Setting Proper Access Controls for User Identities

It is important that you properly set the access controls for the portaluser, portalguest, portaldemo, portaladmin, and dwadmin user identities. The following list should help you create the proper permission settings. These settings are required for proper operation of the portal.

The portaluser identity

• must be able to read, write, search, compare, delete, and add entries to the cn=SAS,$SAS_CONTEXT$ entry and its children
• must be able to read, write, search, compare, delete, and add entries to the $PERSON_CONTEXT$ entry
• must be able to read, search, and compare the $GROUP_CONTEXT$

The portalguest user identity

• must be able to read, search, and compare its own person entry
• must be able to read, search, and compare the group context
• must be able to read, search, and compare entries to the sasPortalUserCn=Portal Guest,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$ entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search, and compare entries in the following contexts that are defined to be publicly available:
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$

The portaldemo user identity

• must be able to read, write, search, and compare its own person entry
• must be able to read, search, and compare the group context
• must be able to read, write, search, compare, delete, and add entries to the sasPortalUserCn=Portal Demo,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$ entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search, and compare entries in (Note: Disallowing access to any of the following entries will result in content not being shown as documented in the demo.)
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$

The portaladmin user identity

• must be able to read, write, search, and compare its own person entry
• must be able to read, search, and compare the group context
• must be able to read, write, search, compare, delete, and add entries to the sasPortalUserCn=Portal Admin,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$ entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, write, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search, and compare entries in
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$

The dwadmin user identity

• must be able to read, write, search, and compare its own person entry
• must be able to read, search, and compare the group context
• must be able to read, write, search, compare, delete, and add entries to the sasPortalUserCn=DW Admin,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$ entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search and compare entries in
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$ sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$