Self-Service Import :: SAS® Visual Analytics 7.4: Administration Guide

Introduction

Data imports that are performed in the designer, the explorer, or the data builder are referred to as self-service imports. This topic provides information to help an administrator support self-service imports. For user instructions, see the SAS Visual Analytics: User’s Guide.

Requirement: User Privileges

Individual data source-specific capabilities affect the availability of all self-service import actions. In the designer and the explorer, the Import and Load Data capability is a prerequisite for all self-service imports. For example, users who perform self-service imports from Oracle should have both of the following capabilities:
- Import and Load Data
- Import from Oracle
Self-service import actions load data to memory, so users must have appropriate metadata-layer access to the target LASR library, server, and folder. See Permissions for Working with LASR Tables and Servers.
Self-service import actions use a workspace server and a SAS LASR Analytic Server, so users must have appropriate host-layer access. See Host Account Privileges.

Note: Self-service imports require a workspace server that supports the job execution service. See Using Multiple SAS Application Servers.

Requirement: SAS/ACCESS

For most data sources, a SAS/ACCESS engine must be licensed, installed, and configured on the workspace server machine. For example, to perform a self-service import from Oracle, SAS/ACCESS Interface to Oracle is required.

Tip

After you add or renew a license, you must update the SAS Installation Data (SID) file in metadata. See Usage Note 49750.

If a SAS/ACCESS license for a data source is required but not available, that data source is not listed in the Import Data pane. This deployment-level exclusion affects all users, regardless of their capabilities.

Note: Imports from Salesforce use SAS/ACCESS Interface to ODBC and the Salesforce driver.

How to Protect Imported Data

User access to each data source is controlled by that data source’s authorization system.

Each self-service import action loads a source table to memory. The in-memory copy of the data is not subject to access controls from the original data source’s authorization system. Instead, access to in-memory data is controlled by metadata-layer permissions. Unless permissions are set directly on a LASR table, permissions on the LASR table’s parent folder determine access.

The following guidelines apply:

Users who have privileged access to source data should import that data to only a location that has appropriate metadata-layer protections.
Users who have fine-grained, identity-based access to source data should import that data to only a private location. For example, if UserA imports a source table that has salary information, and the source table has row-level controls that enable UserA to see only his salary, then the in-memory version of the imported table contains only information about UserA.

If your deployment supports self-service import of sensitive data, use the following measures:

Give self-service import capabilities to only users who understand and can conform to the preceding guidelines.
Set up an appropriately protected output location (metadata folder) for each distinct level of access. Ensure that users who have self-service import capabilities load data to the appropriate location.

Tip
In the initial configuration, self-service import actions load data to a general-purpose location. Users can instead select a private location (My Folder). Only users who have the Build Data capability can select other locations.

How to Limit Import Size

Row Limit

To prevent users from importing extremely large DBMS tables, you can set a maximum number of rows for self-service imports of DBMS tables. If the number of rows in a DBMS source table exceeds the limit, no data is imported. In the initial configuration, no limit is imposed. See va.SelfService.ImportRowsHardCap.

You can set a warning threshold for self-service import actions. If a user attempts to import a DBMS table that exceeds a specified number of rows (but does not exceed the maximum number of rows that can be imported), a warning message informs the user that the import might take a long time. The user can either continue the import or cancel the action. In the initial configuration, no warning threshold is set. See va.SelfService.ImportRowsSoftCap.

File Size Limit

To set the maximum file size (in megabytes) that a user can import, see va.SelfServe.MaxUploadSizeInMegabytes.

Tables Limit

To limit the total amount of space that a SAS LASR Analytic Server can use to host tables, see Limit Space for Tables.