Create Metadata User Definitions :: SAS(R) 9.3 Intelligence Platform: Security Administration Guide

Add Regular Users

For accountability, we recommend that you create an individual SAS identity for each person who uses the SAS environment. This enables you to make access distinctions and audit individual actions in the metadata layer. This also provides a personal folder for each user. To create a SAS identity for someone, store a copy of the person’s user ID in the SAS metadata.

Each user should have at least the following attributes:

a name that is unique among users within the metadata server.
a login that includes the user's external account ID. This might be any type of account that is known to the metadata server's host (an LDAP, Active Directory, host, or other type of account).

Note: For a Windows account, specify the user ID in an appropriate format. See Windows User ID Formats.

Note: If your site uses Web authentication, you might assign logins to a different authentication domain.

Here are some details and tips:

If the workspace server is on Windows, give anyone who accesses that server using credential-based host authentication the Windows privilege Log on as a batch job.
As an alternative to adding users interactively, you can batch import users from a provider such as LDAP into the SAS metadata.
The metadata server maintains its own copy of each ID, but doesn't keep copies of passwords for identification purposes.
Registered users automatically belong to PUBLIC (everyone who can access the metadata server) and SASUSERS (those members of PUBLIC who have a well-formed user definition).
A user who doesn't have a well-formed definition has only the PUBLIC identity. In the standard configuration, a PUBLIC-only user can't access any resources. Not all applications allow a PUBLIC-only user to log on.
Authorization settings within a user definition do not determine what that user can do. Those settings affect the ability of other users to update or delete that user definition.

Add Administrators

For accountability, we recommend that you establish individual metadata administrators rather than sharing the unrestricted SAS Administrator account.

Each administrator should have at least the following attributes:

a name that is unique among users within the metadata server
either a login (as explained in the preceding topic) or an internal account
membership in the SAS Administrators group

Here are some details:

If you log on with an internal account, you must include the @saspw suffix in the user ID that you submit (for example, sasadm@saspw).
We recommend that you use an administrative identity only to perform tasks that require a high level of privilege.
The advantage of using an internal account is that this facilitates creation of a dual user, because this approach leaves the user's external account available for use in a second user definition. A disadvantage of using an internal account is that such an account can't launch a standard workspace server. These administrators are prompted for host credentials if they attempt to validate or use that server.

Add Dual Users

To enable someone to alternately function as an administrator and as a non-administrator, create two user definitions for that person as follows:

One definition is based on an internal account and is a member of the SAS Administrators group.
The other definition is based on an external account and is not a member of the SAS Administrators group.

Here are some tips for working with a dual user:

The only way to make someone a dual user is to give that person two user definitions, each based on a different account. You can't create a dual user by adding a login to a definition that already has an internal account or by adding two logins to one definition.
A dual user should use a dedicated client-side connection profile for their internal account. In that profile, the user should leave the Authentication Domain field blank. This optimizes credential reuse.
A dual user should log on with their internal account when they need administrative privileges and with their external account the rest of the time.

Create Metadata User Definitions

Add Regular Users

Add Administrators

Add Dual Users

See Also