Occasionally, you might need to prevent a user or a group of users from using SAS in a way that is reversible by preserving their metadata identity. This document outlines two methods for performing this task.

Method 1: Modifying the Metadata Group / Repository ACT

This method involves creating a Metadata Group to contain users that must be disabled, and modifying the repository ACT to explicitly deny access to the repository.

Note: Because this method blocks permission to metadata objects to function, it results in web application access failing for disabled users with a non-specific HTTP 500 error that indicates the web application encountered an error.

Step 1: Create a Metadata Group to contain the disabled users.

1. Open SAS^® Management Console.
2. On the Plug-ins tab, select User Manager.
3. Select Action ► New, and click New Group.
4. Give the group a descriptive name such as "Disabled Users."

Step 2: Modify the repository ACT to include a definition for the newly created group.

1. On the Plug-ins tab in SAS Management Console, expand Authorization Manager.
2. Expand the Access Control Templates folder.
3. Right-click your repository ACT and select Properties.
   By default, this is set as Default ACT and should have a blue cylinder in its icon identifying it as a repository ACT.
4. On the Permission Pattern tab, click Add to add the Disabled Users group to the ACT.
5. Once added, select the Disabled Users group and in the bottom pane, select the Deny check box for each permission listed.
   Ensure that the background of each check box is white rather than gray, indicating that the denial is explicit.

Step 3: Add metadata users to be disabled to the Disabled Users group.

1. Click the Plug-ins tab in SAS Management Console.
2. Right-click the Disabled Users group and select Properties.
3. On the Members tab, select the users that you need to disable, and use the single-arrow button in the center to move the users to the Current Members pane.
4. Click OK to save the changes to the group.

 

Method 2: Modifying the User's Associated Account

When a user authenticates with SAS^® Metadata Server using an external account, the server process passes the credentials to the external authenticator (this could be the host, or a LDAP/Active Directory) and also checks the credentials used against the accounts listed in its metadata identities. If it finds a match, the session is associated with that identity and its permissions. If not, the user is authenticated within the group PUBLIC, which has limited accessibility. This method results in the disabled users assuming the PUBLIC permissions.

Note: If you have a program in place that synchronizes your metadata identities with an external data source like Active Directory, it might overwrite these changes.

Step 1: Access the Accounts tab of the metadata user's properties.

1. On the Plug-ins tab of SAS Management Console, select User Manager.
2. Right-click the external metadata user identity that you need to disable and select Properties.
3. Click the Accounts tab for the user.

Step 2: Alter the user ID for authentication.

1. Double-click the user ID, or right-click and select Edit.
2. Add a modifier to the user name (x_ for example, making jsmith into x_jsmith).
3. Click OK to return to the User Properties window.
4. Click OK to store the changes in the metadata.

Either of these methods results in the user authenticating, but having no access to the SAS^® environment.