Tag: Metadata Migration

Promoting SAS Security Metadata (in Custom Repositories)

Did you know that with SAS® 9.3 you can promote (export/import) SAS metadata packages containing users, groups, roles, and ACTs, just like you can with Jobs, Tables, Libraries, Stored Processes, Reports and Information Maps? I needed to do this myself a few weeks ago. I wanted to promote some groups, roles and ACTs from an existing SAS 9.3 M1 installation to a newer SAS 9.3 M2 installation. Security metadata can be exported and imported via a SAS package file (.spk) from special virtual folders under the top-level /System folder. These virtual folders are distinguishable from normal folders because they have white folder icons instead of yellow folder icons as shown below.

SAS Management Console Virtual Folders

You can find out more information about this feature, including a few considerations you need to be aware of, by reading the Promoting Security Objects and Server Objects sub-section of the main Promotion Details for Specific Object Types section in the SAS 9.3 Intelligence Platform: System Administration Guide, Second Edition.

My security metadata promotion was a little more complicated than normal because I was also promoting some security metadata located in a custom repository. I normally avoid using custom repositories as much as possible (preferring to store everything in the Foundation repository and partitioning content with folders and ACTs). This is especially the case for security metadata: I’ve found that security metadata in custom repositories, being less visible, tends to get forgotten until it gets rediscovered whilst troubleshooting tricky security problems. Helping a customer resolve such problems was the reason we made security metadata from custom repositories highly visible in our Metacoda Security Plug-ins. We have since needed to keep some security metadata in custom repositories for the purposes of development and testing of our software. This is the custom repository security metadata I was attempting to promote, but it took me a little while to find it in the virtual folders …. Continue reading “Promoting SAS Security Metadata (in Custom Repositories)”

Migrating SAS Access Control Templates

I ran into a tricky issue today whilst migrating some Access Control Templates (ACTs) from an old SAS® 9.3 M0 deployment to a new SAS 9.3 M2 deployment. I’d seen it before and I initially forgot how I resolved it. It took a little while to rediscover the method that worked so I’m blogging it in the hope I won’t forget it in future. Perhaps it will help others too.

As you may know, SAS 9.3 has virtual folders that allow you to export security metadata like users, groups, roles and ACTs. It’s quite handy. We use it at Metacoda to migrate some security metadata we carry over from version to version for testing and demonstrating our Metacoda Security Plug-ins. You can find more information about migrating security metadata on the SAS web site in the Promotion Details for Specific Object Types section of the SAS 9.3 Intelligence Platform: System Administration Guide, Second Edition.

I had successfully exported a package of ACTs from my source 9.3 M0 environment, but when I tried to import them into my target 9.3 M2 environment I saw the following error message:

It was quite puzzling. It said I had to import ACTs into a specific folder, but that was the very same folder I was trying to import into. I had a feeling of deja-vu. I realized I’d seen this back when I first set up our SAS 9.3 M0 environment and was testing migration of security metadata between levels for the same SAS version. Continue reading “Migrating SAS Access Control Templates”

All Systems Go with SAS 9.3

Over the past few weeks I must have done about half a dozen SAS® 9.3 installations and deployments (mainly Linux 64-bit server and Windows 7 32-bit client). Not because of any problems really, just trying out a variety of options. My experiences have been very good. I must say the SAS installation and migration process is getting really streamlined now. Refreshingly easy actually. I even repeated a couple of installs because it would be easier to change some items during install than manually modify them in the new installation (something I wouldn’t have done with SAS 9.1.3). Of course, whilst SAS installations/migrations are getting more straightforward, I’d still recommend getting SAS Professional Services or one of the SAS partners to help – being businesses that install, migrate and configure SAS software on a daily basis they are very efficient and have extensive support resources at their disposal. I can’t imagine how it could be cost effective for SAS customers to acquire those skills when it’s something they might only do once or twice every few years.

My first impressions of SAS 9.3 have been very good. The installs and migrations went very smoothly. At Metacoda our installations are based on standard deployment plans and used for development and testing of our Metacoda Security Plug-ins software. Whilst our SAS installations are not very complex, we do have deployments with lots of carefully constructed, weird and wacky metadata security configurations. Deployments that, were you to see them in real-life, would have you wondering what was that administrator thinking! They are perfect for developing and testing our Metacoda Security Plug-ins software though! With SAS Migration Utility (SMU) based migrations our Lev1 and Lev2 security metadata came over perfectly from SAS 9.2 to SAS 9.3. We also did a clean empty Lev3 deployment too. I’m hoping that in future, with virtual folders in SAS 9.3, and the ability to easily export ACTs, users, groups, and roles, we could switch to using package exports and imports to promote this security metadata from SAS 9.3 to SAS 9.4 and beyond.

From our perspective SAS 9.3 seems to be very compatible with SAS 9.2 too. We were very pleasantly surprised to find our Metacoda Security Plug-ins ran in SAS Management Console 9.3 almost without change. A few minor modifications based on underlying changes in the SAS metadata model (the Login object changed its parent from SecondaryType to PrimaryType) and now we are running our plug-ins in SAS Management Console 9.3. We are so happy with it that our V2 release currently in beta will support both SAS 9.2 and SAS 9.3 when it goes live soon.

I have heard some people say they are hesitant about upgrading from SAS 9.2 to SAS 9.3 based on their experiences with SAS 9.1.3 to SAS 9.2. Personally I remember the move from SAS 9.1.3 to SAS 9.2 seemed more like a major version upgrade than a point release. I always wondered why SAS 9.2 was not SAS 10 ;). In contrast, the move from SAS 9.2 to SAS 9.3 does feel more like a point release upgrade to me. Whilst there may have been lots of improvements under the covers and a several welcome new additions, as a SAS platform administrator it still feels very similar to SAS 9.2. No huge learning curve and the users get to use almost the same clients they were using with SAS 9.2 M3 too.

I’ll certainly be recommending upgrades from SAS 9.2 to SAS 9.3 and for those currently on 9.1.3 it makes much more sense to me to go straight to 9.3 – the direct migration path is supported and why do two migrations and two rounds of testing when you can do one?

Some of the main administration oriented improvements I’m keen to look at in detail include:

  • Integrated scheduled SAS metadata hot backups. Now everyone gets scheduled metadata backups out of the box with no down time for the metadata server.
  • Easy SAS metadata restores with roll-forward recovery.
  • SAS Management Console virtual folders for exporting and importing users, groups, ACTs etc.
  • New SAS Management Console Search tab.
  • Enhancements to pre-assigned libraries.
  • IWA support for UNIX servers.

Keep an eye out for a few more posts from me on SAS 9.3. I’m hoping I get some time to document some of my 9.3 experiences as I investigate further.

Update 30Aug2011: Andy Ratcliffe mentions this post in his blog post NOTE: Upgrading to SAS 9.3 where he also makes some good recommendations about obtainining pre-installation architecture plans and post-installation implementation documentation.

SAS Platform Object Framework MakeFolder Metadata Utility

Back in July last year I posted MKDIRMD Macro: Creating Tree Folders in Metadata about a SAS macro I wrote to create tree folders in a SAS metadata repository using the SAS Open Metadata API. Just recently I discovered an alternative method using a utility already present in a SAS 9.2 installation: MakeFolder.

I stumbled on MakeFolder in passing whilst looking in the SASPlatformObjectFramework directory (which is /usr/local/SAS/SASPlatformObjectFramework/9.2 on my Linux machine). If you haven’t seen it before, that directory contains a number of tools such as the Batch Export and Import tools for batch migration/promotion of metadata and the ValidateServer utility mentioned in SAS Usage Note 42523: ValidateServer utility to check availability of SAS® 9.2 Business Intelligence servers. I noticed the SASPlatformObjectFramework directory contained a few other utilities too, including MakeFolder which sounded very much like it might, well, make a folder! Since there are already operating system commands to make file system folders I guessed it would probably make metadata folders and so be worth a closer look.

I couldn’t find any documentation for MakeFolder. A search on support.sas.com yielded nothing. The other SASPlatformObjectFramework utilities documented –help parameters so I thought I would try that out first. It displayed the following nice usage message: 

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder --help
usage: MakeFolder [options...] folderPath
options include:
 -profile <profile>     Metadata server connection profile.  Can be used in
                        place of the -host, -port, -user, and -password options.
 -user <userID>         User login identity. Required if -profile is not set or
                        if the profile does not contain connection credentials.
 -password <password>   User login password. Required if -profile is not set or
                        if the profile does not contain connection credentials.
 -host <hostname>       Metadata server host. Required if -profile is not set.
 -port <port>           Metadata server port. Required if -profile is not set.
 -?,--help              Print help information.
 -domain <domain>       User authentication domain
 -log <log-file>        Log file or directory.
 -makeFullPath          create intermediate folders if necessary

It all looked quite straightforward, so I tried it out in a development environment. Firstly to create a simple top level folder (/testsimple):

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword /testsimple
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
INFO  Folder /testsimple created.
MakeFolder has completed.

That worked fine and looking in the SAS Management Console Folders tab I could see the folder had been created.

There was also a -makeFullPath to create intermediate parent folders too. I first tried it out without -makeFullPath:

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword /test/multiple/levels
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
ERROR Parent folder /test/multiple/ does not exist.
MakeFolder has completed.

As expected, that produced an error message since I didn’t already have the /test/multiple parent folders. I ran it again, this time with the -makeFullPath parameter:

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword -makeFullPath /test/multiple/levels
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
INFO  Folder /test/ created.
INFO  Folder /test/multiple/ created.
INFO  Folder /test/multiple/levels created.
MakeFolder has completed.

The folder and its parents were all created successfully.

MakeFolder indeed looks very useful. However, since I haven’t seen any official SAS documentation for it, I would err on the conservative side and, unless I hear otherwise, assume it’s not currently supported. Perhaps if someone from SAS Institute is reading they might be able to provide a bit more info about its status.

So now I know two ways to script the creation of metadata folders.

Interesting SAS notes relating to Portal Promotion

I noticed a couple of recent SAS usage notes relating to the new portal content promotion capability in SAS 9.2:

SAS Problem Note 42231 discusses a potential problem whereby incorrect letter casing in the specification of a template name could result in the removal of the entire Portal Application Tree. Of course, if you always follow the practice of doing a SAS metadata backup before any metadata promotions it wont be an issue as you will have a backup to restore from. It sounds like there is a hotfix planned.

The problem note also alerted me to SAS Usage Note 41692 which provides a link to download the portal promotion scripts for use with versions prior to 4.3. A quick look through the documentation shows the scripts can be used to go from a source environment of SAS 9.1.3 (or later) to a target environment of SAS 9.2 (or later) – no 9.1.3 to 9.1.3. I’m not entirely sure, but it also sounds like the downloadable scripts might also be of use to Portal 4.3 users who want to avoid the potential problem mentioned in 42231.

I’d be keen to hear of anyone’s experiences with the portal promotion tools if they want to share.