topic Re: SAS Viya 3.3 Cannot Authenticate Users in Administration and Deployment

SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 14:39:43 GMT

Today when any user attempts to login to our SAS Viya environment they are receiving an error that the username or password is invalid. It worked yesterday and over the last several months since launch with no issues, nothing has changed on the Linux server. Any trouble shooting ideas?

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 14:43:25 GMT

@YvetteS,

Please clarify, which application they are using? SAS Environment Manager? SAS Studio 4? SAS Studio 5? SAS Home?

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 14:45:08 GMT

From the "SAS Home" link to login into Viya for VA

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 14:47:09 GMT

@YvetteS,

Thanks, please check the most recent log file in /opt/sas/viya/config/var/log/saslogon/default directory. Do you see any errors there?

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 15:07:40 GMT

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

Looks like some sort of certificate issue - forgive me I am not a server administrator, and am working with our IT dept who has little experience with this as Zencos did the install - so if you have any trouble shooting steps that would be appreciated.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 15:10:18 GMT

Another Log Snip

[root@cawina06 default]# grep ERROR sas-saslogon_2018-09-09_10-27-48.log

2018-09-09 10:28:26.901 ERROR 24451 --- [n Asynchronous4] c.s.credentials.bootstrap.DomainLoader : service [82854b7902879700] [domain.create.error.fmt.log] Error creating credentials domain Domain: /credentials/domains/kerberos (GSSCredential) 405 Method Not Allowed

2018-09-09 10:28:26.909 ERROR 24451 --- [n Asynchronous5] c.s.c.bootstrap.ConfigurationLoader : service [01b40d7d4017b355] [CONFIGURATION_BOOTSTRAP_RESTCLIENT_EXCEPTION] POST encountered an exception attempting to invoke the [HTTPMethod=com.sas.configuration.bootstrap.ConfigurationLoader@7b91d9f][endPoint=/configuration/definitions]

2018-09-09 10:28:28.240 ERROR 24451 --- [n Asynchronous4] c.s.credentials.bootstrap.DomainLoader : service [82854b7902879700] [domain.create.error.fmt.log] Error creating credentials domain Domain: /credentials/domains/kerberos (GSSCredential) 405 Method Not Allowed

2018-09-09 10:28:31.911 ERROR 24451 --- [n Asynchronous4] c.s.credentials.bootstrap.DomainLoader : service [82854b7902879700] [domain.create.error.fmt.log] Error creating credentials domain Domain: /credentials/domains/kerberos (GSSCredential) 405 Method Not Allowed

2018-09-09 10:28:31.916 ERROR 24451 --- [n Asynchronous5] c.s.c.bootstrap.ConfigurationLoader : service [25697dcb24315ddc] [CONFIGURATION_BOOTSTRAP_RESTCLIENT_EXCEPTION] POST encountered an exception attempting to invoke the [HTTPMethod=com.sas.configuration.bootstrap.ConfigurationLoader@7b91d9f][endPoint=/configuration/definitions]

2018-09-09 10:28:36.981 ERROR 24451 --- [n Asynchronous4] c.s.credentials.bootstrap.DomainLoader : service [82854b7902879700] [domain.create.error.fmt.log] Error creating credentials domain Domain: /credentials/domains/kerberos (GSSCredential) 405 Method Not Allowed

2018-09-09 10:28:41.925 ERROR 24451 --- [n Asynchronous5] c.s.c.bootstrap.ConfigurationLoader : service [e20c3168892a974b] [CONFIGURATION_BOOTSTRAP_RESTCLIENT_EXCEPTION] POST encountered an exception attempting to invoke the [HTTPMethod=com.sas.configuration.bootstrap.ConfigurationLoader@7b91d9f][endPoint=/configuration/definitions]

2018-09-09 10:28:49.371 ERROR 24451 --- [n Asynchronous4] c.s.credentials.bootstrap.DomainLoader : service [82854b7902879700] [domain.create.error.fmt.log] Error creating credentials domain Domain: /credentials/domains/kerberos (GSSCredential) 405 Method Not Allowed

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 15:14:20 GMT

@YvetteS,

Thanks. I just want to see who exactly is throwing this exception:

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

Please do "tail -f" on the most recent SAS Logon log and try to log in to the system. Send to me what will be added on the screen.

If you having connection issues to LDAP(s), most likely the certificate has been updated but not added to SAS Viya trusted store.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 15:27:07 GMT

Here is what we get:

2018-09-13 11:25:21.962 ERROR 24451 --- [o-auto-1-exec-2] w.a.UsernamePasswordAuthenticationFilter : service [804d145fb06de916] An internal error occurred while trying to authenticate the user.

org.springframework.security.authentication.InternalAuthenticationServiceException: cawinc01.cyphersystems.com:3269; nested exception is javax.naming.CommunicationException: cawinc01.cyphersystems.com:3269 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 15:33:52 GMT

@YvetteS,

Have you recently changed SSL certificate on your LDAP server? If yes, you have to add new or updated certificate to SAS VIya as described in document below:

Encryption in SAS® Viya® 3.4: Data in Motion -> Encrypt LDAP Connections -> Configure the LDAPS (Secure LDAP) Connection

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 15:38:39 GMT

Our IT guy is saying that he is not aware of any changes and that the LDAP server is one of the domain controllers?

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 15:43:04 GMT

@YvetteS,

Something has been changed. This command will show you which certificate is currently in use on your LDAP server:

openssl s_client -showcerts -connect <LDAP_SERVER_NAME>:<LDAP_PORT> < /dev/null

Make sure that this certificate has been added to SAS Viya.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 15:43:58 GMT

OK thanks we'll give it a try.

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 15:44:46 GMT

@YvetteS,

Sure, keep me posted.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 16:19:12 GMT

The certificate location is empty ...

[root@cawina06 default]# pwd
/opt/sas/viya/config/etc/consul.d/default
[root@cawina06 default]# ls
[root@cawina06 default]#

At this point we feel we have exhausted our ability to resolve the issue and are looking to engage Zencos. Thanks for your support in helping us pinpoint the issue.

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 16:27:53 GMT

@YvetteS,

Here is correct link for SAS Viya 3.3: https://go.documentation.sas.com/?cdcId=calcdc&cdcVersion=3.3&docsetId=secref&docsetTarget=n1xdqv1sezyrahn17erzcunxwix9.htm&locale=en#p0ouu7812slk6fn1xpbzwxh66idk . You can also open SAS Technical Support Track.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Thu, 13 Sep 2018 18:22:42 GMT

Hi Alexal

Well I am pleased to report that we resolved issue without engaging the consultants. You were absolutely correct, a certificate on our LDAP had expired and was replaced. We copied the new certificate onto the Linux SAS server. Excellent news.

So that being said, we never had this issue in VA or SAS 9.4 on our old install, seems to be new with our recent Viya install, so we noticed that the certificate we just applied expires January 2019. We are assuming this issue will occur again then, we don't appear to get any warning about this certificate expiring, maybe I should see if IT can add some sort of alert to our SAS administrator.

Thanks so much for your support and quick replies on this issue, greatly appreciated.

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Thu, 13 Sep 2018 18:45:16 GMT

@YvetteS,

You are welcome. I'm glad that the problem has been resolved.

Well I am pleased to report that we resolved issue without engaging the consultants. You were absolutely correct, a certificate on our LDAP had expired and was replaced. We copied the new certificate onto the Linux SAS server. Excellent news.

So that being said, we never had this issue in VA or SAS 9.4 on our old install, seems to be new with our recent Viya install, so we noticed that the certificate we just applied expires January 2019. We are assuming this issue will occur again then, we don't appear to get any warning about this certificate expiring, maybe I should see if IT can add some sort of alert to our SAS administrator.

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Fri, 21 Dec 2018 16:03:49 GMT

HI There

We are experiencing this issue again today, however this time our LDAP SSL certificate in active directory has not expired? Any suggestions?

Re: SAS Viya 3.3 Cannot Authenticate Users

alexal — Fri, 21 Dec 2018 16:12:47 GMT

@YvetteS,

Have you had a chance to check the most recent log file in /opt/sas/viya/config/var/log/saslogon/default/? Do you see any errors?

Re: SAS Viya 3.3 Cannot Authenticate Users

YvetteS — Fri, 21 Dec 2018 16:30:52 GMT

IT is telling me it appears to be Java certificates this time?