topic Bypass STP Login Screen Using Hard-Coded Credentials in Developers

Bypass STP Login Screen Using Hard-Coded Credentials

krusader — Wed, 12 Apr 2017 23:56:46 GMT

Is there a way to hard-code _username and _password macro variables in a stored process to be passed as login credentials when executed from SAS Stored Process Web?

For testing purposes I'm trying to execute my stored process from a link like this, and to have the hard-coded credentials in the program do the authentication:

http://server-name.com:8080/SASStoredProcess/do?_program=/path/to/program

I've spent a lot of time researching and I've seen how input parameters can be specified in the URL, so I'm not looking for that. I am wondering if the program code itself can do the authentication.

Re: Bypass STP Login Screen Using Hard-Coded Credentials

Kurt_Bremser — Thu, 13 Apr 2017 03:26:58 GMT

You need to specify credentials in the URL so the webapp can access the metadata. Only after that can the program be found and started.

Re: Bypass STP Login Screen Using Hard-Coded Credentials

boemskats — Mon, 17 Apr 2017 13:43:48 GMT

Hi,

This is not possible. Your client browser must make a POST request with the user/pass to the /SASLogon app in order to retrieve a session ID to make the SASStoredProcess web app happy to talk to it. The SPWA doesn't / can't deal with auth stuff directly.

If this is a requirement you should seriously consider Configuring anonymous access for the SAS® Stored Process Web Application, and then limiting the STPs the anonymous users are able to execute by restricting the webanon@saspw metadata user.

Nik