SAS 9.4 Language Reference, 6th Edition

Definition of a Password

SAS software enables you to restrict access to members of SAS libraries by assigning

passwords to the members. You can assign passwords to all member types except

catalogs. You can specify three levels of protection: Read, Write, and Alter. When a

password is assigned, it appears as uppercase Xs in the log.

Note: This document uses the terms SAS data file and SAS view to distinguish between

the two types of SAS data sets. Passwords work differently for type VIEW than they

do for type DATA. The term “SAS data set” is used when the distinction is not

necessary.

read

protects against reading the file.

write

protects against changing the data in the file. For SAS data files, write protection

prevents adding, modifying, or deleting observations.

alter

protects against deleting or replacing the entire file. For SAS data files, alter

protection also prevents modifying variable attributes and creating or deleting

indexes.

Alter protection does not require a password for Read or Write access; write protection

does not require a password for Read access. For example, you can read an alter-

protected or write-protected SAS data file without knowing the Alter or Write password.

Conversely, read and write protection do not prevent any operation that requires alter

protection. For example, you can delete a SAS data set that is read- or write-protected

only without knowing the Read or Write password.

To protect a file from being read, written to, deleted, or replaced by anyone who does not

have the proper authority, assign read, write, and alter protection. To allow others to read

the file without knowing the password, but not change its data or delete it, assign just

write and alter protection. To completely protect a file with one password, use the PW=

data set option. For more information, see “Assigning Complete Protection with the

PW= Data Set Option” on page 734.

Note: Because of how SAS opens files, you must specify the Read password to update a

SAS data set that is only read-protected.

Note: The levels of protection differ somewhat for the member type VIEW. See “Using

Passwords with Views” on page 735.

Assigning Passwords

Syntax

To set a password, first specify a SAS data set in one of the following:

• a DATA statement

• the MODIFY statement of the DATASETS procedure

730 Chapter 36 • File Protection

• an OUT= option in some procedures

• the CREATE VIEW statement in PROC SQL

• the ToolBox

Then assign one or more password types to the data set. The data set might already exist,

or the data set might be one that you create. The following is an example of syntax:

(password-type=password ... password-type=password>)

where password is a valid eight-character SAS name and password-type can be one of

the following SAS data set options:

• ALTER=

• PW=

• READ=

• WRITE=

T I P Each password option must be coded on a separate line to ensure that they are

properly blotted in the SAS log.

CAUTION:

Keep a record of any passwords that you assign! If you forget or do not know the

password, you cannot get the password from SAS.

Assigning a Password with a DATA Step

You can use data set options to assign passwords to unprotected members in the DATA

step when you create a new SAS data file.

This example prevents deletion or modification of the data set without a password.

/* assign a write and an alter password to MYLIB.STUDENTS */

data mylib.students(write=yellow alter=red);

input name $ sex $ age;

datalines;

Amy f 25

… more data lines …

;

This example prevents reading or deleting a stored program without a password and also

prevents changing the source program.

/* assign a read and an alter password to the SAS view ROSTER */

data mylib.roster(read=green alter=red) / view=mylib.roster;

set mylib.students;

run;

libname stored 'SAS-library-2';

/* assign a read and alter password to the program file SOURCE */

data mylib.schedule / pgm=stored.source(read=green alter=red);

… DATA step statements …

run;

Note: When you replace a SAS data set that is alter-protected, the new data set inherits

the Alter password. To change the Alter password for the new data set, use the

MODIFY statement in the DATASETS procedure.

Assigning Passwords 731