search: Search support.sas.com KNOWLEDGE BASE     System Requirements     Install Center     Product Documentation     Papers     Samples & SAS Notes     Focus Areas SUPPORT     License Assistance     Administrator Services     Downloads & Hot Fixes LEARNING CENTER     Bookstore     Training     Certification     SAS Learning Edition     Higher Education Resources     SAS OnDemand For Academics COMMUNITY     User Groups     Events     E-Newsletters

• Print |
• E-mail  |
• Bookmark

Overview

BI row-level permissions enable you to limit access to SAS data and third-party relational data that is accessed through information maps. Row-level permissions are enforced when information maps are accessed from applications such as SAS^® Web Report Studio.

This sample shows you how to define a row-level permission filter that is based on group membership. This filtering method can be useful when you need to subset results only for a few groups. As the input table for the information map, this sample uses the SASHELP.PRDSALE table.

Note: This sample was written using SAS Information Map Studio 3.1, but the tasks are essentially the same for SAS Information Map Studio 4.2.

Note: Row-level permission filters also can be identity-driven (see Sample 31563).

About the Sample Users and Groups

For this sample, these users and group memberships are defined in metadata.

User	Group Membership
Sales Rep East	Eastern Region
Sales Rep West	Western Region
Sales Manager	Eastern Region, Western Region

Create the Filters

In SAS Information Map Studio, the PRDSALE table has already been used to create an information map named Sales 2008 Map.

Here are the steps to create the filters:

1. Select Insert–>Filter to open the New Filter dialog box.
2. Name the filter, select the data item that you want to filter, select the filter value, and then click OK. In this sample, the data item is REGION and the value is WEST.

   

3. Select Insert–>Filter to open the New Filter dialog box again.
4. Create the next filter. In this sample, the second (and final) filter is based on REGION and the value is EAST.

Add the Groups to the Information Map

1. Right-click on the information map name and select Authorization.
2. Click Add to add the groups that you want to secure. In this sample, the groups are Eastern Region and Western Region.

   

Add the Filter Conditions to the Groups

The groups must be granted explicit Read permission to the information map. Explicit permission is indicated by no background color. Initially, the Read permission has a gray background.

1. Select one of the groups that you just added. In this sample, the Eastern Region group was selected.
2. Click the Read check box until the background is cleared. When this is done correctly, the Add Condition button becomes active.
3. Click Add Condition to open the Row-Level Permission Condition dialog box.

   

4. Select the filter that you want to assign to the group that you selected on the Authorization tab.
5. Click the arrow to assign the filter to the PRDSALE table.

   

   Notice the filter expression that you created.

   

6. Back on the Authorization tab, perform steps 1 through 5 to define the next permission condition. In this sample, the Western Region Filter is assigned to the Western Region group.

Make the Filtered Table Required

1. Right-click on the information map name and select Properties.
2. Select the Required Tables tab and move the table with the associated filter into the Required Tables box. In this sample, the table is PRDSALE.

   

Viewing Results

To see the results of testing this filter in SAS Web Report Studio, click the Results tab at the top of this sample.

Additional Documentation

For more information about creating row-level permissions, see the documentation for the version of SAS that you are using:

• SAS 9.1.3 Intelligence Platform: Security Administration Guide, "Chapter 10: BI Row-Level Permissions".
• SAS 9.2 Intelligence Platform: Security Administration Guide: BI Row-Level Permissions.

For more information about SAS Information Map Studio, see the SAS Information Map Studio documentation page.

---

Seeing Filtered Results in SAS Web Report Studio

To test the filter created in this sample, each user logged into SAS Web Report Studio and viewed the Sales 2008 by Region report, which is based on the Sales 2008 Map.

Here are the results that were displayed for Sales Rep East.

Here are the results that were displayed for Sales Rep West.

Here are the results that were displayed for the Sales Manager. Because Sales Manager is a member of both regional groups (at the same level of identity precedence), this user has access to all rows that are visible to each group.

Note: For easier readability, the region values were moved to rows.

This sample shows you how to define a row-level permission filter based on group membership in SAS® Information Map Studio. As the input table for the information map, this sample uses the SASHELP.PRDSALE.

Type:	Sample
Topic:	Data Management ==> Data Sources ==> Information map System Administration ==> Security ==> Authentication System Administration ==> Security ==> Permissions Query and Reporting

Date Modified:	2008-04-24 15:37:45
Date Created:	2008-04-24 10:08:40

Operating System and Release Information

Product Family	Product	Host	Product Release		SAS Release
			Starting	Ending	Starting	Ending
SAS System	SAS Information Map Studio	Microsoft® Windows® for x64	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Advanced Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Datacenter Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Professional	3.1		9.1 TS1M3 SP4
		Microsoft Windows NT Workstation	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Datacenter Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Enterprise Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Standard Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows XP Professional	3.1		9.1 TS1M3 SP4
SAS System	SAS Web Report Studio	Microsoft® Windows® for x64	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Advanced Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Datacenter Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Server	3.1		9.1 TS1M3 SP4
		Microsoft Windows 2000 Professional	3.1		9.1 TS1M3 SP4
		Microsoft Windows NT Workstation	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Datacenter Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Enterprise Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows Server 2003 Standard Edition	3.1		9.1 TS1M3 SP4
		Microsoft Windows XP Professional	3.1		9.1 TS1M3 SP4
		64-bit Enabled AIX	3.1		9.1 TS1M3 SP4
		64-bit Enabled Solaris	3.1		9.1 TS1M3 SP4
		HP-UX IPF	3.1		9.1 TS1M3 SP4