About the SetPassword Metadata Utility

Purpose: The SetPassword utility enables an unrestricted user to change passwords on one or more metadata login objects. The person who runs the utility must provide the new passwords as input. This utility can be used in conjunction with enterprise password provisioning/reset tools to drive password changes into the metadata server. Notes: This utility does not extract passwords from authentication providers. Nor does it update passwords used for metadata server internal authentication. (These accounts are usually in the form of username@SASPW.)

Alternate Methods: As an alternative to using this utility, unrestricted users can use SAS Management Console to reset passwords for other users (one at a time). Regular users can use SAS Personal Login Manager (or SAS Management Console) to update their own passwords. For background information about logins and storage of passwords in the metadata, see the SAS Intelligence Platform: Security Administration Guide, at support.sas.com/administration.

Functional Overview: The utility works like this:

1. You provide these inputs:

   • Connection information for the metadata server (using the standard metaServer metaPort, metaUser, metaPass, and metaRepository arguments).

   • A user ID, authentication domain, and new password for each login that you are updating (using the UserID, AuthenticationDomain, and Password arguments).
     
     

     • You can provide this information directly in the command line, or via piped input, or via a separate input file.

     • Values that contain spaces must be enclosed in double-quotation marks.

     • Each user ID/authentication domain pair that you specify must correspond to an existing login in the metadata.

     • Userids and Authentication domains will be matched in a case-insensitive manner.

     • For a login that is not associated with an authentication domain, specify an empty string as the AuthenticationDomain value. For example, AuthenticationDomain="".

     • The passwords that you provide should be in clear text (not encrypted).

   • Options that specify how the account information is being supplied and how error and log files will be generated.

2. The utility passes each UserID/AuthenticationDomain pair to the SAS Metadata Server to verify that there is a corresponding login. If a corresponding login is found, the old password is replaced with the new password. The utilitiy does not verify the new password with the authentication provider.

3. The utility generates log and error files as specified by you.

Syntax for the SetPassword Metadata Utility

Basic Syntax

A simple form of the command is:

As an alternative, you can remove the -File option and add options that directly provide account information:

Utility Options

Connection Options

Usage Examples

Example 1: Changing One Password Directly From the Command Line

To update the Oracle password for the SAS Demo User, enter this command:

Example 2: Changing Mulitple Passwords From an Input File

To update the passwords in the Oracle logins for three demo accounts (sasdemo1, sasdemo2, and sasdemo3), create a file named passwords.txt that contains these lines:

And enter this command:

Example 3: Changing Multiple Passwords From Piped Input

To accomplish the same password changes as in the previous example using a piped input file named input.bat on windows, this file contains the following information::

And on Windows, enter this command:

Note: This example assumes that the logs directory has already been created.