Metacoda Security Plug-ins – Page 3

Metacoda Auth Domain Reviewer Libraries Tab

Last year I posted some information about a new Metacoda Auth Domain Reviewer plug-in that was planned for Metacoda Plug-ins 6.1. That Auth Domain Reviewer is now available with the recent Metacoda Plug-ins 6.1 R1 release and you may notice that it looks a little different to the screenshots I posted back then … it now has a Libraries tab.

The Libraries tab as was added based on feedback we got during early access testing by customers. They told us they would like to be able to see, for a selected authentication domain, all of the SAS® software libraries registered in metadata that are associated with that auth domain. That sounded like a great idea so we added it!

Thanks to those customers that suggested it and please keep those suggestions coming!

If you’d like to try out the new Auth Domain Reviewer plug-in you can login and download Metacoda Plug-ins 6.1 R1 from the Metacoda Customer Portal. If you don’t yet have a Metacoda login you can register for a free 30 day evaluation license to try the plug-ins in your own SAS platform installation.

Metacoda Plug-ins Batch Interface Setup Utility

This is a short post to let those readers who run or schedule Metacoda Plug-ins in batch know that, with the recent Metacoda Plug-ins 6.1 R1 release, we have published a GitHub repository to help with setup of the Metacoda Plug-ins Batch Interface. You can find this new repository, together with setup instructions, at https://github.com/Metacoda/metacoda-plugins-batch-setup

Metacoda Plug-in 6.1 HTML Export

The main benefit of this Metacoda Plug-ins Batch Interface Setup Utility is the automation of much of the previous manual work involved in setting up and site-specific tailoring of the batch interface samples. It also includes additional batch exports for Authentication Domains and External Identities (from the new Auth Domain Reviewer and External Identity Manager plug-ins). The Metacoda recommended practice starter tests for SAS metadata security have also been updated.

If you have any questions or comments please let me know by posting below. You can also contact us via the Metacoda contact form or send us an email at Metacoda support.

Metacoda Auth Domain Reviewer

Update 05Mar2019: The Metadata Auth Domain Reviewer discussed in this blog post is now available with the Metacoda Plug-ins 6.1 R1 release, and also includes a new Libraries tab based on feedback from customers during early-access testing.

One of the new Metacoda Security Plug-ins features arriving in version 6.1 is the Auth Domain Reviewer. Like the other reviewers, this plug-in is used for investigating, documenting and testing how a SAS metadata security feature has been used within a particular SAS platform deployment. When I’m reviewing metadata security for a SAS platform I like to look at it from several different perspectives and authentication domains is one of them. I like to see:

What authentication domains have been added beyond the initial DefaultAuth?
How have they been used with respect to inbound logins?
How have they been used with respect to outbound logins and providing shared credentials for database access?
How have they been used with respect to 3rd party database system connections?
Are there any unused ones, possibly added by accident, that can be cleaned up?
Are there any seemingly duplicate ones that might be consolidated?

In the past it has been time-consuming to gather this information together, so this new plug-in Continue reading “Metacoda Auth Domain Reviewer”

Metacoda Plug-ins Tip: User’s Group Content Admin Permissions (Identity Permissions Explorer)

This tip was prompted by a SAS Communities question which I hear from time to time, essentially “How do I find out which groups a SAS user is a Portal Group Content Administrator for?” It can be answered using the Metacoda Identity Permissions Explorer but involves a few steps so I will outline them here.

To quote the SAS® 9.4 Intelligence Platform: Web Application Administration Guide, Group Content Administrator section:

A group content administrator is a user who has WriteMetadata permission for the respective group, and the group’s Portal permission tree. A group content administrator can share personal content with the group, and can edit or remove content that has been shared with the group. (Portal administrators have WriteMetadata permission for all group permission trees that are defined in metadata.)

So, to find out which groups a user is group content admin for, we need to look for all of the group portal permission trees where the user has a grant of the WM permission. This can be done quickly and easily using the Metacoda Identity Permissions Explorer. Below is a screenshot with numbered steps where we find out which groups Aaron Atkins (demoaaron), a fictitious Business Analyst, is a Portal Group Content Administrator for. Continue reading “Metacoda Plug-ins Tip: User’s Group Content Admin Permissions (Identity Permissions Explorer)”

Metacoda Plug-ins Tip: Removing an Unwanted Auth Domain and Logins

This tip details how to go about removing an unwanted Authentication Domain and all associated Login objects from SAS metadata. A need for this can arise when you have been temporarily (or accidentally/unnecessarily) added a second set of inbound logins for all of your SAS users and you decide you no longer need those extra logins (perhaps you are migrating between authentication mechanisms).

If you are using the Metacoda Identity Sync Plug-in then the first step is to edit the Identity Sync Profile (IDSP file) using the Identity Sync Profile Wizard and untick the checkbox that configures the 2nd login. If you don’t do this, then the auth domain, and all the logins, will simply be re-added next time you run a sync! You can see a sample screenshot of the wizard page where you can unconfigure the 2nd login below:

Metacoda Identity Sync Plug-in Wizard with unchecked Second Login

After updating, and saving, the Identity Sync Profile you are almost ready to remove the unwanted auth domain and associated logins. Before removing the metadata it is a good idea to do the following: Continue reading “Metacoda Plug-ins Tip: Removing an Unwanted Auth Domain and Logins”