Das met die log-files ist eine gute. Die standard weise mit SAS datasets fur logiles wird jeder parallel bearbeitiung einer job frustrieren. Besser ist ein eigener vortgang wie es geht gut entwerfen.    ... View more

Die "R�ckgradverkr�mmung" fremde karakter sind in utf-8 angedeutet as replacement karakter. Mit Wlatin1 geht es um einzele-byte nur die decimal order karakter 32 - 127 sind gleich in utf-8. utf-8 benuts 1-4 bytes für eine karakter. Klar ist das die transcoding zwischen die unterschiedliche encodings nicht gut gegangen is. Das einfachste wurde ein sas session utf-8. Eguide ist utf-8 aber nicht die sas-session.  https://blogs.sas.com/content/sgf/2017/05/19/demystifying-and-resolving-common-transcoding-problems/   ... View more

Wenn es sich um eine DBMS-Datenbank handelt, stellen Sie sicher, dass die Schlüssel vom DBMS verarbeitet werden können. Wenn Sie versuchen, die Schlüssel in SAS zu konvertieren, bringen SQL-Einschränkungen alle Daten auf den SAS-Computer. Die Leistung der Verarbeitung wird durch die Übertragung von Daten drastisch beeinträchtigt. Wenn es gelingt. Bei kleinen Dateien, bei denen alles in den Speicher passt, reicht jeder Code aus, der funktioniert. ... View more

Meine Entschuldigung mit die link, wird nachschauen.   Die Mapper kommt normalweise mit SAS Depot mit.  Ein lokale Installation macht es möglich alles darauf zu setzen. Die Verarbeitung mit XML ist offen nicht bekannt und dann passiert es das es nicht dabei installiert ist. Die SAS deployment manager ist dat Installation Programm das alle teilen die Software Installation organisiert.   Ihren link ist ein anderen Möglichkeit. Ich sehe  Linux und Windows Versionen. Ohne etwas vom SAS auf eine Rechner zu haben soll es damit auch gelingen ein map file zu generieren. (SAS UE).   Das Profess ist ziemlich einfach wenn die XML Datei einfache Strukturen hat.   1/   XSD (ein Metadaten Beschreibung des XML im XML Struktur) oder        XML ,  die Datei benutzen als Beispiel. Special Aufmerksamkeit für Ausnahmen benötigt 2/ Mit die MAP-file das XML File verarbeiten mit Resultat ein SAS dataset.         Angesehen das das Resultat ein SAS-dataset möglich ein Teil des originalen XML ist, ist zurückschreiben nicht möglich        ... View more

Es sieht aus das die XML met vbs im html umgesetzt wird,   XML aufbereiten ist am einfachsten mit die mapper. https://documentation.sas.com/?docsetId=engxml&docsetTarget=p1cji2td43rru1n1wi0c3a6n0q9f.htm&docsetVersion=9.4&locale=en  Mit die mapper bekommen sie auch die LIbname xml code und mapfile.    14/3 Die link Functioniert bei mir.  SAS® 9.4 XMLV2 and XML LIBNAME Engines: User’s Guide s Guide What Is SAS XML Mapper? SAS XML Mapper is an XMLMap support tool for the XMLV2 and XML engines. Based on Java, SAS XML Mapper is a stand-alone application that removes the tedium of creating and modifying an XMLMap. SAS XML Mapper provides a graphical interface that you can use to generate the appropriate XML elements. SAS XML Mapper analyzes the structure of an XML document or an XML schema and generates basic XML syntax for the XMLMap. The interface consists of windows, a menu bar, and a toolbar. Using SAS XML Mapper, you can display an XML document or an XML schema, create and modify an XMLMap, and generate example SAS programs. SAS XML Mapper Application     Importing an XML Document with Numeric Values This example imports the XML document Precision.XML, which was exported in Exporting Numeric Values. This example illustrates how you can change the behavior for importing numeric values. The first SAS program imports the XML document using the default behavior, which retrieves parsed character data (PCDATA) from the element: libname default xml 'C:\Output\precision.xml'; Ein blog: https://blogs.sas.com/content/sgf/2016/06/24/tips-for-reading-xml-files-into-sas-software/   ... View more

Es gibt mehrere moglichheiten wie ein parallel process gestartet wird -  SAS/Connect  (lauft auf server) -  SAS Grid (lauft miet mehrere servers)   Einiges wird beim installieren configuriert es geht um die software auf die server .   Das manul (leider english);   http://support.sas.com/documentation/cdl/en/etlug/67323/HTML/default/viewer.htm#n01x9nu3lsgx7ln13dddo03t2mdo.htm    Gibt es auch ein endloop im ihren flow? ... View more

David,  "it is perfectly and consistently clear that they to not recommend mixing code/data by the DI-developers in the same folders. And nor would I. I wonder what you can mean?" The Danish best practices is having a nice rule setting how to architect something.  But what is in the example (2009) is the organisation of the Danish office focussed on their structure. What happened in that time (210) as (not SAS) architects did not understand that difference to the client local situation is trying to copy (the example) and that organisation into the local situation. It was followed by subfolders as of step 1,2,3 of some development process actions and getting data and code artifact being mixed up. Having the requirements for release manager later getting a lot of growing exceptions.  The situation getting unsolvable as at some point far too much of exceptions being needed with unpredictable behavior.   Making a clear statement: determine local client requirements starting with security of artifacts not working with tools would solve a lot. I see you are in that direction, we can agree on that. .      "However, which one is used is undefined. It is deterministic: it is always the same one, of you connect multiple times - so it is certainly not random."  That was the key behavior as previous described  deleting and adding the same definitions was showing that. I am indicating it as random as at the moment someone is updating that (delete/adding eg groups) and it is not getting the same results as the internal order is different. It realyy happened that way ne department new group name and …. .  I my first case it was on folder access and as far I am remembering it in the inheritance of subfolders with multiple access right groups in the same distance but with different rights and there were different denies added as argument for auditing being more clear. In the second one also many organisational groups and is this one global tool roles mixing up access rights allow and denies on the same distance. (because you are Eminer / Eguide / DI user you have right to and not) Because you are part of that and that department getting access right to .. and not to ..   I would like to reinvest such things again but as not having the needed access rights now (admin rights local isolated SAS environment) it is for the time being not possible. For some surprise experienced some time: adding authdomains by some normal user (login manager) should that be possible? The DI failed access needing too mucht richts was at 9.1.3 and was confirmed by sas support, should be fixed now.  At that moment and existing user could work on folders getting more restricted a new user crashed on security. Only after a first login with higher admin levels at the user it worked thereafter it could set more restricted again. No change on folder security in between was done. The only conclusion is some invisible administration was done at the first usage.                                                ... View more

Well Paul SAS metadata is not that long present as being working in IT and SAS (technical based) far longer as that. The most difficult things is getting data information security according policies wheras the ISO27002 is the challenging but basic one. Do you have those references?  As there we go. The need is building an environment whereas all this with code/business logic and data should well seperated for daily business usages and at the same time release-management (code promotions version controlled) . And  data manipulations by somebody else being prepared (segregation of duties).  The testing should be done that all needed access is granted and time the required denies should be active. Even the famous Danish "best practice" never getting correct as of the mixing of code/data by the DI-developers grouping ignoring those other activities. This may be the whole issue as the random security behavior was always in that settings. I cannot create an example of that as not having acces at that level now. Mu question: Do you have that kind of structures to that level of compliancy (Iso27002) underpinned and audited?   Som frustrations from the past: - The dynamic prompt random behavior was nicley replayable but even with that shown to SAS staff they still not seeing the issue.   That was a result of parallel testing multiple goups of persons sharing logic but wiht segregated data to be chosen as option.  - Getting the shared server to work on Aix it was working at first sight well (user/password checked) that found by surprise that without password all was accepted. Surely not the way but the only answer "upgrade to the next release" (still  B at that moment).                ... View more

Michael, yep that is the terrible thing we struggled quite a lot on that. The updates time-outs on the OS and the SAS were done seperately not aligned to each other. The pw checking was calling the OS and the OS being redirected to LDAP (AD) for only normal users as service accounts being local. When this is also you case testing / validating will get more easy. Have at least two accounts availiable. One being getting locked and at every attempt increasing the time (accumulating). The other as normal user just logging in an measuring the time in responding for normal usage. Having a test for infra validation of a sas installation available you can try those settings in the sasauth.conf on that scenario changing values and just replay the user-locking and changing passwords. That environment should be very similar to the real one. A stand alone one on a desktop will not do that job.          ... View more

Michael, with the omaconfig you have reviewed the internal account definitions With that you can validate passwords against LDAP/Kerberos/AD but there is no immediate connection to the OS security itself. It is a kind of working in ignoring security at het data/os-level and combine those to a shared grouped account that is maintained and owned by SAS. I hope SAS institute is not responsible or if they are. Anyway that way of working should be described well as losing auditablity traceablity by normal tools for that. --- high profile user, hurts ----   For unix security technical way of working, there are many options: http://support.sas.com/documentation/installcenter/en/ikfdtnunxcg/66380/PDF/default/config.pdf review PAM / sasauth. Getting into LDAP/AD depending on the size of the company there can be many LDAP/AD servers. Updating the password in a windows environment and expecting it immediately active can be frustrating. At windows you get the immediate response of the update password as you are being connected to that one. https://blogs.technet.microsoft.com/kenstcyr/2008/07/05/understanding-urgent-replication/   Normally it should be implemented well but you never know. There is an other weird behavior of the sasauth module. It is that module checking the password while runnig at root-level. What will happen when validating a user/password  combination when there are delays/lock wait policies being activated at the AD origin. Will the user account behave als normal Windows or will there happen something different? The latter having seen happening. Trying a locked out user several times and the delay time went ever up never being reset by a correct login. You must be very patient and confident to see the login happening after an hour or so.                  ... View more

You don't mention ACEs in the proposal, but given you say your ACTs only grant, I am assuming an implied use of ACEs to deny permissions (to PUBLIC or SASUSERS) when you need to hide/protect folders. Is this correct? Yes they are the exceptions to do at a high level as possible so no need to adjust them afterwards. The default installation is/was open for public/guest by default causing real security audit issues.   However any access controls on the parent will still have an indirect effect. Without any direct access controls on the subfolder, the effective permissions on the subfolder will be the same as the parent folder (except for any potential WMM on parent > WM on child related differences). I am sorry, but real life experiences (9.4m3 latest) seen this not being true. Not anything set at subfolders and behaving differently wiht a far too complicated setting on the parent   There is no random effect. When there are conflicts the outcome is determined. It might appear to be unpredictable without a full knowledge of the implementation and precedence rules. I left a detailed situation example away because it is rather complicated. But here it comes. Suppose the conflict is in the "closest group" access ones, there is no clear definition order of that.  Also this one real life experience and only being proven by removing and adding exactly the same rules in a different order. The same kind of pitfall experienced by the way with dynamic prompts. When the library and you have several different of those for different apps-servers and the prompt is searching the app-server the app-server selection is by-passed and the first in a technical order is opened, No problem when there is only one app-server and one library definition but with parallel groups you get surprised.      ... View more

https://www.owasp.org/index.php/Security_by_Design_Principles  There are lot principles for security in that. “The need for application security in the form of security architecture is every bit as great as in building or bridge construction.” I would like to start with one I propose and than going to what is often happening.   My proposal: - start with a folder structure categorization (containers) on projects/applications - Within those containers segregate on the artifacts like Jobs(DI) Tabels(DI) Miner (models and the pointers to the externals stored EM projects) flows deployedjobs etc. - When there is some information flow that needs segregation within that project define additional folders.   This can happen in data science projects having different flows for delivering the data as  modelling purpose or as scoring purpose.    In the latter one there is some parallel development in cooperation to solve. - Having all those folders define for each two ACT definition one for read-only purpose and one for updating maintenance. - Having the ACT’s only giving grants and never denials. - As last:  never (only some exceptions) define access for users or groups by explicitly on those folders/resources only do it by maintaining the rights by groups membership at the ACT’s. For the high privileged accounts (project limited least privileges) it can be dedicated non personal accounts.   The result: - a very simple way to implement maintain. - I can’t see any mistakes or confusions when strictly doing this.   The challenge to explain to others is that obviously hidden layer by ACT’s. Another challenge is the an additional clear need for the sponsor / line of business as it not visible in this concept. Heaving multiple line of business sharein something is no issue at all as those groups can mentioned in the ACT’s        The common approach I often seeing.      - start with folder structure naming the lines of business unit. - put all kind of different artifacts mixed in some folders. This is a result of following the ownership named conform the business-line - have the smart IT add some denials/ grants named like DI-developer Modeler or whatever.   The result: - The complexity is becoming a headache as     . requirements of securing artifacts are coming in.     . additional business lines are also allowed to use some parts, security to be changed    With this the temptation of using explicit ACE’s on each folder/artifact is that is going to be used. The first will look to be working and more will come in adding more complexity as humans are able to understand.       In the last situation: Now add some  subfolder or going to move some things. Look at the precedence the settings explicit have priority on the ACT’s an the inherited. In the new folder everything is inherited there is no automatic copy of all ACE’s. The new folder is seeing groups like Act’s and all stuff as inherited the on the Item box is vanished.   Will the security give the same results?   An other is having this one:  “then the access control for the group the user is more closely a member of will win” Having conflicts in right that are as equal in distance there will be a random affect (unpredictable undefined outcome). I have seen this kind of issues in real life even more weird ones. The owasp never got really to life   ... View more

In this approach there is a major pitfall, those are: -The ordering of security settings is easily different as of the setting on the item (artifact) explictly or being inherited. - outsmarting some nasty and dumb expected grouping on items work by adding roles and other levels will make it worse. When the security and/or work for promoting is very complicated most likely the grouping and ordering of artifacts ha been done in a wrong way. In that case the advice should be redesiging that area. I like the concept of using only some ACT's protecting grouped way of artifacts of the same security classification and same security rights. There is no problem on then number of ACT's (well designed naming convention) or is there. So what is the issue sticking to that?        ... View more

Geht es um ganz schnell mit wenig system belastung information uber tabellen ansichtlich zu machen dan: - schau mal an attrn/atrrc fucntionen. Die greifen am tabellen information selbst an.   http://support.sas.com/documentation/cdl/en/lefunctionsref/69762/HTML/default/viewer.htm#p12uchp7hm5h2zn1om2ut816af7h.htm - Mit externe DBMS tabellen ist ein count(*) ohne etwas zu filteren sehr schnell weil es das dictionary.tables benutz    Accessing SAS tabellen und external dbms tabellen wirden schrecklich langsam.   http://support.sas.com/documentation/cdl/en/lrcon/69852/HTML/default/viewer.htm#p00cato8pe46ein1bjcimkkx6hzd.htm ... View more