Tag: SAS 9.3

SAS Metadata Security Testing

SAS® Global Forum 2014 is now only a few days away, and I’m excited (and a little nervous) about presenting my paper Test for Success: Automated Testing of SAS® Metadata Security Implementations.

Update 03Apr2014: My paper is now available for download from the SAS Global Forum 2014 Online Proceedings.

SAS metadata security testing is a topic I’ve been contemplating for a long time now. For many organizations, metadata security is an important feature of the SAS platform. It enables them to control access to business resources described by the metadata and ensure their users can only use SAS applications to view and modify resources appropriate to their roles within the organization.

When metadata security is important, conducting security testing on a regular basis is important too. Regular testing allows an organization to feel confident in the security of their platform and to promptly detect deviations from a carefully crafted metadata security implementation. Many times I’ve seen accidental changes, or quick fixes, which had a detrimental impact on an installation’s metadata security. Without regular testing, Continue reading “SAS Metadata Security Testing”

Providing User Access to the SAS® BI Lineage Plug-in

I was asked yesterday whether it was possible to use the SAS® Management Console BI Lineage plug-in to provide non-administrators with the ability to review BI Lineage scans (as previously run by administrators). The BI Lineage plug-in can be used to do impact analysis for BI content (reports, information maps etc.) in a similar way that SAS Data Integration Studio provides impact analysis for DI content (jobs, tables, etc).

I’d never needed to do this before, so I did a little research. It didn’t take long to find the Granting Users Permission to View Scan Results section of the Using the BI Lineage Plug-in page in the SAS® 9.4 Intelligence Platform: System Administration Guide, Second Edition. That page explains how to open up access to the BILineage custom repository so that normal non-administrative users can get access to the scans (which are otherwise only available to unrestricted users). The document doesn’t get into explaining how to provide normal users with access to the BI Lineage plug-in itself so in this blog post I’m going to outline the steps required, with screenshots, to show the entire process. The end result of this process will be a BI Lineage Users group. You can then add normal non-administrative users as members of this group to provide them with access to both the BI Lineage plug-in and the scans in the BILineage repository.

The first step is to create the BI Lineage Users group. Continue reading “Providing User Access to the SAS® BI Lineage Plug-in”

Removing Custom Task Capability Metadata

Yesterday I saw a question on the SAS® Communities site from Nick about Registering Custom Tasks and managing the capability metadata that’s used for role based access control on those custom tasks. I found Nick’s question especially interesting because we have some free Metacoda Custom Tasks and those techniques can also be used to control access to them.

Nick had mentioned how he used SAS® Enterprise Guide® to register the capability metadata for some custom tasks, was asking about doing the same for the SAS Add-In for Microsoft Office, and also about how one would go about removing the capability metadata. Chris Hemedinger later replied with a response that I found very useful. There was a link to one of his prior blog posts on the topic (Controlling access to custom tasks in SAS Enterprise Guide – The SAS Dummy) and some information on using RegAddin.exe to get the capability metadata populated for use by the Add-In. Chris also mentioned there was not a way to remove the custom task capability metadata short of the potentially dangerous technique of using the SAS Open Metadata Interface’s DeleteMetadata facility.

Having already registered the custom task metadata myself, I now needed a way to remove it so I could repeat the process for future documentation and testing purposes. I used the DeleteMetadata method. This is the main topic for this blog post and it serves 2 purposes: the first is that I wanted to document how I did it so I could do it again later; the second is that it was an opportunity for me to use the SAS Management Console XML Metadata Interface and capture a few screenshots along the way. I rarely use the SAS Management Console XML Metadata Interface and it’s always a journey of re-discovery every time I do. This time I wanted a permanent memory of the steps so I could refer to them again in future. I also ran into an interesting unknown-public-type issue that initially prevented me from deleting the capability metadata, so I’ll show how I resolved that too. Continue reading “Removing Custom Task Capability Metadata”

Password Encoder

I’ve noticed that whenever I need a pwencoded password, it seems to coincide with me not having a SAS® coding interface readily available (DMS, SAS Enterprise Guide®, SAS Data Integration Studio etc.). On the other hand, I almost always have a SAS Management Console session open. For this reason I’ve added a small Password Encoder utility to our Metacoda Plug-ins product which will be available in the next maintenance release (3.0 R4). What’s more, this Password Encoder will be a free-of-charge utility along with the existing ACT Reviewer and Metadata Explorer.

It’s accessible from the SAS Management Console Tools menu:

Metacoda Plug-ins Password Encoder visible in the SAS Management Console Tools menu

It displays a window Continue reading “Password Encoder”

Record, Rewind, Replay

Sometimes you find yourself wanting to repeat a SAS® software installation or deployment with the same, or slightly different, options. Perhaps you want to start an installation again after realizing that you chose a wrong option the first time around. Maybe you want to test out a slightly different configuration. It might be that you are planning on doing multiple client installs, choosing exactly the same settings each time, and want to automate the process. For all of these reasons, you might be interested in the SAS Deployment Wizard’s ability to record an installation and replay it later. You might make the replay automatic and silent so there is no interaction, or you might just want to use the smart defaults from an old installation and make a few minor changes here and there.

It’s such a handy feature, that you might even decide to always record your installs, just in case you need them later.

For more information, have a look at the following SAS documents:

I’ve listed the SAS 9.4 documents above, but there’s equivalent documentation available for the earlier SAS releases too.

Here are a few examples:

1. Record a manual install/deploy:

/sasdepot/sas94ts1m0-rev940-13w30/setup.sh -record -deploy -responsefile /opt/sas94m0/sasdw-response.txt

If the response file already exists it appears to be overwritten without reading the contents. I haven’t yet found a way to get the SAS Deployment Wizard to read an existing response file, make changes and save an updated or new response file. If someone knows how to do this please let me know.

2. Interactively replay a previously recorded install/deploy, picking up defaults from the response file, and allowing changes to be made along the way (these changes are not saved in the response file however):

/sasdepot/sas94ts1m0-rev940-13w30/setup.sh -responsefile /opt/sas94m0/sasdw-response.txt

3. Quietly and non-interactively replay a previously recorded response file for automated install/deploy:

/sasdepot/sas94ts1m0-rev940-13w30/setup.sh -quiet -responsefile /opt/sas94m0/sasdw-response.txt

The SAS Deployment Wizard has several other options and modes that you might find useful, so check the documentation for more info.

If you have any extra tips for using response files with the SAS Deployment Wizard, please let me know by leaving a comment below.