checked the synchronized objects - Users AND/OR Groups or Roles "External Identity"  associations ? More specifically, if you click on "External Identity", do you see any "Identifier" value ? or is it still empty ? ... View more

It depends. If your requirement is to terminate "inactive" sessions("old" = "inactive" ?)  then you could simply rely on SAS time-out values : Stored Process or Pooled Workspace sessions are supposed to be closed automatically when the time out limit has been reached (30 minutes by default on 9.2 SAS EBI). However, if you want to kill any SAS web session, either "active" or "inactive" then that's a different matter. If you have SAS 9.3 or beyond then you could try using Procedure IOMOPERATE to list active user sessions meaning running SAS sessions like Stored Process or Pooled Wk server -  and stop them : http://support.sas.com/documentation/cdl/en/biasag/62612/HTML/default/n20000intelplatform00srvradm.htm If you want to terminate SAS Web sessions with no corresponding SAS sessions, then it depends on your implementation : J2EE Application Server like Jboss and/or front-end http Server like Apache could be accessed with different tools to forcibly terminate user sessions according to a set of given rules. ... View more