SAS Viya: General Authorization Window

Introduction

Use this window to set permissions on folders, reports, and other content objects.

For concepts and background information, see General Authorization: Overview in SAS Viya Platform: General Authorization.

Navigation

Here is one way to access the Authorization window for content objects:

1. In the applications menu (), under ADMINISTRATION, select Manage Environment.
2. In the vertical navigation bar in SAS Environment Manager, click .
3. On the Content page, locate and select the object.
4. In the toolbar at the top of the navigation pane, click , and select View Authorization or Edit Authorization.
   Note: Some items on the Content page do not participate in general authorization. For example, you cannot set permissions on a virtual folder.
   Note: If Edit Authorization is not available, you are not authorized to modify access to the selected object.

Examine Access

For each principal and permission, the following icons describe effective (net) access to the current object:

The scope of the display is as follows:

• There is always a row for Authenticated Users.
• There is always a row for you, the currently connected user who is using the display.
• There is a row for each principal that is assigned to a rule that affects access to the current object. The exception is that internal service principals (for example, sasapp or sas.folders) are not displayed in the Authorization window.
• If you add an identity and do not give that identity at least one direct setting, that identity is automatically removed from the display.
• You cannot directly remove a row. If you remove all direct settings for an identity and there is no other reason for that identity to be displayed, that identity is automatically removed from the display.
• For a non-container object (such as a report), only the Read, Update, Delete, and Secure permissions are displayed. The Create permission is not applicable to an individual content object.
• For a container (such as a folder), two sets of permissions are displayed:
  • The first set of permissions affects access to the object, including the ability to add members to and remove members from the object. This set of permissions has no effect on the folder’s members.
  • The second set of permissions affects the access that this object conveys to its child members. See Inheritance in SAS Viya Platform: General Authorization.
    TipAn effective access value of Not Authorized on the conveyed side of a folder’s Authorization window does not guarantee that access to child members is not authorized. A direct setting on the child or another influencing rule might provide access to the child member. For example, when you create a top-level folder, the effective access values on the conveyed side for SAS Administrators are all Not Authorized. However, SAS Administrators does have effective access to a folder that you add below the top-level folder. That access comes from a predefined rule that gives SAS Administrators access to all folders.

Provide Access

1. Open the Edit Authorization window for the target object.
2. If the principal that you want to work with is not already listed, click .
   Note: If guest access is enabled, you must select either Add Identities or Add Guest after you click .
3. Click an effective access icon (for example, ).
4. In the pop-up window, select Grant as the direct setting.
   Note: If you cannot change a direct setting, you do not have Secure permission for the current object.
5. In the Edit Authorization window, click Preview. Examine the impact of your unsaved change.
   Note: If there is a relevant prohibit setting anywhere in the system, that setting has precedence over the direct grant that you added. In that case, the effective (net) result is Not Authorized (), and a diamond () is not displayed.
6. Click Save.

You can also apply direct grants for all permissions for a principal. See Add Direct Grants of All Permissions for an Identity.

Limit Access

Any access that is not granted is implicitly denied. The preferred approach is to grant selectively and to avoid use of prohibit settings.

If you must add a prohibit setting, make sure that you do not inadvertently block your own access, particularly for the Read and Secure permissions. If you do block your own access, see General Authorization: Troubleshooting in SAS Viya Platform: General Authorization.

Add a Condition

To provide access within a particular scope or set of circumstances, add a condition.

1. Open the Edit Authorization window for the target object.
2. If the principal that you want to work with is not already listed, click .
   Note: If guest access is enabled, you must select either Add Identities or Add Guest after you click .
3. Click an effective access icon (for example, ).
4. In the pop-up window, select Conditional Grant.
   Note: A conditional prohibit setting does not provide access. A conditional prohibit setting blocks all access within its scope, regardless of any more specific grant settings. A conditional prohibit setting can limit access that is provided by a grant or conditional grant setting.
5. In the Condition window, create an expression that specifies the scope and circumstances in which access is granted. Your syntax is validated when you click OK. See Rule Conditions in SAS Viya Platform: General Authorization.
6. In the Edit Authorization window, click Preview. Examine the impact of your unsaved change.
7. Click Save.

Edit a Condition

1. In the Edit Authorization window for an object, click the effective access icon for the direct conditional setting that you want to modify.
2. In the pop-up window, next to the Conditional Grant or Conditional Prohibit direct setting, click .
3. In the Condition window, edit the expression. Your syntax is validated when you click OK. See Rule Conditions in SAS Viya Platform: General Authorization.
4. In the Edit Authorization window, click Preview. Examine the impact of your unsaved change.
5. Click Save.

Delete a Condition

1. In the Edit Authorization window for an object, click the effective access icon for the direct conditional setting that you want to delete.
2. In the pop-up window, next to the Conditional Grant or Conditional Prohibit direct setting, click .
3. In the Condition window, delete the expression. Click OK.
4. In the Edit Authorization window, click Preview. Examine the impact of your unsaved change.
5. Click Save.

Remove a Direct Setting

1. Open the Edit Authorization window for an object.
2. In the cell that has the direct setting that you want to remove, click the effective access icon. In the pop-up window, select (none) as the direct setting.
   Note: If you cannot change the direct setting, you do not have Secure permission for the current object.
3. In the Edit Authorization window, click Preview. Examine the impact of your unsaved change.
   Note: Any identities that are no longer principals are automatically removed.
4. Click Save.

You can also delete all direct settings for a principal. See Remove All Direct Settings for an Identity.

Identify the Source of Effective Access

To determine which rules and shares contribute to a particular effective access result, examine the origins information for that result.

1. Open the View Authorization window for the target content object.
2. Click the effective access icon for which you want origins information.
3. In the pop-up window, the Contributing Rules tab provides a read-only display of all applicable rules, except share-based rules. Here are tips:
   • If the Edit Authorization window contains pending changes, the Contributing Rules tab is disabled.
   • To view additional details, add columns to the table. Click and select Manage columns.
4. In the pop-up window, the Contributing Shares tab provides a read-only display of all relevant shares. Here are tips:
   • If sharing is disabled, the Contributing Shares tab is not displayed.
   • To view additional details, add columns to the table.

Details for Share-Based Authorization Rules

Shortcuts for Adding and Removing Settings