Domain Access Options; Owner; Libaclinherit - SAS Scalable Performance Data Server 4.5 Administrator's Manual

The non-intuitive names example uses different names for the declared domain name,
pathname, data pathname, and index pathname. The structure is technically valid, but is
also unnecessarily complex.
In summary, it is a good idea to use the same name that is declared as a LIBNAME domain
as the destination directory name for pathname, data path, and index path specifications.
The directories that are specified in domain pathname, data path, and index path statements
should correspond to one and only one domain. In the intuitive names example, the
pathname, data path and index path specifications point to separate, unique paths that end
with the directory name, "pds123" which correspond to the domain "spds123". If a domain
"spds456" exists, it should have its own unique domain pathname, data path, and index
path specifications, and share no specified path with "spds123" or any other domain.

Domain Access Options

When you issue a libref statement to create a domain for SPD Server, you can use the
following optional specifications to control the accessibility of resources among other SPD
Server users:

OWNER=

Specifies the owner of a domain. The SPD Server owner controls the resources of the
domain, and can create a LIBNAME ACL on the domain to grant or deny privileges to
other SPD Server users. When the domain is specified with an owner, only the owner can
use the TEMP=YES LIBNAME option with the domain.
The owner can use LIBNAME ACL to grant the following:
•
•
•
Usage:
OWNER=owner-id

LIBACLINHERIT=

The LIBACLINHERIT parameter file option controls the ACL precedence of permission
checks. Precedence of permission checks includes inheriting the permissions of the
LIBNAME ACL for resources owned by the domain owner. In this case, the LIBNAME
ACL is used first to give READ or WRITE access to the domain, and then to inherit ACLs
to resources that belong to the domain owner. When a user attempts to access resources in
a domain where the domain owner specifies LIBACLINHERIT=YES, the following ACL
precedence of permissions checks are made on the resource:
1. If user-specific permissions are defined on the object for the accessor, the accessor gets
2. If group-specific permissions are defined on the object for the accessor's group, the
3. If LIBNAME ACL permissions are defined for the accessor, the accessor gets the
READ access to allow a user or group to get a LIBNAME to the domain.
WRITE access to allow a user or group to create new objects in the domain.
CONTROL access to allow a user or group to modify the owner's LIBNAME ACL .
these permissions.
accessor gets these permissions.
LIBNAME ACL permissions on the object.
127
LIBACLINHERIT=