Thanks Chris, Our needs are perhaps unique in that we have data from various sources that are made available to a wide range of users, and where our SAS administrators are a separate department from the IT department. In particular, many users need to carry out ad-hoc analysis, but, as administrators of the system, we would like to implement row and column level security in a way that does not necessitate coordination with our database administrator for the creation of accounts and database views each time. We need the ability to provide and revoke access in a timely and efficient manner, and trying to coordinate both metadata and host level security is complicated and prone to error. As for trusting our users, a signed statement is not often enough for custodians of sensitive data, where, it is not just the problem of inappropriate distribution of data, but inappropriate viewing. Denying a tool such as EG is really a drastic step when all we want to do is restrict access to data. I don’t think the system of mediated access makes it more difficult for the power user – indeed, by allowing access to what is a combination of complex and sensitive data in a mediated way – we allow those users the ability to carry out important analysis, whilst satisfying the requirements of the data custodians for security. Here there is a distinction between the developer, who requires host level permissions to create the content for other users, and the analyst, who requires access to data to then analyse. A mediated approach simply uses metadata objects such as Information Maps as the access point to data – from then on, the user can work in the ‘physical’ world. The disadvantage from the way SAS EG is set up is that, if they use information maps where a user does not have host permissions to the underlying data, they get that annoying error, as well as a much slower access time. Furthermore, they get to see all the libraries, connection details and table definitions that make up those Information Maps, even though, they don’t physically have access to them. My suggestion is a way around this. It seems that, from your email, that there is little emphasis in future releases of EG to encourage the use of mediated access, which, although understandable in regards to development effort required, is disappointing. I would be interested if other users have a similar issue where, they want finer control of data access for their analysts using SAS Metadata security, or that they find that SAS EG just allows to easy an access to their data to be useful. I would also like to know if anyone can see any security holes around the suggested mediated access approach. Thanks again Chris for your response. Nick
... View more
