Controlling access to custom tasks in SAS Enterprise Guide

I've bragged about how easy it is to install custom tasks for SAS Enterprise Guide. It's simple: you copy the .NET assembly (usually a single DLL file) into one of the designated folders in your SAS Enterprise Guide installation, and your task just shows up in the menu. Since I have made several custom tasks available for download from this blog, it's possible for users to spend just a few minutes to acquire capabilities that they didn't have before. (By the way, this also applies to the SAS Add-In for Microsoft Office.)

This can trigger anxiety for some SAS administrators. A custom task, despite it's usefulness, might work against the policies of those who maintain a SAS environment. For example, the Copy Files task makes it very easy to move files between your SAS server and your local PC. Some organizations don't want server-based files to leave their controlled server environment, so this type of custom task is a thorn in their side.

Fortunately, SAS administrators can control access to these capabilities by defining roles in SAS metadata, and then associating those roles with users or groups of users. Each role has a list of capabilities that are permitted. If a user's role doesn't permit a certain capability, then that feature simply doesn't appear in the SAS Enterprise Guide user interface.

Custom tasks are a special case for administration. A custom task is a new capability, and so by definition it's not known to SAS metadata. If it's not known, how can you control it? You accomplish it by following these general steps:

  1. First, examine the capability named Access Unregistered Custom Tasks. Do you want your users to be able to add their own tasks? Even if you allow this, you can still "disallow" certain custom tasks if you register them in metadata.
  2. Next, register the custom tasks that you want to control into SAS metadata. SAS Enterprise Guide provides a tool to do this. (It's not in SAS Management Console.)
  3. With the task now listed in SAS metadata, use SAS Management Console to control which roles (and therefore, which users) have the permission to run the task.

    In the remainder of this post, we'll explore these steps...in pictures.

    In SAS Enterprise Guide, select Tools->Add-In Manager to register the task on one machine

    It's important to use Add-In Manager (not the easier "drop-in" deployment) for this step, as it updates a version of the local SAS Enterprise Guide task list so that it contains information about the task.

    In SAS Enterprise Guide, select Tools->SAS Enterprise Guide Explorer and use the Task Import Wizard

    SAS Enterprise Guide Explorer provides this special tool that can examine the local task list (which now contains your custom task) and identify the "new" tasks that are not yet part of the SAS Metadata Server. This tool allows you to add those new tasks into the metadata-controlled list.

    In SAS Management Console, edit role to disallow unregistered custom tasks

    This step is optional -- if you don't want your end users to add any custom tasks on their own. You can restrict access to any custom tasks that you add to SAS metadata.

    In SAS Management Console, edit role to allow desired custom tasks for appropriate groups

    The new tasks show up under an "Imported Tasks" group. For any given role you can decide whether the task is allowed.

    Result: End user sees "restricted" functions

    Once the settings are in effect, the end user will see that his/her functions are restricted -- as indicated in the SAS Enterprise Guide status area on the bottom of the window.


    The user can click the "Functions" link to see the full list of features that are available in the product, along with an indication as to which are disallowed for the user. The user can use this information to "petition" the SAS administrator for access to additional capabilities, if desired. (Ah, the power of a SAS administrator!)

    tags: SAS Add-In for Microsoft Office, sas administration, SAS custom tasks, SAS Enterprise Guide

    4 Comments

    1. Per Helmark
      Posted March 11, 2013 at 1:19 pm | Permalink

      Following the steps in "Task Import Wizard" (to make capabilities appear in SMC) I get an error in the last step saying:

      "The task named Squeeze SAS data could not be created in the repository.
      Additional information: Object reference not set to an instance of an object."

      Do you know what causes this (the task works fine in EG)?

      • Chris Hemedinger Chris Hemedinger
        Posted March 11, 2013 at 2:08 pm | Permalink

        Per,

        From the error message, I cannot tell. I suggest that you work with SAS Tech Support to investigate.

        In order to add the task to metadata roles, you must be using an account that has privileges to create this metadata entry. Also, the application "roles and capabilities" data must already be present (usually done during application configuration when you install/configure the SAS Metadata Server and SAS Enterprise Guide).

        If either of those conditions are not met, you would receive a more specific error message. I was just able to add the "Squeeze Data" task into my own environment, so I don't think it's an issue with the task.

    2. Xavier
      Posted April 25, 2013 at 4:18 pm | Permalink

      Hi,
      I'm it project manager and i assume responsibility for the deployment of seg 5.1. I would like to propose using "data explorer" for people who make new data quality control. Could you tell me if we have capability to manage "Data explorer" and if we can check the number of process in sas management console with the next version ?
      best regards,
      Xavier

      • Chris Hemedinger Chris Hemedinger
        Posted April 26, 2013 at 11:44 am | Permalink

        Xavier,

        There is an undocumented method for controlling the number of SAS processes that might be used for Data Explorer. I suggest that you contact SAS Technical Support, and they will supply you with the information you need.

        Tasks->Describe->Characterize Data is also very useful for data quality, and Graph->Scatter Plot Matrix is a useful task for understanding relationships between measures -- at a glance.

    One Trackback

    1. [...] use it (or give it to my team to use)? You need to register a custom task in SAS Management Console only if you want to limit who has access to it. By default, any SAS Enterprise Guide user can install and run a custom task simply by "installing" [...]

    Post a Comment

    Your email is never published nor shared. Required fields are marked *

    *
    *

    You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <p> <pre lang="" line="" escaped=""> <q cite=""> <strike> <strong>