Setting Proper Access Controls for User Identities

It is important that you set the access controls for the Portal User, Portal Guest User, and Portal Demo User identities properly. The following list should help you create the proper permission settings. These settings are required for proper operation of the Portal.

The Portal User User identity

• must be able to read, write, search, compare, delete and add entries to the cn=SAS,$SAS_CONTEXT$ entry and its children
• must be able to read, write, search, compare, delete and add entries to the $PERSON_CONTEXT$ entry
• must be able to read, search and compare the $GROUP_CONTEXT$

The Portal Guest User identity

• must be able to read, search and compare it's own person entry
• must be able to read, search and compare the group context
• must be able to read, search, and compare entries to the sasPortalUserCn=Portal Guest,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$ entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search and compare entries in the following contexts that are defined to be publicly available
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$

The Portal Demo User identity

• must be able to read, write, search and compare it's own person entry
• must be able to read, search and compare the group context
• must be able to read, write, search, compare, delete, and add entries to the sasPortalUserCn=Portal Demo,cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$entry and its children
• must NOT be able to access any other sasPortalUser entries in cn=sasPortalUsers,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• must be able to read, search, and compare entries in
  • cn=Public,cn=sasPortalWindows,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLists,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=Public,cn=sasPortalLinks,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
  • cn=sasPortalThemes,sascomponent=sasPortal,cn=SAS,$SAS_CONTEXT$
• should be able to read, search and compare entries in (disallowing access to any of the following entries will result in content not being shown as documented in the demo)
  • cn=sassubscribers,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • cn=saschannels,sascomponent=sasPublishSubscribe,cn=SAS,$SAS_CONTEXT$
  • sascomponent=sasApplications,cn=SAS,$SAS_CONTEXT$
  • cn=sasLibraries,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$
  • cn=sasTables,sascomponent=sasDataSources,$SAS_CONTEXT$
  • cn=sasInfomarts,sascomponent=sasDataSources,cn=SAS,$SAS_CONTEXT$