Defining User Accounts

There are two types of user accounts to understand when deploying SAS: The following sections describe the user accounts that SAS and third-party software require, and provide information to help you answer these questions:

This section contains the following topics:

Internal user accounts are accounts known only to SAS and are created and authenticated internally in metadata rather than externally. SAS identifies internal accounts by appending a special string to the user ID. This string begins with an at sign (@) and contains saspw: @saspw. For two of the required user accounts, the SAS Administrator and the SAS Trusted User, the SAS Deployment Wizard prompts you by default to create internal user accounts.

The following table shows the default internal user accounts required by SAS. (SAS internal accounts are authenticated on the metadata server.)

For more information about SAS internal user accounts and their purposes, see Understanding the State of Your System in SAS Intelligence Platform: System Administration Guide.

Here are some benefits of internal accounts:

External user accounts are user accounts defined outside of SAS metadata. These accounts are local to a machine or are defined in a network directory service of which the machine is a member, such as LDAP. SAS requires certain external user accounts for two purposes: installation and running certain SAS server processes.

During installation and configuration, the SAS Deployment Wizard must run under an external account with the necessary privileges on the target machine to write SAS program and log files. To run servers such as the stored process server and the pooled workspace server, SAS requires an external user account to be the server process owner. For more information about external user accounts and their purposes, see the SAS Intelligence Platform: System Administration Guide.

As you set up external accounts, remember to use different external accounts for the SAS First User and the SAS Spawned Servers user. Otherwise, your configuration will end in errors and the SAS pooled workspace server will not be functional.

As you create these external user accounts, record information about them in Pre-installation Checklist for External User Accounts for SAS on Windows and UNIX or in Pre-installation Checklist for External User Accounts for SAS on z/OS. You will need this information when you run the SAS Deployment Wizard later.

The following table shows external user accounts required by SAS and the machines on which they are authenticated.

Operating systems require that you assign certain rights to the external user accounts used to deploy and to run SAS.

The following table describes the user rights needed by the required external user accounts to deploy and run SAS.

On Windows, if you choose how to run your SAS servers using management scripts—instead of running them as Windows services—then the user account that runs the object spawner must meet the following requirements on the object spawner machine:

The following table describes the external user accounts required by third-party software and the machines on which they are authenticated—either as local accounts or in a network directory service that the machine can access.

As you create these external user accounts, record information about them in Pre-installation Checklist for External User Accounts for SAS on Windows and UNIX. You will need this information when you run the SAS Deployment Wizard (in Chapter 6).

The following table describes the user rights needed by the required external user accounts to deploy and run third-party software:

SAS relies on its various server machines to authenticate external user accounts. In turn, the SAS server machine authenticates user accounts using an authentication provider. An authentication provider refers to an authentication service that is one of the following: You can create either local or directory service accounts for external users. The only requirement is that each user shown in Required External User Accounts for SAS can be authenticated by the machine's authentication provider—be that an authentication provider that is local to the machine, or an authentication provider that is available to the machine through a directory service.

The main advantage of local accounts is that if account information were to get into the wrong hands, the credentials could be used only to log on to the machine or machines that can authenticate the credentials. A secondary benefit is that the host could continue to authenticate users even if the directory service authentication provider were unavailable.

The advantage of directory service accounts is that you do not have to create the same accounts on multiple machines or keep the account information synchronized across machines—the directory service authentication provider does this for you.

For example, setting up the SAS Spawned Server user account is usually straightforward. The spawned server account must be able to be authenticated by the pooled workspace server and stored process server machine. If these servers are distributed on more than one machine, then each machine must be a member of the same directory service or in different directory services between which a trust has been established.

When you set up passwords for your SAS system accounts, we highly recommend that these passwords do not have to be reset when a user first logs on. If, for some reason, it is required that you create passwords that have to be reset, you will have to log on using each account and change the password before you install and configure your software. And, of course, you will need to know the changed password for each account.

By default, passwords for internal accounts are set not to expire. When passwords for system accounts change, you must use the SAS Deployment Manager to update a set of configuration files and some metadata objects. SAS provides instructions for updating these files and metadata objects. However, you can save yourself some time if the passwords do not expire. For more information see Update a Managed Password in SAS Intelligence Platform: Security Administration Guide..

Use the following pre-installation checklist to create the necessary external user accounts to deploy and run SAS on Windows and UNIX.

Note these important items:

Use the following pre-installation checklist to create the necessary external user accounts to deploy and run third-party software.

Use the following pre-installation checklist to create the necessary external user accounts to deploy and run SAS on z/OS.