As you will recall from our previous post "Seeing SAS data through metadata, there are lots of good reasons to use SAS metadata to manage libraries instead of having each user specify the library details in their individual program.  Fortunately, smart clients like SAS Enterprise Guide are metadata “aware” and since you authenticate to those clients when you connect to the server (even if you cache your credentials), it “automagically” navigates through the authentication and authorization process for us.

When clients can't find the connection

But what happens when I submit a metadata libname engine (MLE) library in a program that we submit from the UNIX command line?  For example, let’s say I want to submit the following program:

libname mydata2 META library="metaref";
proc datasets nolist nodetails;
   contents data=mydata2._all_;
run;

But no worries, we can fix that pretty simply, by using a SAS options statement before we allocate our SAS library. Here is an example:

options metaserver="mymetadataserver" metaport=8561 metauser="myuserid" metapass="mypasswd" metarepository="Foundation";
libname mydata2 META library="metaref";
proc datasets nolist nodetails;
   contents data=mydata2._all_;
run;

So what?  Where is the “best practice” in that?!?

Ok, you could have figured that out on your own (or reading the friendly SAS 9.3 Language Interfaces to Metadata manual!)  What most users struggle with is how to connect to the metadata server when they aren’t exactly excited about adding this bit of extra code into their programs and, more importantly, how do they deal with the whole password thing since they don’t want passwords floating around in free text?

One option would be to use the same credentials for everyone when you connect to the metadata server.  I don’t recommend this option but if you really want to do this, take a look at the documentation, specifically the section entitled “Specifying Connection Properties Directly”.

For those users who want to write once and use everywhere, we can put the options statement in an autoexec file that just gets run when we invoke SAS.  As you may recall, when you run a SAS program from the command line, SAS looks to see if there is a file called “autoexec.sas” in the current directory and if so, runs that. Otherwise, it looks to see if there is a file called “autoexec.sas” file in your SASROOT directory and if it exists, it will run that (but not both!)

If you want to put the options statement in a more general autoexec (e.g., !SASROOT/autoexec.sas) that gets executed each time SAS fires up, then we will need to make this a bit more dynamic since we are passing in the metauser and metapass parameters to the options statement and you don’t want to use the same account every time someone wants to connect to the SAS Metadata.

Encoding a password for an autoexec file

One practice I have found useful is to create a simple process that encodes the password using PROC PWENCODE and then just including that in your normal autoexec file every time you run a program that requires your credentials.

The process is quite simple if you follow the steps below:

1. Encode your password and save the resulting password in a file.
2. Create a file that reads the password and sets the options statement.
3. Include that file in your program.

Let me show you.

Step 1.

Instead of storing your password in a text file that everyone could read, use the following program to encrypt your password and then set the permissions on that new file so that only you can read it.

filename pwfile '~/pwencode';
proc pwencode in='mypassword' out=pwfile;
run;

Step 2.

Now that we have the password stored in an encrypted and accessible file, we will now show you how to read the file and pass the information to the SAS options statement to be able to connect to the SAS Metadata server.

/* Change these values based on your organization */
%let myuserid=gnelson;
%let myserver=mymetadataservername;
/* Read the password file */
filename pwfile '~/pwencode';
data _NULL_;
   infile pwfile obs=1 length=l;
   input @;
   input @1 line $varying1024. l;
   call symput('dbpass',substr(line,1,l));
run;
/* Specify connection options. Change as needed for your installation */
options metaserver="&MYSERVER" metaport=8561 metauser="&MYUSERID" metapass="&DBPASS" metarepository="Foundation"

Step 3.

Now we are ready to use the options statement wherever we need the connection details for SAS Metadata. For example, using our program above, we change it to now include the program in Step 2.

%include '~/dbpass.sas';
libname mydata2 META library="metaref";
proc datasets nolist nodetails;
   contents data=mydata2._all_;
run;

Retrieving connection details: alternatives

For those that have been using SAS for any length of time may quickly realize that there are many other options for handling passwords including storing the passwords in databases, retrieving them from a corporate identity management service such as LDAP or Active Directory or using the AUTHDOMAIN option as outlined in Usage Note 38204 or in Chris Hemedinger’s post "Five strategies to eliminate passwords from your SAS programs". In addition, you could use the METACONNECT= and METAPROFILE= system options as described the connection options for metadata documentation.

So, now it’s your turn. How do you help your users manage metadata credentials for SAS Clients that are not metadata aware?

Until next time, Happy Data!

--greg

Think bad dates aren’t a big deal? Think again. Shao likens them to headaches, which could be a symptom of a common cold, or, as he cautions “a complication of brain cancer.” Fortunately, he says that the log file is an excellent indicator of the data’s overall health can be used to prevent this potentially-fatal diagnosis.

Unsure as to whether or not your data is in good health? View Shao’s winning paper for a step-by-step guide on bad dates and give your data a routine checkup.

Image provided by Peter Hellberg//attribution by creative commons

• The SAS client applications must know the SAS server name (or at least an alias) and port where services are listening.
• The SAS client applications store the SAS server name and port for services that are required in configuration files or in metadata.

For most grid-enabled installations, when a SAS server is taken offline or fails to start, those services are protected by failover mechanisms and restarted on a different server. If server names and identities are stored in the client application or metadata, how can the connection be restored? Well, as SAS administrator, you have to manually update the SAS client application’s configuration information or SAS Metadata definitions with the new location—not an easy task for a business user and not manageable for large enterprises.

There are two solutions to enable client applications to access lost services regardless of whether the service is running on a primary or a failover server:

• a hardware solution using a virtual IP switch or IP load balancer
• a software solution using DNS resolution

In this post, I'd like to detail more about a hardware solution for avoiding lost servers!

Normal connection sequence

Finding the IP address for a server name is referred to as resolving the IP address and is built into the operating system’s networking software. Let’s see what happens under the covers when a client such as SAS Management Console tries to resolve the SAS Metadata Server's name.

1. SAS Management Console makes a request to connect to the SAS Metadata Server on sgcwin071.exnet.xyz.com on port 5555.
2. The networking software determines the physical IP address for the sgcwin071.exnet.xyz.com name and returns it to SAS Management Console.
3. The connection request is properly routed to the physical server where the SAS Metadata Server is running.

Connection sequence with a virtual IP switch

The virtual IP switch, or IP load balancer, is a hardware device that serves as an intermediary between a client application and the services running on the grid. In effect, they help decouple the grid operation from the physical structure of the grid. When the client application wants to connect to the service, it connects to the load balancer, which then redirects the request to the appropriate host machine running the service. Common IP switches on the market include Cisco, F5 BIG-IP or Barracuda Load Balancer.

Here's the connection sequence between SAS Management Console and SAS Metadata Server with a virtual IP switch in place:

1. SAS Management Console makes a request to connect to the SAS Metadata Server on meta_alias on port 5555.
2. The networking software determines the physical IP address for the meta_alias name, which is actually an alias setup pointing to the virtual IP switch, and returns it to SAS Management Console.
3. SAS Management Console sends the connection request to the virtual IP switch for the IP address: 10.0.0.2.



4. The virtual IP switch is configured to forward requests for the IP address 10.0.0.2 to the primary or secondary server based on which server is listening to port 5555. In this case, sgcwin071 is running the SAS Metadata Server on port 5555, so the request is forwarded to the IP address 123.456.78.90, and the connection is completed.

Connection sequence with IP switch with failover

Now let's look and the connection sequence when one of the servers in the configuration fails, for example, sgcwin071. The grid has been configured to restart the SAS Metadata Server on the failover server, in this example, SGCWIN072.

The SAS Management Console client application runs follows the same connection pathway as always; however, the virtual IP switch recognizes that port 5555 is open on sgcwin072, not sgcwin071. Therefore, the switch forwards connection requests for 10.0.0.2 to IP address 123.456.78.91.

The end user does not know, but now the application has reached a different server! There's no disruption in service, and no action required by the SAS administrator.

Advantages of a hardware solution

The advantages of a virtual IP switch are evident:

• It provides a single virtual IP address for critical applications to clients.
• It provides quick failover because switching incoming traffic to the failover host is nearly instantaneous.
• SAS clients don’t need to know where applications are running.

This solution may be more expensive, since organizations have to purchase and maintain additional hardware. Additionally, to avoid that the virtual IP switch itself becoming a single point of failure, the installation would be required to have at least two of them.

In my next post, I’ll show how to achieve the same result with a software implementation. Stay tuned!

--Edoardo

My experience with the Mentoring Program, as a mentoree was excellent. I signed up for the program because the idea of working with someone experienced was too good to pass up. And it was entirely affordable since it didn’t cost anything!  After sending drafts of my outline and paper, my mentor soon replied with insightful comments and suggestions. He wrote things like, ‘remember to include a paragraph about X and Y,’ and ‘be careful with too much detail here.’ His comments were perceptive and especially tailored to my paper.

My paper and presentation, as a result of participating in the Mentoring Program, were much improved. As a result of this marvelous experience, I’ve decided to help others by coordinating this year’s Mentoring Program for MWSUG.   Don’t forget – the MWSUG 2013 call for papers closes on June 15, and the Mentoring Program is here to help you do your best!

Even though SAS Global Forum 2013 has come and gone, all of the papers and presentations are still available online. Out of this fantastic group of submissions, only a handful can be awarded Best Contributed Paper. Each of these winning papers represents the very best in its category as a can’t-miss insight into the world of SAS and SAS software.

Read, learn and enjoy!

Applications Development - Best Contributed Paper

Macro Quoting to the Rescue: Passing Special Characters
Mary Rosenbloom, Art Carpenter

Applied Business Intelligence - Best Contributed Paper

Escape from Big Data Restrictions by Leveraging Advanced OLAP Cube Techniques
Stephen Overton

Beyond the Basics - Best Contributed Paper

RUN_MACRO Run! With PROC FCMP and the RUN_MACRO Function from SAS® 9.2, Your SAS® Programs Are All Grown Up
Dylan Ellis

Data Management - Best Contributed Paper

SAS® Data Integration Studio: The 30-Day Plan
John Heaton

Data Mining and Text Analytics - Best Contributed Paper

Using Classification and Regression Trees (CART) in SAS® Enterprise Miner™ for Applications in Public Health
Leonard Gordon

Honorable Mention

Variable Reduction in SAS® by Using Weight of Evidence and Information Value
Alec Lin

Foundations and Fundamentals - Best Contributed Paper

Don’t Let a Bad Date Ruin Your Day: Dealing with Invalid Dates in SAS
Lucheng Shao

Pharma and Healthcare - Best Contributed Paper

Estimating Patient Adherence to Medication with Electronic Health Records Data and Pharmacy Claims Combined
Beinan Zhao, Eric Wong, Lathan Palaniappan 

Planning and Support - Best Contributed Paper

Communicating Standards: A Code Review Experience
David Scocca

Posters - Best Contributed Paper

Gee! No GTL! Visualizing Data with the SAS Graph Template Language
Ted Conway

Quick Tips - Best Contributed Paper

Graph Your SAS® Off
Karena Kong

Reporting and Information Visualization - Best Contributed Paper

A Concise Display of Multiple Response Items
Patrick Thornton

SAS^® Enterprise Guide^® - Implementation and Usage - Best Contributed Paper

Destination Known: Programmatically Controlling Your Output in SAS® Enterprise Guide®
Aaron Hill

Statistics and Data Analysis - Best Contributed Paper

Multilevel Reweighted Regression Models to Estimate County-Level Racial Health Disparities Using PROC GLIMMIX
Melody S. Goodman, Lucy D’Agostino

Systems Architecture - Best Contributed Paper

SAS® Release Management and Version Control
John Heaton

Setting up the basics.  Heaton uses the open source Subversion (SVN) server to maintain current and historical versions of source code and other software elements. Because most SAS 9.3 software tools don’t provide native support for Subversion, he uses TortoiseSVN interface to manage releases. The folder structure in Subversion is relatively straightforward. Heaton recommends defining repositories for each source environment (such as development) and target environment (such as testing). Within each environment, he recommends setting up a baseline folder for complete code and backups and a releases folders for each incremental push of software. SAS Data Integration Studio is one product that does integrate with Subversion through a set of plug-ins for CVS version control and there are step-by-step details for incorporating these as well as Base SAS batch import and export tools.

Using version control.  The ability to archive software as files or objects in SAS Data Integration Studio enables developers to track development changes at a granular level. Heaton walks through the steps for archiving and comparing files and explains some of the benefits and drawbacks of the process.

Promoting an initial release.  Once development is complete and code is ready to promote from the source environment to the target. Some tips for successful handling of a full export include:

• Create a root folder that contains all your code.
• Ensure your source and target environments are as identical as possible.
• Determine if you need to replicate security in your target environment.
• Remember to set up security for objects once moved and redeploy an jobs necessary.

Handling batch releases.  Heaton offers these insights for an effective release management process:

• Changes and code should be captured at the lowest practical level in the version control repository.  However, the import-export process in SAS creates a single file for all objects.
• Incremental or patch releases are recommended as a practical work-around.
• Plan incremental releases on a regular schedule and number each release using a date-based format.
• Use a Releases folder and standard naming conventions to support use of automated scripts.

See these additional SAS Global Forum 2013 papers for release management and version control topics:

•   SAS® Virtual Desktop Deployment at the US Bureau of the Census
•  Consistent and Organized Analysis: Moving Beyond Pie-in-the-Sky to Actual Implementation via SAS® Enterprise Guide

Data security is a global concern, and configuring SAS in a distributed computing environment with enhanced security and regulatory controls is a challenge SAS administrators must face more frequently. To meet today’s more stringent requirements, SAS administrators must understand the different technologies available for securing individual components of the architectural stack—options for all SAS components as well as options for any third-party components and tools.  In his most recent paper, Bigalke offers these suggestions and documents his approach for securing a multi-tier installation of SAS software in a Linux environment:

•  Understand the explicit security needs of the organization and the options available for meeting those needs.  Bigalke based his configuration on meeting FIPS 140-2 requirements of the US government computer security standard.  
• Use single sign-on to minimize the need for providing user credentials. SAS Web applications and clients generally require users to enter credentials. 
• Protect the Web components using reverse proxy and TLS/SSL signed certificates.  Web components are generally the most exposed, and these techniques will not only secure the connection but also be more convenient to the end-user.
• Configure SAS clients, SAS metadata, Base SAS and third-party data sources using appropriate authentication options.  SAS 9.3 components that use WIP Services to connect to the SAS System offer direct LDAP authentication.  You may also want to explore JAVA-based versus standard SAS-based functions for securing connections using TSL/SSL protocols.  

 Other SAS Global Forum 2013 papers that cover security topics include:

•  Key Aspects to Implement a Perfect SAS® BI Platform
•  Kerberos and SAS® 9.4: A Three-Headed Solution for Authentication
•  π in the sky: Building a private SAS® cloud
•  Extending SAS® Reports to your iPhone

For the more information on security and configuration options, here’s a handful of recently published SAS configuration guides:

• Configuration Guide--SAS® 9.3 Foundation for UNIX® Environments
• Configuration Guide: Securing SAS® Web Applications with SiteMinder
• Configuration Guide for SAS® 9.3 Foundation for z/OS®

Image provided by thebittenword.com//attribution by creative commons

Within SAS, divisions and teams use Agile in different ways; its nimbleness allows for varying degrees of adoption or implementation. For example, since 2008, R&D teams have been using Agile for requirements management, product implementation and project tracking. Planning is simplified with Agile. Potential product or solution features, known as stories, are ranked and scheduled in a release plan. Then they are assigned to an iteration or sprint (usually 2-4 weeks in length) in the development life cycle.

One of the main benefits of Agile development is that it fosters more cross-functional activity and collaboration, that is, a higher level of engagement and commitment. For example, for any given iteration, developers, testers and product managers work closely together and share updates several times a week in meetings called scrums. At the end of each iteration, all stakeholders sign off on features, and demos are given to internal or external stakeholders, showing the software in proper working condition.

Agile methodology was highlighted as a key development strategy at the Business Intelligence Development Roundtable at SAS Global Forum 2013. Business Intelligence R&D teams adopted Agile when they set out to create SAS’ data visualization software, SAS® Visual Analytics. Developing a new product like Visual Analytics required a nimble approach. Agile’s short, time-bound iterations allowed SAS product developers to incorporate user feedback more quickly and focus more on what worked.

In 2012, senior project managers at SAS surveyed SAS development teams to determine the effectiveness of Agile approaches. Seventy-eight percent of respondents said they would recommend Agile to another team. The survey reported that stronger adoption of Agile methods drives higher productivity and a deeper sense of engagement among teams.

In April 2013, Tim Arthur, Agile champion within SAS Research & Development, presented the results of that survey at the Stanford Strategic Execution Conference. Arthur heard from several Silicon Valley companies that SAS is ahead of the curve and viewed as a model for Agile adoption and scaling. If you're interested in learning more about SAS' approach, you can download Arthur's white paper Agile Adoption: Measuring its Worth.

Does your organization use Agile?  Leave a comment to tell us about your experience or ask for more information about SAS' implementation of Agile.

My coworker's note reminded me that new SAS adminstrators join the ranks every month so it seems like a good time to compile a list of online resources.  If I've overlooked your favorite, please share with everyone by commenting on this post. 

For connecting with other SAS administrators, there are several good options:

• SAS Deployment Community on support.sas.com
• Several LinkedIn groups but a couple of familiar ones are SAS Administration Team and SAS Architects/Administrators/Implementation Specialist
• SAS Blogs tagged for administrators such as the Wednesday series you're reading on SAS Users Groups as well as the SAS administration topics on The SAS Dummy.
• Blogs hosted by SAS users such as Paul Homes' platformadmin.com and Andrew Ratcliffe's NOTE: blog.

If you're responsible for installing and maintaining a SAS installation, you will find most of the information necessary to accomplish your tasks on these support.sas.com sites:

• System Requirements
• Install Center
• Third-Party Software Support
• System Administration topic in Samples & SAS Notes
• Migration Focus Area

 Prefer videos?  SAS Talks On Demand offers several videos for the SAS administrator. 

•  SAS® 9.3 Features and Functionality for Platform Administration
• Best Practices in SAS^® Administration 
• Best Practices for Configuring Your IO Subsystem for SAS®9 Applications

 And, of course, don't forget training and documentation:

•  Courses and training paths for the administrator
• SAS Global Certification program for platform administrators
• Product documentation for the SAS Intelligence platform

 Please let us know how SAS can continue to support this important role.

SAS Global Forum is one of the largest user-based conferences, and it has amassed a lot of treasure over the past three decades. Each year, the locale and the conference theme change to meet the current needs of SAS users. While the 80’s "large volumes" may have been associated more with the "big hair" trend, the 2013 conference was fashionably bigger and interested in large volumes of another kind--Big Data and Big Analytics!

To reflect the title of Dr. Dave Dickey’s paper, SAS conferences are all about finding the gold in your data. And like the information in Dr. Dickey’s paper, there are numerous conference treasures in the form of Paper Presentations, trend-setting interviews with industry leaders on Live Reports, geek wisdom on Tech Talks, on-site interviewers with SAS attendees and many other cool videos captured on demand for later viewing.

SAS Global Forum Take-Out is another treasure that offers a selection of some of the best audio presentations from the conference. For those of you primarily interested in reading technical papers and posters, we have it all! Proceedings for 38 conferences from 1976 to 2013 have been archived for your reading pleasure.

The meetups and networking events at the conference inspire each one of us differently. If you are inspired and interested in learning more about your local users groups and participating at similar engagements, take a look at the Happenings page. It has all the current information on customer events, SAS Talks, users groups, newsletters, blogs and much more. It’s a goldmine. The more you dig, the more gold you find!

We hope you find these SAS resources helpful and find creative ways to reap the benefits of this "pot of gold" by reading, commenting and sharing with your network.

 Image provided bySin Amigos//attribution by creative commons

To borrow a quote from Ron Burgundy in the movie Anchorman -  "I don’t know how to put this, but SAS 9.4 is kind of a big deal."   So why is SAS 9.4 a big deal?  

Presenters at Global Forum shared some of the SAS 9.4 story and there are many, many new features I could include here, but these are some of my favorites so far: 

• Clustering  support for the metadata and middle-tier servers enabling scalability and higher availability.  Through server clustering, where multiple servers manage copies of the same data, the threat of data loss or whole-system downtime is drastically reduced. Clustering also allows users and tasks to be spread across the clustered environment to distribute the workload and improve performance.
• Introduction of SAS Environment Manager, which provides SAS administrators with a deeper understanding of their SAS deployments  and increased capabilities to monitor and manage their SAS servers. Through a plug-in interface, SAS Environment Manager deploys software agents on each managed SAS server and interacts with these agents to gather health and availability information, perform resource control actions, collect server resource usage, and more.
• For mobile  delivery of SAS reports, there are the new options in Base SAS Output Delivery System (ODS) EPUB support. With ODS EPUB you can output SAS reports as e-books that can be read with iBooks on the iPad and iPhone.  Additionally, support is provided for output to HTML5 and Microsoft PowerPoint files.
• DS2 sessions and demos were highly attended as SAS programmers were interested in hearing about the new SAS programming language that allows code to be submitted from Base SAS sessions to run in-database to perform advanced data manipulation without moving the data out of the database.
• In the Opening Session, SAS CEO Jim Goodnight explained, “SAS 9.4 allows your IT team to deploy SAS with confidence that it meets the requirements for security, authentication, scale and resiliency.”  Attendees were interested to learn more about middle-tier and metadata server clustering, scalability support and increased authentication support in SAS 9.4.
• Goodnight’s statement during the Opening Session, “SAS 9.4 delivers cloud-friendly architecture,” added to considerable interest in the new SAS Cloud tools and technologies, including SAS App Central, SAS App Engine, SAS vApp technology and SAS Web Editor.  Cloud-friendly SAS enables rapid deployment of SAS in cloud environments, provides simple management tools and processes, and promotes innovation through a SAS cloud development platform.
• The SAS Web Application Server embedded in SAS 9.4 reduces overall cost and complexity of SAS deployments. By eliminating the cost to acquire, integrate,  maintain and support third-party software, the SAS Web Application Server saves you money and time.  By reducing integration complexity and embedding software optimized for SAS, the SAS Web Application Server provides right-sized, integrated technology that simplifies IT management and makes your SAS environment cloud-ready.
• Availability of High-Performance Analytics procedures (HP PROCs) to customers running on a single server. Customers will be able to leverage the performance benefits of multi-core computing as they take advantage of these new HP PROCs. An added benefit of the HP PROCs is that when you grow your SAS deployment from a single server to multiple servers, your high-performance code automatically scales to run in your multi-server, distributed environment.
• A Decision Management user experience that combines data management, business rules management, data lineage, orchestration and more – all from within one unified user interface.

Which SAS 9.4 topic is the "biggest deal" to you? Which topics would you like to hear more about prior to the June release?

There is plenty to say about SAS 9.4.  Be sure to check back for more information!

Why should you pre-assign SAS libraries?

As outlined in the SAS 9.3 Intelligence Platform: Data Administration Guide, there are two ways you can make sure that your server is aware of your library reference: 

• pre-assigning the library
• letting the client application define the library reference

Even if you use a LIBNAME statement in your program, it is useful to register SAS libraries and tables in SAS metadata so that they can be used by some of the SAS clients (for example, SAS Data Integration Studio). We saw this demonstrated in our last article when we assigned a libref through a LIBNAME statement versus one assigned in SAS metadata.  Different clients may assign libraries differently, such as SAS Data Integration Studio or SAS OLAP Cube Studio where the library can be automatically generated based on the metadata. 

When you pre-assign a library, you are making explicit which engine will be used to control the library (such as BASE or ORACLE). Pre-assigning the library has a number of benefits:

• Pre-assigning librefs helps maintain consistency across users and applications
• Libraries are always available to the server, regardless of how the program is run (batch versus interactive)
• Libraries are easier to migrate to new storage since the physical location can be abstracted from the user
• Pre-assigning libraries makes it easier for developers to eliminate redundant code (for example, not having to manage library references in stored processes)

As discussed last time, if you don’t pre-assign our library and try to use that library in SAS Enterprise Guide, you get an error.

PROC Print data=metaref.postassessments;
run;
ERROR: Libname METAREF is not assigned.

To see this libref as “Assigned” when connecting to the server, you would need to pre-assign the library.  This action tells SAS to run the assignment code on the server whenever the server is started. If you select “Library is Pre-assigned” in the Advanced options (SAS Management Console→Data Library→ Manager→<Library> Properties), you see three Pre-Assignment Types listed:

• By native library engine
• By metadata library engine
• By external configuration

Understanding three methods for pre-assigning libraries

So which of the three options are right for your libraries? Here is a nice graphic and description of what really happens behind the scenes when you access a library governed by one of these processes.  

Key to understanding these choices is to knowing the difference between the Metadata Library Engine method (option 2 above) versus the other two approaches that use the native engine. 

• In the case of the native engine, the system does not check the SAS metadata to see if the user has read access on the table; however, it does check the physical security and whether the user has permission to ReadMetadata. When you use a native engine, the data-level authorizations of Read, Write, Create, and Delete are not checked.
• If you want to use the metadata authorization layer to control Read, Write, Create, and Delete permissions, then you must pre-assign the library and use the Metadata Library Engine method. But remember, operating system level file permissions should always be considered whether you use the SAS Metadata Libname Engine or the underlying native engine.
• Additionally, as we have noted, it is not always efficient to pre-assign every library that you might want to use. (In fact, a little birdie reminded me that too much of good thing may affect performance.) You should determine which libraries will actually be needed before you choose to pre-assign them. You should also set READMETADATA privileges to limit which libraries a group of users sees, as not everyone needs every library.
• One related area you may want to consider is the notion of read-only access. You will note that in the properties for a library, you have the option of specifying the library as READONLY. This capability augments the metadata permissions on the library or table in the fact that it eliminates the possibility of anyone writing to or destroying elements contained in the library – even if they have metadata permissions to do so.

In the discussion that follows, I will focus only on the mainstream servers (Workspace Servers, Pooled Workspace Servers, Stored Process Servers, SAS/SHARE servers and OLAP servers) as these servers automatically read metadata when they start and assign the libraries. You will have to edit the server configuration files if you want these to be read by other servers such as SAS/CONNECT, SAS Data Step Batch Server or SAS/IntrNet.

So let’s summarize the three assignment options in SAS metadata and explore how each one works and why we would select one over another.

By Native Library Engine

When you select the native library engine as the Pre-Assignment Type, you will notice that, in SAS Enterprise Guide, the client immediately has access to the library and the defined metadata tables.

The library is assigned when the SAS session starts and referenced through a SAS System Option called METAAUTORESOURCES. SAS uses the library engine defined for the library in SAS metadata. As noted above, the data-level authorizations are not checked in the SAS metadata. To illustrate this, we will set the metadata permissions in this example to read only.

Then we will try to replace the table.

Here, you notice that despite the metadata permissions of Read and ReadMetadata, the user was able to delete the dataset. As we mentioned above, if the native engine is used to access the table, then metadata permissions are not evaluated. 

Note: For SAS 9.3, SAS has added a feature called metadata-bound libraries, which cannot be overridden. Metadata-bound libraries offer better protection than do other metadata-based approaches to access control because the enforcement begins with the physical data. The enforcement occurs regardless of how the user requests access to the data (metadata clients such as SAS Web Report Studio or direct (through a LIBNAME statement submitted from SAS Enterprise Guide). For more information, see the documentation for metadata-bound libraries.

By Metadata Library Engine

When you select the Metadata Library Engine as the Pre-Assignment Type, the library is similarly assigned through METAAUTORESOURCES options; however, this option uses the Metadata Library Engine that ensures access controls that are placed on the library and its tables and columns are enforced. Here, we submit a simple DATA step that tries to replace an existing dataset. Note that our metadata permissions did what they were supposed to do.

By External Configuration

The third and final option for pre-assigning libraries is to use an external definition or an autoexec file. This method essentially makes the library available to client applications but moves the code out of the user interface to an external file. This option is particularly useful if you want to manage your configuration outside of SAS metadata or share the configuration among multiple services such as SAS/Connect.

Four questions to help choose the best method

Since I am a visual thinker, I also thought it might helpful to show these comparisons in a flow chart. Admittedly, this is a simple set of decisions, but the chart should help you decide which pre-assigned library option might be best for your case.

Hopefully, this post was a useful discussion, and you know a bit more about what it means to pre-assign libraries and how the various options affect whether users can read or both read and write data.

Happy Data!

--greg

SAS users from all over the globe were accustomed to meet-ups and team building at conferences to talk about SAS, software and solutions. But the team that came together this time had a different agenda in mind. A team that believed in giving back to the local community as much as it got from the opportunity to gather in San Francisco to reconnect and learn from each other. The Build-a-Bike charity event was one such moment that brought back childhood memories and the carefree joys of riding a bike.

Attendees scattered into smaller groups armed with wrenches and excitement to assemble bikes for underprivileged children in the San Francisco area. . “I love bicycles, I cycle to work” said one such enthusiastic attendee stating that every time she comes to the conference, she meets new people and learns a lot. They built 50 bikes for young boys and girls in an hour. The mood was upbeat and it gave everyone involved a rare opportunity to connect outside of work, re-live their childhood and, most importantly, bring big smiles on the faces of some very lucky children. Many thanks to the participants for making this a memorable event and certainly one of the highlights from the conference.

What was your memorable moment from the conference and how would you like to give back to the community? Please share.

According to Berryhill, there are two very important things you can do to make the best of your time and those who look at your code later: Make sure your code is clear and correct. "To me, the main thing is correct. If the answers are wrong, it doesn't matter how you got there," he says.

Here are three of his tried-and-true tips:

1. "I like to use the %LET, particularly at the top of my code where variables are going to change," says Berryhill. He use a series of the %LET at the top of the program to remind him of changes he needs to make.
2. The NOBS option tells you how many observations you have in a dataset. According to Berryhill, the option is most useful when NOBS is 0. "If you try to do a PROC PRINT or a global dataset, you set that empty dataset, and Boom you're gone. (This only works for disk files, not views or tapes.)"
3. Try your luck. When he isn't on a tight deadline, Berryhill says that he likes to experiment with code just to see if it  works. Recently, he found that the double question mark will suppress expected errors in the input function. "I was surprised to find out that it is also supported in a statement."

Read 27 more of Berryhill's SAS tricks in his paper, "30 in 20 things you may not know about SAS."

Koketso Moeng says that Statistics South Africa has allowed its users to access internal sites from their smartphones for some time, but reading text heavy reports and tables on an iPhone can be frustrating. And even in the areas on the website where they were using visualization, the information still wasn't as accessible as they would have liked.

Choosing a platform

Moeng says the team had to carefully consider the level of security that would be offered. "We have a lot of very sensitive information that should not be released before it's time," he said.

Additionally, Statistics South Africa had to ensure that the platform integrated with its existing infrastructure.  "We have invested a lot of money in our SAS environment and our operating environment," Moeng said. "So whatever we bring into that environment must integrate - you don't want to have to reshuffle things just to bring an additional tool into your environment."

Finally, Moeng's team wanted to make sure their users were happy with the platform so they would use it. They conducted focus groups to test the mobile BI on several platforms. "We said, 'Play around with these tools and give us feedback. Which ones do you like? Why do you like them? and Which one is most appealing to you?'"

Pinch, swipe, tap

They decided to go with Roambi because of the easy interface and many of the end-users were already using the iPad and iPhone. Moeng says there are "two flavors" of Roambi: Roambi Analytics produces beautiful graphics and with Roambi Flow, you can embed those graphics. This gives the end-user an interactive document that gives context to the data visualization.

"Configuration is very easy," says Moeng. In a SAS Enterprise Business Intelligence environment, it takes only a matter of minutes to configure. (Roambi runs off TomCat and MySQL.) Roambi uses the URL from your SAS Web Report Studio environment to interact with SAS.

As you can imagine, Roambi is touch-enabled - pinch, swipe and tap to access and manipulate the reports. Moeng did his entire presentation using Roambi Flow on an iPad.

In Moeng's paper, "Extending SAS Reports to your iPhone," you can read more about publishing reports and giving access to your end-users. Also check out what SAS Visual Analytics can do on the mobile.