Previous Page | Next Page

Permissions on Servers

Hiding Server Definitions

Initially, all registered users can use almost all servers. In general, the SASUSERS group has the ReadMetadata permission on all server metadata.

Note:   The logical workspace server within the SASMeta application server has limited availability. This avoids the potentially confusing situation in which a regular user is offered the SASMeta server context in applications such as SAS Enterprise Guide. SASMeta should be used only as instructed in a few specialized administrative tasks.  [cautionend]

These initial settings are appropriate until you want to allow only certain users to use certain servers. Here are some reasons why you might choose to limit use of a server:

If you choose to limit use of a server, preserve access as follows:

To efficiently set the permissions, create an access control template (ACT) that includes the core grants and denials that you would use when you hide any server. To enable selected users to use a particular server, supplement the ACT settings with a grant of ReadMetadata permission on that server. The following instructions explain one way you can set these permissions:

  1. Log on to SAS Management Console as a member of the SAS Administrators group (for example, sasadm@saspw). Select the Plug-ins tab.

  2. (Optional) To examine the current settings:

    1. Expand Server Manager, right-click the server or server component that you are limiting use of and select Properties.

    2. On the Authorization tab, select SASUSERS. Notice that this group (which includes all registered users) has ReadMetadata permission. The application server inherits the grant from the standard repository-level settings. Click OK to close the dialog box.

  3. To create the ACT:

    1. Expand Authorization Manager [icon], right-click Access Control Templates, and select New Access Control Template.

    2. On the General tab, enter a name such as HideServer.

    3. On the Permission Pattern tab, define general settings for hiding servers:

      1. Click Add. In the Add Users and Groups dialog box, clear the Show Users check box. Move PUBLIC, SAS Administrators, SAS General Servers, and SAS System Services to the Selected Identities list box and click OK.

      2. On the Permission Pattern tab:

        • Select PUBLIC and add a denial of ReadMetadata permission.

        • Make sure that the other three groups each have a grant of ReadMetadata permission.

        The HideServer ACT
        Group Permission Pattern1
        PUBLIC Denial ReadMetadata
        SAS Administrators Grant ReadMetadata
        SAS General Servers Grant ReadMetadata
        SAS System Services Grant ReadMetadata
        1 Gives SAS Administrators and service identities exclusive read access to metadata.

        This pattern, when applied to a standard workspace server, grants a little more access than is strictly necessary. For a standard workspace server, the SAS General Servers group doesn't need ReadMetadata permission. If you want to avoid this, consider omitting the SAS General Servers group from this ACT and remembering to add an explicit grant for this group when you are hiding a stored process server or pooled workspace server.

    4. On the Authorization tab, protect the ACT that you are creating. Either apply the Protect ACT or add explicit [check box white] settings that deny WriteMetadata permission to PUBLIC and grant WriteMetadata permission to the SAS Administrators group.

      Note:   If the Users and Groups list box on the ACT's Authorization tab is empty, click OK to save the ACT. Then, right-click the new ACT, select Properties, and select the Authorization tab again.   [cautionend]

    5. Click OK.

  4. (Optional) If you don't already have a group that represents the users who will use the server, create a new custom group.

    1. Right-click User Manager [icon] and select New [arrow] Group.

    2. On the General tab, enter a name such as GroupA.

    3. On the Members tab, move users (or groups) to the Selected Identities list box.

    4. Click OK to save the new group. You will grant ReadMetadata permission to this group in step 5c. This group doesn't participate in the general pattern because this group doesn't need ReadMetadata permission on all servers.

    Note:   As an alternative to creating a group for only this purpose, you can skip this step and instead assign the permissions directly to specific users in step 5c.  [cautionend]

  5. To set the permissions:

    1. Under Server Manager, right-click the server that you are limiting use of and select Properties.

    2. On the Authorization tab, click Access Control Templates. In the Add and Remove Access Control Templates dialog box, move the HideServer ACT to the Currently Using list box (you have to expand the Foundation node to get to the ACT). Click OK to return to the Authorization tab.

      Note:   If the Currently Using list already includes another ACT (such as the Protect ACT), don't remove that assignment.  [cautionend]

      Note:   Review the revised settings. Notice that SASUSERS is now denied ReadMetadata permission and that PUBLIC and SAS Administrators have some green settings [green check box]. The green settings come from the HideServer ACT.  [cautionend]

    3. Click Add, add one or more identities to the Authorization tab, and give each of those identities an explicit [white check box] grant of ReadMetadata permission. For example, you might assign the grant to a group (such as GroupA) or to individual users.

    4. Click OK to save the settings for this object.

    For example, the following table summarizes settings that you might add to provide mutually exclusive access to two server components beneath a standard workspace server that is configured for SAS token authentication:

    Example: Hiding Server Definitions
    Object Added Settings1
    ACT Supplemental Grants
    [icon]SASApp - ServerA [icon]HideServer [icon]GroupA: +RM
    [icon]SASApp - ServerB [icon]HideServer [icon]GroupB: +RM
    1 These settings don't determine which of the users who can see the server can also update or delete the server. See the preceding topic, "Protecting Server Definitions."

    Note:   Someone who has ReadMetadata permission for both ServerA and ServerB (for example, members of the SAS Administrators group) uses the first server in the object spawner's list of servers.  [cautionend]

  6. If you are limiting use of a logical server or server component, ensure that the Use Server Access Security check box on the logical server's Options tab is selected. If the check box is present and not selected, requirements for ReadMetadata permission for that server and its components are not enforced. This option affects only enforcement of the ReadMetadata permission.

    Note:   User access to a client-pooled workspace server is determined by the user's puddle group memberships, not by permissions on the server definition.  [cautionend]

See Also

Host Access to SAS Tables

Choices in Workspace Server Pooling

Protecting Server Definitions

Previous Page | Next Page | Top of Page

Copyright © 2011 by SAS Institute Inc., Cary, NC, USA. All rights reserved.