Author: Paul Homes

Identity Sync: Finding Your Keys

Using the Metacoda Identity Sync Plug-in with a new SAS installation is easy. All of the defaults are based on common practices for synchronizing Active Directory users and groups with a SAS metadata server. Using the plug-in with an existing installation, where users and groups have already been synchronized using custom code, takes a little more planning. One of the ‘key’ things to do is to configure the plug-in to use the same external identity key id attribute that was used in the custom code. If you have the custom code, you can find the prior key choice in that code. This post is about helping you find and recognize those external identity keys without necessarily having to study the code.

An external identity key is a unique identifier for a user or group in an external identity source (e.g. Active Directory). It connects users within SAS metadata to the equivalent external user, so changes to the external user (including name changes) can be applied to the SAS user at some later date/time. In choosing a key from the external source, it is best to choose one that will stay constant over time, even after user name changes, directory reorganisation etc. There are a few different key choices available, and some are more likely to remain constant over time than others. Later in this post I will show examples of some common external identity key id attributes. The key that is chosen for groups doesn’t have to be the same as the one chosen for users either. I often see sAMAccountName being used for users and distinguishedName being used for groups. At Metacoda we recommend using objectGUID for both users and groups (as explained below). Once a Key Id Attribute has been chosen it is important to continue to use the same one over time. Switching the key choice after it has already been used for a synchronization is not an easy thing to do, so it is good to carefully consider the initial choice before deciding to synchronize users and groups. Of course, sometimes you inherit the process and have no choice in the matter.

When switching from one synchronization process to another, such as custom code to the Metacoda Identity Sync plug-in, it is important to continue to use the same key choice as before. If the key choices are different you might see something like this in the Identity Sync Plug-in, where every user or group looks like it will be (tag) deleted and re-added, and there are associated validation errors that prevent the sync from proceeding.

Metacoda Identity Sync: Users with mismatched keys being added and deleted

In the screenshot above, Continue reading “Identity Sync: Finding Your Keys”

Identity Sync: Multiple Active Directory Domains (Single Forest)

Recently I’ve been working on using the Metacoda Identity Sync Plug-in to synchronize SAS platform identities (users and groups) with their counterparts from multiple Microsoft Active Directory (AD) Domains contained within a single Forest. In a future post I’ll talk about extending this to multiple domains from multiple trusted forests.

In the recent Metacoda Plug-ins 5.0 R5 release there have been a few enhancements to make it easier to sync with multiple domains (and avoid using custom code hooks):

  • Members of “Included Groups” are followed into other domains within the same forest.
  • You can opt to prefix the SAS User and Group names with the NetBIOS domain name. You might choose to do this if you have any users or groups in different domains with the same sAMAccountName and want to avoid non-unique user/group name validation errors when they get to the SAS platform.
  • There are more user login options available to help appropriately qualify the inbound login for the SAS user using the domain of the Active Directory user.

I’ll show a relatively simple example. This might help other people who need to sync SAS users from multiple AD domains. The diagram below summarizes the Active Directory deployment: Continue reading “Identity Sync: Multiple Active Directory Domains (Single Forest)”

Restarting SAS Web Apps with SAS Environment Manager

Have you ever wanted to restart a single SAS® web application without having to wait for the entire stack of SAS Web Application Servers to restart? Well, SAS Environment Manager provides the ability to do this, and I think that’s fantastic. I needed to restart the SAS Logon Manager several times the other day, and by using SAS Environment Manager I was able to save at least an hour of my time in repeatedly restarting the individual app rather than the entire app server. This post shows the steps involved in restarting a single web app with SAS Environment Manager. I’m saving these steps because each time I’ve needed to do it, it has taken me a while to find the right place (because there’s so much to see in SAS Environment Manager!).

In my case, I needed to allow a Metacoda web application to use SAS Logon Manager and this required a change to metadata and a restart of the SAS Logon Manager web app (as described in SAS Problem Note 56451: The error “The Application is not authorized to use SAS Logon Manager” occurs …).

I used the SAS Management Console Configuration Manager plug-in to add the ServiceUrl.Allowed advanced parameter to SAS Application Infrastructure. The next step was to restart SAS Logon Manager to pick up the change. After logging into SAS Environment Manager, I knew that the SAS Logon Manager web app was in the SAS Web App Server instance named SASServer1_1, so I searched for that by typing in sasserver1_1 and selecting Servers from the drop down:

SAS Environment Manager: Finding a SAS Web App Server instance

That returned a single sas94m3 tc Runtime SASServer1_1 instance which I clicked on: Continue reading “Restarting SAS Web Apps with SAS Environment Manager”

Testing Conditional Grants in SAS Visual Analytics

If you use conditional grants in SAS® Visual Analytics for row level security, then you might be interested in one of the enhancements available in our recent Metacoda Plug-ins 5.0 release. This new release adds support for automated metadata security testing of the permission conditions behind conditional grants. Conditional grants, sometimes known as row-level permissions or row-level security, allow you to grant limited access to a subset of data based on an expression. If someone is in a constrained group then they only get to see the rows where the expression evaluates to true.

If you’re using conditional grants to restrict certain groups of users to specific subsets of data then you’d probably be keenly interested in making sure those conditional grants remain in place. You wouldn’t want to discover at some future time that, due to unexpected changes in the permission conditions, those groups of users have been getting much broader access to data than should have been allowed.

We’ve enhanced Metacoda Plug-ins in version 5 to help people maintain the integrity of their permission conditions in the following areas: Continue reading “Testing Conditional Grants in SAS Visual Analytics”

Active Directory Authentication for SAS on Linux (with realmd)

This is another post in the series about configuring a SAS platform on Linux to use Integrated Windows Authentication (IWA), in this post I’m going to jot down some notes on steps 1-7 – configuring the Linux server for Active Directory (AD) Authentication.

Some time has passed since I wrote the original post, and a few things have changed. I’m now running SAS 9.4 M3, but this post should equally apply to SAS 9.4 M2. I have also switched the Linux distribution from Debian to CentOS 7.1. I am also using a much simpler method of joining the Linux server to the AD domain, using the realmd package (previously there were lots of individual steps using the underlying packages but realmd automates most of this). In this post I’m going to outline the simpler method using realmd of course.

Here goes … Continue reading “Active Directory Authentication for SAS on Linux (with realmd)”