Providing software solutions since 1976

• Log in
• Create profile
• Welcome
  [Log out]
• Edit profile
• My SAS

• Print  |
• Feedback  |
• Share

  • E-mail
  

  E-mail This Page

  Your Name:*
  Your E-mail:*
  Recipient E-mail:*
  Send a copy to me
  Personal Message:
  
  

  * indicates a required field

Overview

BI row-level permissions enable you to limit access to SAS data and third-party relational data that is accessed through information maps. Row-level permissions are enforced when information maps are accessed from applications such as SAS^® Web Report Studio.

This sample shows you how to define a row-level permission filter that is based on group membership. This filtering method can be useful when you need to subset results only for a few groups. As the input table for the information map, this sample uses the SASHELP.PRDSALE table.

Note: This sample was written using SAS Information Map Studio 3.1. For a more efficient method of creating this type of filter in SAS Information Map Studio 4.2, see Sample 37798.

Note: Row-level permission filters also can be identity-driven (see Sample 31563).

About the Sample Users and Groups

For this sample, these users and group memberships are defined in metadata.

Create the Filters

In SAS Information Map Studio, the PRDSALE table has already been used to create an information map named Sales 2008 Map.

Here are the steps to create the filters:

1. Select Insert–>Filter to open the New Filter dialog box.
2. Name the filter, select the data item that you want to filter, select the filter value, and then click OK. In this sample, the data item is REGION and the value is WEST.

   

3. Select Insert–>Filter to open the New Filter dialog box again.
4. Create the next filter. In this sample, the second (and final) filter is based on REGION and the value is EAST.

Add the Groups to the Information Map

1. Right-click on the information map name and select Authorization.
2. Click Add to add the groups that you want to secure. In this sample, the groups are Eastern Region and Western Region.

   

Add the Filter Conditions to the Groups

The groups must be granted explicit Read permission to the information map. Explicit permission is indicated by no background color. Initially, the Read permission has a gray background.

1. Select one of the groups that you just added. In this sample, the Eastern Region group was selected.
2. Click the Read check box until the background is cleared. When this is done correctly, the Add Condition button becomes active.
3. Click Add Condition to open the Row-Level Permission Condition dialog box.

   

4. Select the filter that you want to assign to the group that you selected on the Authorization tab.
5. Click the arrow to assign the filter to the PRDSALE table.

   

   Notice the filter expression that you created.

   

6. Back on the Authorization tab, perform steps 1 through 5 to define the next permission condition. In this sample, the Western Region Filter is assigned to the Western Region group.

Make the Filtered Table Required

1. Right-click on the information map name and select Properties.
2. Select the Required Tables tab and move the table with the associated filter into the Required Tables box. In this sample, the table is PRDSALE.

   

Viewing Results

To see the results of testing this filter in SAS Web Report Studio, click the Results tab at the top of this sample.

Additional Documentation

For more information about creating row-level permissions, see the documentation for the version of SAS that you are using:

• SAS 9.1.3 Intelligence Platform: Security Administration Guide, "Chapter 10: BI Row-Level Permissions".
• SAS 9.2 Intelligence Platform: Security Administration Guide: BI Row-Level Permissions.

For more information about SAS Information Map Studio, see the SAS Information Map Studio documentation page.

---

These sample files and code examples are provided by SAS Institute Inc. "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Recipients acknowledge and agree that SAS Institute shall not be liable for any damages whatsoever arising out of their use of this material. In addition, SAS Institute will provide no support for the materials contained herein.

---

These sample files and code examples are provided by SAS Institute Inc. "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Recipients acknowledge and agree that SAS Institute shall not be liable for any damages whatsoever arising out of their use of this material. In addition, SAS Institute will provide no support for the materials contained herein.

Seeing Filtered Results in SAS Web Report Studio

To test the filter created in this sample, each user logged into SAS Web Report Studio and viewed the Sales 2008 by Region report, which is based on the Sales 2008 Map.

Here are the results that were displayed for Sales Rep East.

Here are the results that were displayed for Sales Rep West.

Here are the results that were displayed for the Sales Manager. Because Sales Manager is a member of both regional groups (at the same level of identity precedence), this user has access to all rows that are visible to each group.

Note: For easier readability, the region values were moved to rows.

Operating System and Release Information