Hi,
If you just need user administration permissions, and not be full administrators (aka, not being part of the SAS Administrators group or being Unrestricted):
- If you need that user to be able to administrate all user accounts and groups, following some best practices:
- Create a group as (SAS User administrator)
- Add the user to this group
- Provide this group the Metadata Server: User Administration
- In case that this is still not sufficient, you can apply a deviation from the best practices (therefore, hopefully it should work with just the role): with an unrestriced account, provide full permissions to the "SAS User administrator" on the "/System/Security/Users" and "/System/Security/User Groups" folders.
An alternative, not recommended, but necessary on some scenarios:
- If you need that user to be able to administrate only some user accounts and groups:
- Create a group as (SAS Users administrator - Group A) - Where Group A stands for the set/batch of groups and users to be administrated.
- Add the user to this group
- Do NOT provide this group the Metadata Server: User Administration
- with an unrestriced account, provide full permissions to the "SAS User administrator" on only the "/System/Security/Users" and "/System/Security/User Groups" items this user wiill administrate.
PS, An additional remark: in an ideal world, you would neever require to administer users: the users can be on sync with your AD/LDAP authentication system with an script or Metacoda's plugin, and you need only to administer groups, no users.
PS2. If you want to really follow best practices, the permissions applied on folders for a groups of users, this has to be transformed into: ACT for this permissions (ACT Users Admin or ACT GroupA users Admin), add the group to this ACT with the Permissions pattern as you wish, then remove the group from Authorizations on the required folders, and add the ACT to Autorizations on the required folders, .
... View more
