31885 - How to Create a SAS® Information Map That Filters Using Group-Based, Row-Level Permissions

Sample 31885: How to Create a SAS® Information Map That Filters Using Group-Based, Row-Level Permissions

Overview

BI row-level permissions enable you to limit access to SAS data and third-party relational data that is accessed through information maps. Row-level permissions are enforced when information maps are accessed from applications such as SAS^® Web Report Studio.

This sample shows you how to define a row-level permission filter that is based on group membership. This filtering method can be useful when you need to subset results only for a few groups. As the input table for the information map, this sample uses the SASHELP.PRDSALE table.

Note: Row-level permission filters also can be identity-driven (see Sample 31563).

About the Sample Users and Groups

For this sample, these users and group memberships are defined in metadata.

User	Group Membership
Sales Rep East	Eastern Region
Sales Rep West	Western Region
Sales Manager	Eastern Region, Western Region

Create the Filters

In SAS Information Map Studio, the PRDSALE table has already been used to create an information map named Sales 2008 Map.

Here are the steps to create the filters:

Select Insert–>Filter to open the New Filter dialog box.
Name the filter, select the data item that you want to filter, select the filter value, and then click OK. In this sample, the data item is REGION and the value is WEST.
Select Insert–>Filter to open the New Filter dialog box again.
Create the next filter. In this sample, the second (and final) filter is based on REGION and the value is EAST.

Add the Groups to the Information Map

Right-click on the information map name and select Authorization.
Click Add to add the groups that you want to secure. In this sample, the groups are Eastern Region and Western Region.

Add the Filter Conditions to the Groups

The groups must be granted explicit Read permission to the information map. Explicit permission is indicated by no background color. Initially, the Read permission has a gray background.

Select one of the groups that you just added. In this sample, the Eastern Region group was selected.
Click the Read check box until the background is cleared. When this is done correctly, the Add Condition button becomes active.
Click Add Condition to open the Row-Level Permission Condition dialog box.
Select the filter that you want to assign to the group that you selected on the Authorization tab.
Click the arrow to assign the filter to the PRDSALE table.

Notice the filter expression that you created.
Back on the Authorization tab, perform steps 1 through 5 to define the next permission condition. In this sample, the Western Region Filter is assigned to the Western Region group.

Make the Filtered Table Required

Right-click on the information map name and select Properties.
Select the Required Tables tab and move the table with the associated filter into the Required Tables box. In this sample, the table is PRDSALE.

Viewing Results

To see the results of testing this filter in SAS Web Report Studio, click the Results tab at the top of this sample.

Additional Documentation

For more information about creating row-level permissions, see "Chapter 10: BI Row-Level Permissions" in the SAS 9.1.3 Intelligence Platform: Security Administration Guide at http://support.sas.com/documentation/configuration/bisecag.pdf

For a list of available documentation for SAS Information Map Studio, see http://support.sas.com/documentation/onlinedoc/ims/index.html

These sample files and code examples are provided by SAS Institute Inc. "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Recipients acknowledge and agree that SAS Institute shall not be liable for any damages whatsoever arising out of their use of this material. In addition, SAS Institute will provide no support for the materials contained herein.

Type:	Sample
Topic:	Data Management ==> Data Sources ==> Information map System Administration ==> Security ==> Authentication System Administration ==> Security ==> Permissions Query and Reporting

Date Modified:	2008-04-24 15:37:45
Date Created:	2008-04-24 10:08:40

Product Family	Product	Host	Starting Release	Ending Release
SAS System	SAS Information Map Studio	Microsoft® Windows® for x64	3.1
		Microsoft Windows 2000 Advanced Server	3.1
		Microsoft Windows 2000 Datacenter Server	3.1
		Microsoft Windows 2000 Server	3.1
		Microsoft Windows 2000 Professional	3.1
		Microsoft Windows NT Workstation	3.1
		Microsoft Windows Server 2003 Datacenter Edition	3.1
		Microsoft Windows Server 2003 Enterprise Edition	3.1
		Microsoft Windows Server 2003 Standard Edition	3.1
		Microsoft Windows XP Professional	3.1
SAS System	SAS Web Report Studio	Microsoft® Windows® for x64	3.1
		Microsoft Windows 2000 Advanced Server	3.1
		Microsoft Windows 2000 Datacenter Server	3.1
		Microsoft Windows 2000 Server	3.1
		Microsoft Windows 2000 Professional	3.1
		Microsoft Windows NT Workstation	3.1
		Microsoft Windows Server 2003 Datacenter Edition	3.1
		Microsoft Windows Server 2003 Enterprise Edition	3.1
		Microsoft Windows Server 2003 Standard Edition	3.1
		Microsoft Windows XP Professional	3.1
		64-bit Enabled AIX	3.1
		64-bit Enabled Solaris	3.1
		HP-UX IPF	3.1

Knowledge Base