synkronisering av ad-brukere med sas metadataserver · synkronisering av ad-brukere med sas...

Synkronisering av AD-brukere med SAS Metadataserver

Abul Ahsan Md Mahmudul Haque

Helse Nord IKT

[email protected]

November 12, 2014

Abul Ahsan Md Mahmudul Haque (HNIKT) AD-synkronisering =⇒ SAS Metadataserver November 12, 2014 1 / 18

Overview

Introduces Active Directory & SAS Metadata ServerMajor features of the synchronization applicationChallenges in Synchronization ProgramLimitations/Further Work


Introduction (1 of 4)

At present we have more than 1000 users including about 50 analysts whodepend on SAS for their analytic and reporting needs; to provide security &confidentiality we need to do the following:

Load SAS user identities into the metadata repository

Assign identities to groups based on their job function (for example,User or HR-User, Analytekere-HR-USER)

Maintain the identity metadata to reflect the current state of thesite’s SAS user



Figure 1: User groups in SAS Environment



“One size does not fit all; — two or three sizes don’t fit alleither.”

Microsoft Active Directory is the most popular tool for managing userauthentication

SAS macros can extract user accounts from AD and create useraccounts in SAS metadata.

By default, these macros import and synchronize all accounts fromActive Directory

SAS metadata server must use host authentication against the sameAD.



Figure 2: Overview of SAS Metadata services


Initial Metadata Repository Identity Load (1 of 2)

Active directory identity extraction

SAS provides LDAP call rotines; minor modifications required for ownsites.Two seperate data steps required for users and groups.The elements stored in the resulting data set were user first name, userlast name, e-mail...etc; can modify

Load master canonical tables

SAS recommended; normalized data sets.

Populate metadata repository with canonical table data

%MDUIMPL converts the SAS canonical data sets into representativeXML data files, which are imported into the repository by theMETADATA procedure


Initial Metadata Repository Identity Load (2 of 2)

Figure 3: Overview of Initial Load Process


User Import Macros from SAS Foundation

The following activities are needed to import and synchronize useraccounts from AD to SAS metadata:

%MDUIMPC , %MDUIMPLB , %MDUEXTR , %MDUCMP ,%MDUCHGV , %MDUCHGLB

Located in: “[SAS Home]\SASFoundation \9.2\core\sasmacro”

SAS Foundation also ships with a sample program calledIMPORTAD.SAS

Located in: “[SAS Home]\SASFoundation \9.2\core\sample”


User Properties

Figure 4: User added manuallyFigure 5: User Identity imported fromAD


Macros in Synchronization program (1 of 2)

Figure 6: Code block from the synchronization program

Masterspecifies the location of the master tables, here “adir”

Targetspecifies the location of the target tables that contain informationextracted from the metadata, here “meta”


Macros in Synchronization program (2 of 2)

CHANGE

specifies the location for the change tables, here “updates”xxx add: contains users, groups, and roles to be added to the targettables to make them look like the master tablesxxx update: contains users, groups, and roles to be modified in thetarget tables to make them look like the master tablesxxx delete: contains users, groups, and roles to be deleted from thetarget tables to make them look like the master tables

Figure 7: Code block from the synchronization program


Example 1

Figure 8: Initial Load Example


Example 2



Example 3



Challenges in Synchronization Program

Norwegian character encoding

Use correct encoding utf-8 or no

“” in any of the field in AD

Check error log and generated xml file

LDAP search returns 1000 users

Use modular search filter so that AD returns less than 1000 users

Frequent OU changes in AD for synchronized users

Change external identities value in metadata


Limitations/Further Work

No GUI for end users

User selection from a group is not available

Manually added users must include “ExternalIdentity” value forfurther synchronization

Detailed log for all groups are not included


The End


synkronisering av ad-brukere med sas metadataserver · synkronisering av ad-brukere med sas...

Documents