User of stored process, which variable to use?

When i look in a SAS log, there are 4 different Variables to grab User:

 _METAPERSON
 _METAUSER
 _SECUREUSERNAME
 _USERNAME

When i check the log, all 4 variables have the same value when i execute the process. So i builded a process which checked _Metauser for some specific user, so that only the users i wanted could do something. But a colleague of me had the problem that in the variable was not the username stored for him when he called the process, but username@Context. In the other 3 variables, there was only username stored for him, so maybe i can change to one of them. I can not use Metauser, because for some persons there could be an @Context after username.

No i have the problem, which variable to use? What is the difference between the 4 variables? Which to use, to be sure that i only (and always) get the pure username, no matter from where and which programm/Version the User is calling the process?

At the moment i use Sas 9.3 and run the process via webservice
I switched to SECUREUSERNAME for now, but i am not sure if this can make problems for other users, at the moment only 3 work with this process, but there will be a lot more soon
Our authorization concept is based on metadata, so i think maybe i should use _Metaperson...

Solution

The _SECUREUSERNAME macro variable is created when the application server executes a Stored Process. The value of _SECUREUSERNAME contains the client identity and this value will be written into the _USERNAME macro variable if _USERNAME doesn't already contain a value. Under most circumstances, the value of _SECUREUSERNAME will be the same as _USERNAME

_USERNAME Specifies the value for the user name obtained from Web client authentication.

_METAPERSON Specifies the Person metadata name that is associated with the _METAUSER login variable. The value of this variable can be UNKNOWN. This variable cannot be modified by the client.

_METAUSER Specifies the login username that is used to connect to the metadata server. This variable cannot be modified by the client.

There is no easy answer to your question, because it depends on your set up. Do your users have to login by using Metaserver? Is your code always accessed using the WebService? User IDs, what are they, are they ID from AD? Is Single-Sign-On (SSO) enabled? How are the IDs configured on SAS? Do people use Trusted Users to connect?

Regards, Vasilij