Passwords and encryption keys for a metadata-bound library are collectively referred
to as metadata-bound
library credentials. Prior to the third maintenance
release of SAS 9.4, when any of these credentials were modified, the
replaced values were immediately removed from the metadata. Sometimes
tables were not processed because another user was accessing the table.
Beginning with the third maintenance release of SAS 9.4, the credentials are retained
in metadata and can be used by the system to open data sets that were not modified.
This retention enables the user to continue processing tables and the administrator
to complete the modification of credentials. The retained credentials are purged if
a MODIFY statement that is processing all of the tables in the library determines
that all the tables
have been successfully changed with the credentials.
An administrator might
want to retain the credentials even after all the existing tables
have been processed successfully. The following are reasons for retaining
the credentials:
-
It enables processing of view files
that implemented row and column level security on underlying tables
by using the old passwords in the view definition. SAS does not know
which view files might contain the passwords and does not have the
ability to modify them in the view file. The administrator must redefine
the views with the new passwords.
-
It enables processing of data sets
restored from backups prior to the modification.
An administrator who wants to retain older credentials and not purge them can specify
the PURGE=NO option in the MODIFY statement.
Note: The administrator must specify
the PURGE=NO option in each MODIFY statement that processes all tables
until the administrator is ready for the replaced credentials to be
purged.
If a library contains tables that do not follow our best practices, automatic deletion
of old credentials might not occur when issuing a MODIFY statement for all tables.
For example, a MODIFY statement that changes the stored encryption key for a library
with optional encryption would not modify the keys of data sets
whose keys do not match the stored key. Because some data sets were not modified,
the old encryption key is not removed. In this case, the PURGE statement must be used
to remove the old credentials.
Note: Notes are written to the
SAS log whenever a metadata-bound table is accessed and the replaced
credentials are used to successfully open the data set. The Note identifies
the date and time that these credentials were replaced.