topic Re: NTLM authentication is not supported in Administration and Deployment

NTLM authentication is not supported

woo — Wed, 25 Jul 2018 01:36:20 GMT

Hello friends, we are trying to implement SSO and trying to test it with metadata server as a first step. Object spawner are SPNs registered). We have keytab file with "sas installer id" as well. Sysadmin seems completed configuration from their side.

SAS 9.4 M5 Grid / Linux/ MIT kerberos/ AD/ LDAP

I generated kerberos ticket and have it on my desktop as well as on linux side.

KRB5CCNAME and KRB5_CONFIG environment variables has been assigned at windows side.

Now, when try to open sas mc with my id (userid) by selecting "use IWA (SSO)" i am receiving below error.

The application could not log on to the server. IWA failed.

Access denied. NTLM authentication is not supported.

metadata log showing "NTLM authentication is not supported" as well...

Any direction??? Thank you.

Re: NTLM authentication is not supported

JuanS_OCS — Wed, 25 Jul 2018 07:32:12 GMT

Hello @woo,

maybe I am wrong, but I think NTLM is not native to Linux, but Windows (servers), this means that you would need to configure in SAS pure Kerberos connectivity, removing the NTLM bits from the string.

Re: NTLM authentication is not supported

woo — Wed, 25 Jul 2018 12:27:14 GMT

Thanks Juan.

Infect SAS documents says that "When you use IWA on UNIX, only Kerberos connections are supported (there is no support for NTLM on UNIX)", and as you mentioned my errors telling SAS still picking NTLM but I am not sure what needs to be done to tell SAS DO NOT USE NTLM,

Re: NTLM authentication is not supported

JuanS_OCS — Wed, 25 Jul 2018 14:17:17 GMT

Hello @woo,

basically you need to remove the "NTLM" strings from the metadata definitions, leaving only "Kerberos".

And you need to ensure the Kerberos TGTs with the keytab.

The best is to refer to @StuartRogers 's papers. He is the MAN for those topics.

http://support.sas.com/resources/papers/proceedings13/476-2013.pdf

https://support.sas.com/resources/papers/proceedings16/SAS3443-2016.pdf

Additionally, in SAS doc:

http://support.sas.com/documentation/cdl/en/bisecag/63082/HTML/default/viewer.htm#n1d1zo1jsf2o0en1ehu4c4simfky.htm

http://support.sas.com/documentation/cdl/en/bisecag/61133/HTML/default/viewer.htm#a003276221.htm#a003147113

Re: NTLM authentication is not supported

woo — Wed, 25 Jul 2018 18:22:26 GMT

Also, if I remove NTLM string and keep below settings in place,

security package: Negotiate

Security package list: Kerberos

it throws below error,

SEC_E_TARGET_UNKNOWN

security package failed while authenticating a user

Re: NTLM authentication is not supported

alexal — Wed, 25 Jul 2018 18:42:00 GMT

@woo,

You are getting the message about NTML authentication because GSSAPI authentication has failed and it fall back to NTLM, which is next in the list. SAS does not support NTLM authentication. SEC_E_TARGET_UNKNOWN is a GSSAPI error meaning that client cannot be found in the Kerberos database. Are you sure you have created SAS/ SPN?

Re: NTLM authentication is not supported

woo — Wed, 25 Jul 2018 19:09:53 GMT

Thanks Alex, our sys admin team trying to figure out if they have set that correctly. For me it doesn't look like as i am not getting any output for below "setspn" cmd from my local machine. At same time i can ping metadata server fine from local machine (windows) + nslookup resolving to metadata hostname with that ip.

setspn -Q SAS/xyz@abc.com

No such SPN found

Re: NTLM authentication is not supported

alexal — Thu, 26 Jul 2018 12:17:50 GMT

@woo,

Yes, you have to fix a problem with SAS/ SPN. Let me know if you need any help after that.

Re: NTLM authentication is not supported

RupaJ — Tue, 01 Dec 2020 20:11:02 GMT

Hello @woo

How did you fix this error? I am getting the same error when logging in to SAS MC with IWA.