SAS 9.1.3 Intelligence Platform: System Administration Guide

Understanding the State of Your System R About Unrestricted Users and Trusted Users 17
to start SAS servers on your Windows machines. You can grant these same rights
to any users that you add to the system by making those users members of this
group.
sas
This group should have been created if your system includes UNIX machines. This
group is used to control access to the configuration directories on those machines.
Typically, you will not add any users to this group.
About Administrative Users
A user who has administrative user status on the SAS Metadata Server can create
and delete user definitions and logins. An administrative user can also perform
administrative tasks such as starting, stopping, pausing, and refreshing the metadata
server.
Unlike an unrestricted user, anadministrative user does not have unrestricted access
to the metadata. You are an administrative user if your user ID is listed in the
adminUsers.txt file or if you connect to the metadata server using the same user ID
that was used to start the metadata server
The SAS Configuration Wizard does not configure any administrative users. For
information about how to designate an administrative user, see “User and Group
Management” in the SAS Intelligence Platform: Security Administration Guide.
About Unrestricted Users and Trusted Users
The SAS Configuration Wizard configures the following highly privileged users of the
SAS Metadata Server:
3 one unrestricted user called the SAS Administrator, whose recommended user ID
is sasadm.
A user who has unrestricted user status can access all metadata on the server
(except for passwords, which an unrestricted user can overwrite but cannot read).
An unrestricted user can also perform administrative tasks such as starting,
stopping, pausing, and refreshing the metadata server. You are an unrestricted
user if your user ID is listed in the adminUsers.txt file and is preceded by an
asterisk.
3 one trusted user called the SAS Trusted User, whose recommended user ID is
sastrust. A trusted user can perform the following tasks that are not allowed for
“non-trusted” user connections:
3 acquire or release credential handles on behalf of other users
3 use the credential handles to make metadata and authorization requests as
another user
3 generate one-time-use passwords to allow clients to connect to the metadata
server directly
No one logs in as a trusted user and makes requests on behalf of other users.
Instead, the account is used by certain servers when they need to make metadata
requests on behalf of their users.
For information about how to designate a new unrestricted user or trusted user, see
“User and Group Management” in the SAS Intelligence Platform: Security
Administration Guide.