General Prefilter with SAS.PersonName :: SAS(R) 9.4 Guide to BI Row-Level Permissions

Introduction

This example subsets data in the SASHELP.CLASS table based on each requesting user’s name. The goal is to enable one user (UserA) to view only rows that contain information about females and another user (UserB) to view only rows that contain information about males. The example assumes that UserA and UserB already exist in the SAS metadata.

Map the Users to the Data

One way to define the relationships between users and data is to create a security associations table. For this example, you could use code like this:

data sashelp.rlp_class;  
   input PersonName $13. @14 Gender $;  
   datalines;
UserA F
UserB M
;
run;

Note: You must register the table in the SAS metadata in order to make it available for use in the information map.

Tip

As an alternative to creating a separate security associations table, you could add a PersonName column to the CLASS table. In this case, UserA would be the value in the female rows and UserB would be the value in the male rows.

Create the Information Map

In SAS Information Map Studio, create a new information map and insert the CLASS table and the RLP_CLASS table.
On the Design tab, move all of the columns in the CLASS table to the Information Map Contents panel. Do not move any columns from the RLP_CLASS table. Save the information map.
From the main menu, select EditPropertiesInformation Map. On the Required Tables tab, make RLP_CLASS a required table. Click OK.
On the Relationships tab, associate Sex in the CLASS table with Gender in the RLP_CLASS table.

Create and Assign the Filter

Select the Design tab. From the main menu, select InsertNew Filter.
In the New Filter dialog box, name the filter and then click Edit Data Item.
In the Edit Expression dialog box:
1. Select Character as the type of expression.
2. On the Data Sources tab (beneath the Expression Text box), under the Physical Data node, expand the RLP_CLASS table and select the PersonName column. Click Add to Expression.
3. Click OK to return to the New Filter dialog box.
From the Condition drop-down list, select Is equal to.
From the Enter values drop-down list, select Derive identity values.
In the table of properties, select SAS.PersonName.

Note: The values in the Examples column are derived from the currently logged-on user. These examples show how the value should appear in the security associations table. If the security associations table included user IDs instead of user names (for example, the values UserA@saspw and UserB@saspw), then you would select the SAS.Userid property instead of the SAS.PersonName property.
(Optional) At the bottom of the dialog box, expand Filter expression to review the criteria that you have defined. Click OK.
From the main menu, select EditPropertiesInformation Map.
On the General Prefilters tab, assign the new filter to the CLASS table.

Note: A prefilter is a mandatory filter that pre-screens and subsets the data in its associated table before any other part of a query is run.

Test the Filter

Log on to SAS Information Map Studio as UserA.
Open the information map. Select ToolsRun a Test Query.
Select all of the data items. You do not have to select the filter because you made it required.
Click Run Test. You will see only rows for females, because you are logged on as UserA.
Log on as UserB and verify that you see only rows for males.
(Optional) To test the filter in SAS Web Report Studio, open the information map as a report.

Note: If you log on as someone other than UserA or UserB, you will get no results, because you are not represented in the security associations table. The general prefilter affects access for everyone (even unrestricted users) if the data is accessed through the information map. However, if anyone opens the CLASS table directly, without going through the information map, the filter is not applied, so all rows are returned.