Author: Steve Overton
Migrating users and groups between SAS environments can be a pain if you have a complex security model or a very large number of users and groups to migrate. Manually creating users and groups within SAS Management Console can be done but this leaves room for human error and headache. While it may be possible to write your own code that uses SAS’s user import macros to migrate users, there is a much easier method using SAS Management Console. This post is focused towards the SAS Platform Administrator or anybody looking for ideas on user migration between two separate SAS environments.
Plan A: Create Metadata Package for Migration
As a SAS Platform Administrator, exporting and importing metadata from the “Folder” view in SAS Management Console is a common task. SAS Management Console is very handy for exporting and importing metadata using the SAS package wizards. SAS support has plenty of documentation on exporting and importing metadata packages if you need it.
To export user metadata, simply create an export package from the “/System/Security” folder in metadata or any of the sub folders individually if needed:
You can export pieces of the Security folder but be aware of dependencies!
When importing the package, be sure to import at the same folder level you created the export package from.
Important Considerations
- User doing the migration must have unrestricted access in metadata (sasadm@saspw for example).
- Object dependencies will most likely exist and become very apparent if you try to export/import one set of objects and not the other. Read the log!
- Example: If migrating ONLY users, any groups that do not exist in the target environment will be removed. The log will give warnings mentioning this.
- To avoid breaking nested groups or any other security model requirements, understand dependencies and perform the export/import process in the correct order to ensure required groups, roles, ACTs exist FIRST.
- Paul Homes has additional considerations around migrating ACTs on his platform admin blog.
- If you have problems, they will most likely pop up during the import process. As always, pay close attention to the messages provided in the import wizard to identify any problems. The resulting log is usually very clear on any warning or error.
I’m not positive if security objects were visible from the metadata folders prior to SAS 9.3. SAS 9.3 and 9.4 support exporting and importing users, groups, roles, ACTs, and authentication domains directly in SAS Management Console. Also be aware that exporting/importing security objects will not fully synchronize environments because objects are not removed in the target environment. If you wish to fully synchronize for whatever reason, base SAS programming could potentially accomplish your goals but can open Pandora’s box.
Plan B: Synchronize User Metadata between Environments with SAS Code
I wrote a paper for SAS Global Forum 2012 on how to selectively migrate users from Active Directory to SAS metadata with sample code that uses the %MDUEXTR macro available on my website. Rather than migrating users from Active Directory, in theory it could be possible to extract user metadata from a source and target SAS environment (%MDUEXTR macro), compare the two (%MDUCMP macro), and update the target metadata environment (%MDUCHGLB macro).
I have not tried this yet – but would make a great SAS Global Forum paper! Additionally it would be beneficial to wrap this base SAS code into a stored process and manage using a SAS Server Page. Yet another great usage case for SAS Server pages. Don Henderson has an excellent book on SAS Server Pages if you choose to make the ultimate user management tool for SAS metadata.
Post Need to Migrate Users, Groups, and Roles between SAS Environments? appeared first on BI Notes for SAS® Users. Written by Steve Overton. Go to BI Notes for SAS® Users to subscribe.