Protecting your Metadata Protections: Part 2

SAS Management Console 9.3 showing default non-administrative capabilities.

In a guest post on blogs.sas.com in January, I wrote about protecting your metadata protections. In that post I said that “Ideally, a SAS® metadata security plan should address both ACT permissions and access to the Authorization Manager.” and went on to explain a method for addressing Access Control Template (ACT) permissions.

In this second part, I’ll talk about reducing access to the SAS Management Console Authorization Manager plug-in as further protection for your ACTs.

Of course, for some smaller SAS sites, and those with simple security requirements, this might be overkill. However, for other possibly larger organizations, those with potentially sensitive data/content, and perhaps those with specific regulatory requirements, it might be a necessity to implement a comprehensive metadata security implementation with multi-layered protections like these.

In the default metadata security implementations for SAS 9.3 and SAS 9.2, all SAS users have the capability to access a limited set of features in the SAS Management Console. This includes access to the Authorization Manager plug-in where any accidentally unprotected ACTs could be modified. In order to be able to take advantage of this capability, and modify an ACT, a user has to be able to fulfill all of the following requirements: Continue reading “Protecting your Metadata Protections: Part 2”

Reading ‘Custom Tasks for SAS Enterprise Guide Using Microsoft .NET’

Chris Hemedinger’s new book Custom Tasks for SAS® Enterprise Guide® Using Microsoft .NET was recently released. If you have an idea for a really useful additional task you’d like to build for SAS Enterprise Guide, I strongly encourage you to read this book and find out how. I certainly got alot out of reading it and learning from Chris’ knowledge and experience.

I think I first spotted this book title about a year ago on SAS Publishing’s Upcoming Titles page. Since then I had been eagerly anticipating its release, so when it became available I was very keen to read it. I even got to provide a review for it too. You can read my review, along with several others, on the book’s reviews page.

One of the things I mentioned in my review was my desire to write a custom task to query SAS metadata from within SAS Enterprise Guide. After finishing the book, going through it a second time to pick up the bits I missed first time around :) , I then busily set about my .. hmm .. well .. ‘task’ …

…. and then sometime later I had a working ‘Metadata Column Finder‘ task. Here’s a screenshot of it in action: Continue reading “Reading ‘Custom Tasks for SAS Enterprise Guide Using Microsoft .NET’”

SAS Stored Process Code in Metadata

With SAS® 9.3 the SAS code for a Stored Process can be located in metadata rather than located the file system (as was required with earlier versions). I had often wondered whether this meant the SAS code was really in metadata or whether it appeared to be in metadata but was really kept in the SAS Content Server (as is done with SAS Web Report Studio report definition .srx XML files). I don’t like not knowing the answers to questions, even ones I ask myself, so today I went looking for an answer. Continue reading “SAS Stored Process Code in Metadata”

Getting SAS Software running on CrunchBang Linux 64-bit

This is a follow-up to my prior post on Getting SAS® Software running on Arch Linux 64-bit. In my quest for a new Linux distro the next stop was CrunchBang Linux. I like the look of CrunchBang because it’s lightweight, based on Debian, and uses Openbox by default. Being Debian based, like Ubuntu, I get to re-use the knowledge I gained from using Ubuntu over the last few years (it’s hard not to automatically type apt-get whenever I want to install something!). CrunchBang is not a rolling release distro like Arch or Gentoo but it’s other attributes make it well worth a look. I’ve seen a disclaimer on the web site where they say it “… could possibly make your computer go CRUNCH! BANG!” but from everything else I’ve read it sounds pretty stable. Anyway, I like my (own) computers to go crunch bang every now and then – it’s a great opportunity to learn something new ;)

I installed the CrunchBang 11 “Waldorf” 64-bit testing image in a multi-boot configuration, alongside Arch and Ubuntu, to test it with our existing SAS deployments. These are the steps I needed to take to get the existing SAS software installation running on CrunchBang 64-bit. As with Arch, no changes were needed to the SAS deployments, it just required a few minor changes and additional libraries for the CrunchBang installation.

After CrunchBang had been installed and I’d mounted the SAS installation volume, I tried to run SAS 9.3 M2 first and got the following error: Continue reading “Getting SAS Software running on CrunchBang Linux 64-bit”

Testing Direct Access to SAS Metadata Bound Libraries and Tables

A little while ago, as part of the work on our recent Metacoda Plug-ins 3.0 R2 release, I used SAS® 9.3 M2 to set up a metadata bound library by following the useful instructions in the Setting Up a Metadata-Bound Library section of the SAS® 9.3 Guide to Metadata-Bound Libraries document. This post is about verifying that, post-setup, I no longer had direct access to the tables in the library.

Metadata bound libraries allow you to force clients to visit the SAS Metadata Server first, before they can gain access to the contents of the tables in the library. This gives the metadata server the opportunity to verify appropriate metadata access permissions. Direct access to those secured libraries and tables from Base SAS, without a visit to the metadata server, will be blocked. I first heard about metadata bound libraries at the SAS Global Forum in April this year and had been looking forward to trying them out. If you’re interested in them as well I recommend reading the documentation. Andy Ratcliffe wrote a NOTE: blog post about them recently too. If you don’t yet read Andy’s NOTE: blog I’d definitely recommend adding it to your RSS reader, and he also wrote a post last week about RSS in How Do You Read?.

This is the code I use to configure the metadata bound library (not the real pwencoded password):

libname hr '/opt/sas93m2/config/Lev3/SASApp/Data/HR';
proc authlib library=hr;
create
   securedfolder='/System/Secured Libraries/HR Secured Data'
   securedlibrary='HR Library'
   pw='{SAS002}ABCABCABCABCABCABCABCABC'
   ;
run;

After configuring the metadata bound library I wanted to verify that it had worked and that I hadn’t missed any steps. I wanted to check that the physical tables had been modified in such a way to prevent direct access from SAS processes that attempted to bypass the metadata server and go direct to the tables themselves. Continue reading “Testing Direct Access to SAS Metadata Bound Libraries and Tables”