Adjust the Repository-Level Settings

Why Adjust the Repository-Level Settings?

CAUTION:

Altering the repository-level settings for service identities can prevent necessary access.

We recommend that you do not change these settings.

This list highlights key points about working with repository-level settings for a foundation repository:

If you want some or all users to have default read access to all data, grant the Read permission at the repository level.
If you want to experiment with narrowing repository-level access, we recommend that you create a new ACT and designate that ACT as the repository ACT (instead of modifying the original repository ACT).
Typically, all users need ReadMetadata and WriteMetadata access to the foundation repository. It is appropriate for the SASUSERS group to have these permissions on the repository ACT's Permission Pattern tab.

To make changes to the repository ACT:

On the Plug-ins tab in SAS Management Console, select Authorization ManagerAccess Control Templates.
In the display area, select the repository ACT .
Right-click and select Properties. Make changes on the Permission Pattern tab. Each restricted identity that you add gets a grant of the ReadMetadata permission in the pattern.

For example, to give all registered users default read access to all data, select the SASUSERS group and then select the Grant check box for the Read permission.

Note: Any gray check boxes are settings that come from the selected identity's group memberships.

Note: Don't confuse the Permission Pattern tab with the Authorization tab. Settings on the Authorization tab affect who can access this ACT; settings on this Permission Pattern tab define access to the repository.

Note: There is no reason to specify grants or denials of the WriteMemberMetadata permission as part of the repository-level settings. Unlike other permissions, the WriteMemberMetadata permission is never inherited from one item to another.

Note: In the repository ACT's pattern, an identity that has a blank setting for a particular permission (neither a grant nor a denial) is denied that permission.

To designate a different repository ACT:

Identify or create an ACT that has the repository-level settings that you want to use.
On the Plug-ins tab in SAS Management Console, under Authorization ManagerAccess Control Templates, select the ACT that you want to use to define repository-level access.
Right-click and select Repository ACT. In the confirmation message box, click Yes.

In the list of ACTs under Authorization ManagerAccess Control Templates, the repository ACT icon is now displayed next to the newly designated repository ACT. The ACT that originally served as the repository ACT still exists, but it is no longer in use.

Note: To revert to the original repository ACT, select that ACT and repeat step 3.