topic Kerberos Authentication via SAS EG in Administration and Deployment

Kerberos Authentication via SAS EG

helannivas88 — Thu, 13 Sep 2018 14:20:08 GMT

Hi,

We are connecting to MSSQL server using Windows Authentication mode and we are succeeded in connecting to that. But we do have a problem whenever we issue the libname statement in SAS EG stating Kerberos ticket expiration

Have identified that whenever we login to SSH first and then issue the libname, we don't see any issue in the connection. But when we connect to SAS EG first and then if we issue the libname statement , we do face issue.

Kerberos ticket is getting generated/renewed whenever we login to SSH under tmp directory but not getting generated using SAS EG(at first).

Is there any SAS configuration file to update Kerberos ticket renewal to rectify this issue??

Thanks and Regards,

Helan Nivas G

Re: Kerberos Authentication via SAS EG

alexal — Thu, 13 Sep 2018 14:25:52 GMT

@helannivas88,

You have to configure PAM authentication as described in this SAS note:

http://support.sas.com/kb/49/432.html

After that, please make sure that "PAM_SETCREDENTIALS=TRUE" is uncommented in your /<SASHome>/SASFoundation/9.4/utilities/bin/sasauth.conf. Also, do not forget to restart the object spawner.

Besides of all of, you have to set KRB5CCNAME, you can do that through this script in WorkspaceServer_usermods.sh:

workspace_user=$(whoami)
workspace_user_ccaches=$(find /tmp -maxdepth 1 -user ${workspace_user} -type f -name "krb5cc_*" -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' | head -n 1)

if test ! -z "$workspace_user_ccaches"; then
            echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."
            echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"
            export KRB5CCNAME=$workspace_user_ccaches
            echo "KRB5CCNAME has been set to ${KRB5CCNAME}."
else
            echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."
fi

Re: Kerberos Authentication via SAS EG

helannivas88 — Fri, 02 Nov 2018 11:03:46 GMT

Hi,

As I said earlier and after updating the script in workspaceserver_usermods.sh, it works perfectly in master (Grid controller) and not in Grid node.

But our environment are shared across both the servers (i.e.) the configuration is shared between master and Node.

But not sure why the ticket are not behaving same like Grid Controller.Can you please let me know the reason on this. Thanks

Regards,

Helan Nivas G

Re: Kerberos Authentication via SAS EG

nhvdwalt — Fri, 02 Nov 2018 11:48:51 GMT

@helannivas88

Have a look here:

http://support.sas.com/kb/57/943.html

http://support.sas.com/kb/55/312.html