Users, Groups, and Roles

Group Definitions

Groups [icon] are primarily used in permission assignments. You can also use a group to populate a role or to make a shared credential available to multiple users. The following figure illustrates how the users in the previous topic might participate in a group structure:

Example: Users in a Group Structure

[Example: Users in a Group Structure]

The following table introduces three important predefined groups:

PUBLIC, SASUSERS, SAS Administrators Groups
Group	Description
PUBLIC	A standard group with implicit membership. This group includes everyone who can access the metadata server, either directly or through a trust relationship. A user who does not have an individual identity uses the PUBLIC group identity.
SASUSERS	A standard group with implicit membership. This group includes those members of the PUBLIC group who have an individual identity. All members of the SASUSERS group are also members of the PUBLIC group.
SAS Administrators	A standard group for metadata administrators. In a standard configuration, members are granted broad access and administrative capabilities, but aren't unrestricted.

The following list and display highlight important details:

The Groups and Roles tab enables you to create a nested group structure.
The Accounts tab is often blank for a group. An entry on a group's Accounts tab makes a shared external account available to all members of the group. Such logins typically provide access to a third-party database server and should include both a user ID and a password. See How to Store Passwords for a Third-Party Server.
A group's Authorization tab does not determine what that group can do. This tab can affect the ability of other users to modify or delete this group.

A Group Definition

[A Group Definition]

	Identity Precedence
	Differences Between Roles and Groups
	Who Can Manage Users, Groups, and Roles?