topic SAS 9.5 M4 - IWA - Some users are unable to connect SASStudio from MiddleTier in Administration and Deployment

SAS 9.5 M4 - IWA - Some users are unable to connect SASStudio from MiddleTier

EmmanuelF — Wed, 17 Apr 2019 16:02:31 GMT

Hello,

Following IWA implementation, I notice that some users can't logging to SASStudio app. They obtain a form with the following message :

The native implementation module for the security package could not be found in the path

(All users are able to connect EG using IWA)

My configuration :

-Middle tier, meta, compute on three separate Linux server (RH)

When I check the compute ObjectSpawner log, I notice that for users that do not have the issue, a first connection is done using SAS token wich is rejected , followed by an IWA (user delegation) connection wich is accected :

2019 - INFO [00032680] :BOB - New client connection (2902) accepted from server port 8591 for SAS token user BOB.

2019 - ERROR [00032680] :BOB - No host credentials exist to start this server. Either the client needs to send in host credentials

...

2019 - INFO [00032684] :BOB - New client connection (2904) accepted from server port 8591 for IWA user BOB

2019 - DEBUG [00032684] :BOB - Preparing to launch server SASApp - Workspace Server under credentials BOB

On the web side, I can see the folowing message indicating that a delegation has occured :

>>>Delegated Creds have pname=BOB.COMPAGNY.FR sname=krbtgt/GROUPE.COMPAGNY.FR@GROUPE.COMPAGNY.FR authtime=null starttime=20190412085736Z endtime=20190412180241ZrenewTill=20190419080241

For not working users, a first connection is done using SAStoken wich is rejected. But no switch occurs to IWA

2019 - INFO [00032680] :DONALD - New client connection (2902) accepted from server port 8591 for SAS token user BOB.

2019 - ERROR [00032680] :DONALD - No host credentials exist to start this server. Either the client needs to send in host credentials

On the web side, I can't see the Delegated Creds messages.

Re: SAS 9.5 M4 - IWA - Some users are unable to connect SASStudio from MiddleTier

BrianK — Thu, 18 Apr 2019 19:32:52 GMT

So just to be clear, it sounds like you are saying the delegation messages appear when you use the thick client, but not when you use the web browser. Is that correct? It sounds like a client configuration problem. Have you followed the client configuration steps in the Middle Tier Administration Guide to configure IWA, including the delegation section, for your relevant browser? You might want to try another browser as well (after, of course, configuring IWA and delegation in that browser as well). This sounds very much like a client configuration problem to me.

Brian

Re: SAS 9.5 M4 - IWA - Some users are unable to connect SASStudio from MiddleTier

EmmanuelF — Fri, 19 Apr 2019 13:32:43 GMT

Hello,

All connections to a workspace server are all right for all users using the thick client (EG)

Using web client, Some users are able to connect to Webstudio (and launching their workspace) but some are unable to logon and receive "The native implementation module for the security package could not be found in the path".

This only concern WebStudio app where mid-tier communicate with compute server.

No IWA issue with other mid-tier app (SaSPortal ...)

On the same Workstation / same browser , an user do not have the issue but another do.

Very strange behaviour. Look like something about the user session is cached somewhere and not refreshed..