ix
What's New in Security
Administration in SAS 9.4
Overview
New and enhanced features in the following areas increase security and manageability:
• access to resources
• authentication
• encryption
• user administration
• documentation enhancements
Access to Resources
• You can use either SAS Management Console or the AUTHLIB procedure to bind
SAS data to metadata. All access from SAS to metadata-bound data is subject to
metadata-layer permissions. See “Metadata-Bound Libraries” on page 94
.
• You can limit the reach of a SAS server process, ensuring that the process can access only designated resources in the host operating environment. This functionality is
available in the first maintenance release for SAS 9.4. See “Locked-Down Servers” on page 96 .
• You can manage metadata-layer permissions using batch tools. The tools support viewing and setting access controls and viewing, creating, and modifying access control templates. See
Chapter 9, “Batch Tools for Metadata Authorization,” on page
103 .
Authentication
• In direct LDAP authentication, the following enhancements are available:
• You can authenticate against multiple LDAP servers.
• You can authenticate against multiple LDAP groups within an LDAP server.
x
Security Administration
• You can use the AD_STYLE environment variable to limit authentication activity to one attempt per logon interaction. By specifying which user ID format the metadata server uses in an authentication request against LDAP, you avoid inadvertent locking of Active Directory accounts due to repeated attempts using different formats for the submitted user ID.
• You can use the AD_TIMEOUT or LDAP_TIMEOUT environment variable to define how long the first attempt to connect has before it times out.
See “How to Configure Direct LDAP Authentication” on page 160 .
• In SAS internal authentication, any server-level internal account policies that have been explicitly set in the metadata server’s omaconfig.xml file are displayed in SAS
Management Console. The display is Read-Only. See “How to Change Internal
Account Policies” on page 177 .
• In the middle tier, the remote services component is no longer used. This simplifies administration and increases availability. See
“Web Authentication” on page 149
.
• In Integrated Windows authentication, only the standard service principal name format (SAS/machine) is automatically registered. A deprecated alternate format that includes a port number is no longer automatically registered. See
“How to Configure
Integrated Windows Authentication” on page 165
.
• In the second maintenance release for SAS 9.4, Integrated Windows Authentication on Linux systems no longer requires the use of Quest Authentication Services. SAS can leverage the libraries that are shipped with the supported operating system or that are provided in most third-party authentication solutions.
• The second maintenance release for SAS 9.4 supports outbound and trusted authentication domains. A login in an outbound domain can establish connections only to other servers. For outbound domain logins, the constraints on the user ID are not enforced. A login in a trusted domain can be accessed only by a trusted system account on behalf of the user. A login in a trusted domain also requires the
authentication domain to be an outbound domain. See “Outbound and Trusted
Authentication Domains” on page 124 .
• Beginning in the third maintenance release for SAS 9.4, additional security is provided for SAS web applications. In scenarios where applications are using the
SAS middle tier as a proxy for accessing external URLs, additional security has been added through a whitelist, or security filter, and logging. You can also whitelist certain HTTP request methods.
SAS web applications that require external access to URLs must also have a whitelist of URLs that can be accessed.
For additional information, see:
• “Whitelist of Websites and Methods Allowed to Link to SAS Web Applications” in SAS Intelligence Platform: Middle-Tier Administration Guide
• “Configuring the Cross Domain Proxy Servlet through a Whitelist” in SAS
Intelligence Platform: Middle-Tier Administration Guide
• “Enabling Support for Forward Proxy Authentication” in SAS Intelligence
Platform: Middle-Tier Administration Guide
