SAS script to list all SAS server users from metadata - excel

Question

I need a way to import a list of all SAS users from SAS metadata into an Excel worksheet. I was considering doing this using the SAS plugin for Microsoft Office to create a dynamic data source the retrieves the list of users dynamically from the SAS server. If I am to do this I need to know how to do this in SAS code.
Does anyone know how I would write a SAS script to display a list of all users in SAS metadata, or if this is even possible?
I've been trying to find something online but haven't had any luck.
I have full administrator privileges, so no problem there.
Thanks!

Answer 1

Thanks to Joe in the comments I found the answer I need:
http://support.sas.com/documentation/cdl/en/lrmeta/63180/HTML/default/viewer.htm#p1k9zipe59ha2an1pq34gu143lay.htm
I used the very last example in this page, modified to do a PROC PRINT instead of exporting to an Excel sheet. In Enterprise Guide I created a new program as follows:
/*Connect to the metadata server using the metadata system options as
shown in the first example. */
data work.Identities;
/* The LENGTH statement defines the lengths of variables for function arguments. */
length IdentId IdentName DispName ExtLogin IntLogin DomainName $32
uri uri2 uri3 uri4 $256;
/* The LABEL statement assigns descriptive labels to variables. */
label
IdentId = "Identity Id"
IdentName = "Identity Name"
DispName = "Display Name"
ExtLogin = "External Login"
IntLogin = "Is Account Internal?"
DomainName = "Authentication Domain";
/* The CALL MISSING statement initializes the output variables to missing values. */
call missing(IdentId, IdentName, DispName, ExtLogin, IntLogin, DomainName,
uri, uri2, uri3, uri4);
n=1;
n2=1;
/* The METADATA_GETNOBJ function specifies to get the Person objects in the repository.
The n argument specifies to get the first person object that is returned.
The uri argument will return the actual uri of the Person object. The program prints an
informational message if no objects are found. */
rc=metadata_getnobj("omsobj:Person?#Id contains '.'",n,uri);
if rc<=0 then put "NOTE: rc=" rc
"There are no identities defined in this repository"
" or there was an error reading the repository.";
/* The DO statement specifies a group of statements to be executed as a unit.
The METADATA_GETATTR function gets the values of the Person object's Id, Name,
and DisplayName attributes. */
do while(rc>0);
objrc=metadata_getattr(uri,"Id",IdentId);
objrc=metadata_getattr(uri,"Name",IdentName);
objrc=metadata_getattr(uri,"DisplayName",DispName);
/* The METADATA_GETNASN function gets objects associated via the
InternalLoginInfo association. The InternalLoginInfo association returns
internal logins. The n2 argument specifies to return the first associated object
for that association name. The URI of the associated object is returned in
the uri2 variable. */
objrc=metadata_getnasn(uri,"InternalLoginInfo",n2,uri2);
/* If a Person does not have any internal logins, set their IntLogin
variable to 'No' Otherwise, set to 'Yes'. */
IntLogin="Yes";
DomainName="**None**";
if objrc<=0 then
do;
put "NOTE: There are no internal Logins defined for " IdentName +(-1)".";
IntLogin="No";
end;
/* The METADATA_GETNASN function gets objects associated via the Logins association.
The Logins association returns external logins. The n2 argument specifies to return
the first associated object for that association name. The URI of the associated
object is returned in the uri3 variable. */
objrc=metadata_getnasn(uri,"Logins",n2,uri3);
/* If a Person does not have any logins, set their ExtLogin
variable to '**None**' and output their name. */
if objrc<=0 then
do;
put "NOTE: There are no external Logins defined for " IdentName +(-1)".";
ExtLogin="**None**";
output;
end;
/* If a Person has many logins, loop through the list and retrieve the name of
each login. */
do while(objrc>0);
objrc=metadata_getattr(uri3,"UserID",ExtLogin);
/* If a Login is associated to an authentication domain, get the domain name. */
DomainName="**None**";
objrc2=metadata_getnasn(uri3,"Domain",1,uri4);
if objrc2 >0 then
do;
objrc2=metadata_getattr(uri4,"Name",DomainName);
end;
/*Output the record. */
output;
n2+1;
/* Retrieve the next Login's information */
objrc=metadata_getnasn(uri,"Logins",n2,uri3);
end; /*do while objrc*/
/* Retrieve the next Person's information */
n+1;
n2=1;
rc=metadata_getnobj("omsobj:Person?#Id contains '.'",n,uri);
end; /*do while rc*/
/* The KEEP statement specifies the variables to include in the output data set. */
keep IdentId IdentName DispName ExtLogin IntLogin DomainName;
run;
/* The PROC PRINT statement writes a basic listing of the data. */
proc print data=work.Identities label;
run;
/* The PROC EXPORT statement can be used to write the data to an Excel spreadsheet. */
/* Change DATA= to the data set name you specified above. */
/* Change OUTFILE= to an appropriate path for your system. */
/*
proc export data=work.Identities
dbms=EXCE
outfile="C:\temp\Identities.xls"
replace;
run;
*/
PROC PRINT DATA=work.Identities;
When this was executed it created a SAS Report. I exported that Report as a .srx file and then used the SAS Plugin for Microsoft Office to add the report into an Excel worksheet (the "Reports" button).
I then right-clicked on the cell where the report was added and clicked Properties, and then set it to automatically update whenever the document is opened.
It's a great way to review users as an administrator. Rather than having to check each system individually to see if a user exists (when they leave the company for example) I have a sheet for each of our SAS systems, a sheet for each of our Teradata systems (auto-updated using a query run through ODBC), and another sheet auto-updated from a separate spreadsheet that contains the list of our MicroStrategy users. It makes checking all systems as simple as a single Ctrl + F.

Answer 2

If you just want to extract the list of users in SAS you can compile this macro and run:
%mm_getusers(outds=myusers)
Disclaimer - I wrote it, and we use it in our commercial product (https://datacontroller.io) so users can see group memberships when applying permissions within the tool.