topic Re: user ID or password is not valid SAS EG in Administration and Deployment

user ID or password is not valid SAS EG

sathya66 — Wed, 27 Jan 2021 16:23:34 GMT

All,

when a user try to login to SAS EG, the user is getting "user ID or password is not valid" ERROR.

this is happening to only few users rest of the users are accessing fine

tried to delete the user in AD and in SMC and recreated the user again and getting the same ERROR.

SAS version is 9.3

note: password and ID is correct

see the metadata log below

2021-01-27T11:10:10,048 INFO [09088446] 1014671:sas - Client connection 1014671 for user sastrust@saspw closed.
2021-01-27T11:10:11,593 INFO [09088449] :sas - Access denied.
2021-01-27T11:10:11,593 WARN [09088449] :sas - New client connection (353039) rejected from server port 8561 for user test_user. Peer IP address and port are [::ffff:11.990.188.95]:61110 for APPNAME=SAS Enterprise Guide.
2021-01-27T11:10:11,593 INFO [09088449] :sas - Client connection 353039 closed.

Re: user ID or password is not valid SAS EG

SASKiwi — Wed, 27 Jan 2021 19:08:57 GMT

What OS do your SAS servers run on? Test a known good user ID on the same PC or test the problematic user ID on a different PC. That will prove if it is a PC problem or not.

Re: user ID or password is not valid SAS EG

gwootton — Wed, 27 Jan 2021 19:34:13 GMT

An access denied message typically occurs when the supplied user ID / password is being rejected by the authentication provider.
If UNIX, does that user/pass combination succeed via PROC PERMTEST on the Metadata Server host?

https://support.sas.com/kb/39/891.html

Re: user ID or password is not valid SAS EG

AnandVyas — Thu, 28 Jan 2021 03:00:54 GMT

Hi @sathya66

As suggested by @gwootton "PROC PERMTEST" is the best way to diagnose and troubleshoot login issues.

Re: user ID or password is not valid SAS EG

sathya66 — Thu, 28 Jan 2021 12:11:26 GMT

Thanks,

we are on UNIX so we can test this.

As I said ,it is happening to only few users (who are created post November) . The IDs which are created are able to access the UNIX server(ie: though WINSCP or putty ) however the same ID and Passwords get denied by the SAS Application with an error. we tried recreating the ID from the scratch but that did not help either .

Re: user ID or password is not valid SAS EG

Kurt_Bremser — Thu, 28 Jan 2021 12:21:55 GMT

Look at the logs of your metadata synchronization program (importpw or importad).

Re: user ID or password is not valid SAS EG

sathya66 — Thu, 28 Jan 2021 13:25:27 GMT

Thanks, Where can I find these logs in the server?
hope you are talking about these "/SASFoundation/9.4/samples/base/importad.sas" and "/SASFoundation/9.4/samples/base/importpw.sas"

Re: user ID or password is not valid SAS EG

sandeeppajni2 — Thu, 28 Jan 2021 13:29:09 GMT

Hi,

Just to ensure, whether the users added after November have a different domain? Also, I hope you are adding their user account IDs correctly in user records being created in the metadata, i.e. through SMC User Manager plugin.

Re: user ID or password is not valid SAS EG

Kurt_Bremser — Thu, 28 Jan 2021 13:39:27 GMT

@sathya66 wrote:

Thanks, Where can I find these logs in the server?
hope you are talking about these "/SASFoundation/9.4/samples/base/importad.sas" and "/SASFoundation/9.4/samples/base/importpw.sas"

Yes, these two programs are the blueprints for automatically synchronizing users from an authentication source.

importpw.sas reads from the "standard" UNIX files /etc/passwd and /etc/group, while importad.sas reads from Active Directory, but it can be adapted to any LDAP source.

One of these programs needs to be adapted to your environment, and then run regularly to keep your metadata up to date. The script with which you run that program will determine where the logs end up (-log parameter on the SAS commandline). If you never ran such a program, but always added your users manually, that's a recipe for problems. Users will stay in metadata even after being removed from the system, and you open yourself up to typos and whatnot.

Re: user ID or password is not valid SAS EG

sathya66 — Mon, 01 Feb 2021 10:12:04 GMT

Thanks,We are using this sytem for more than 8~ years and we are looking after this for the past one month and they siad that they never had this issue so that means users are automatically synchronizing from an authentication source.not sure what happened saddenly 🙂 now .

This 9.3 platform users are not using any AD. All users are setup in local AIX box and in sas metadata. Any idea Why these users (only new users) are rejecting by the SAS application(they can login to AIX server via putty/WinSCP).

Re: user ID or password is not valid SAS EG

Kurt_Bremser — Thu, 28 Jan 2021 14:16:25 GMT

Ouch. You were just lucky, but any IT-experienced person can tell you that such a setup causes problems sooner or later.

Besides that, I would be MUCH too lazy to burden myself with the work of manually keeping metadata up-to-date. We're having computers for such menial tasks.

And your manual entries do not create logs for you to inspect, so now you have an issue and not much in the way of helping to find the cause.

The only help I can give you: compare a working user with a non-working user, both in SAS metadata and in the authentication source.

How is the DefaultAuth authentication domain defined? Does it work against the operating system, or does it authenticate against the LDAP source directly?

(see some examples for LDAP here )

Re: user ID or password is not valid SAS EG

Kurt_Bremser — Thu, 28 Jan 2021 14:29:10 GMT

What I meant in particular:

If your metadata tries to directly authenticate against the LDAP source, then the fact that somebody can log on to the system itself is quite meaningless. If the metadata server cannot retrieve the information from the LDAP source, you'll get the Access denied.

In our case here, the system authenticates against LDAP, and SAS authenticates against the system (no LDAP references in the config of the metadata server).

BUT the SAS metadata is synchronized directly against LDAP, using a variant of the importad program.

Betreff: user ID or password is not valid SAS EG

DanielKaiser — Mon, 01 Feb 2021 14:44:23 GMT

Do you use PAM? Maybe the users are not in the required unix-group that adds the required permissions

Betreff: user ID or password is not valid SAS EG

sathya66 — Mon, 01 Feb 2021 15:03:59 GMT

I have checked the sasauth.conf. there is no setting for "methods=pam" so there is no AD
users are setup locally in the AIX server and in SMC.
We tried cloning already existing user groups but no luck.

Betreff: user ID or password is not valid SAS EG

DanielKaiser — Mon, 01 Feb 2021 15:11:44 GMT

Maybe checking Chapter 3 of the Config Guide might help.
https://support.sas.com/documentation/installcenter/en/ikfdtnunxcg/66380/PDF/default/config.pdf

I'd bet the UNIX-Admins might have changed something like the default group for your UNIX-System

Re: user ID or password is not valid SAS EG

jcFranklin — Tue, 02 Feb 2021 16:28:31 GMT

Did you ever run the PROC PERMTEST? If so, check the logs that you enabled. What do you see in the logs? That should help point to where the failure is occurring.

Re: user ID or password is not valid SAS EG

sathya66 — Fri, 05 Feb 2021 13:29:19 GMT

Sorry I was away from Work.

Yes, we did. We are getting Access denied ERROR. see below

1? proc permtest;

2? run;

Authentication Test

Enter userid:

testuser

Enter password:

NOTE: Access denied.

ERROR: Access denied.Authentication failed.

Sasauth-debug.log-

20210205-12:42:04 Adding auth method pw

20210205-12:42:04 Initializing pw

20210205-12:42:04 Initialized 1 methods.

20210205-12:42:04 Loading method gss from <config>/SASFoundation/9.3/utilities/bin/authgss.so

20210205-12:42:04 Could not load authentication method <config>/SASFoundation/9.3/utilities/bin/authgss.so. Reason: 0509-022 Cannot load module <config>/SASFoundation/9.3/utilities/bin/authgss.so.

0509-150 Dependent module libvas64.so could not be loaded.

0509-022 Cannot load module libvas64.so.

0509-026 System error: A file or directory in the path name does not exist.

0509-022 Cannot load module <config>/SASFoundation/9.3/utilities/bin/authgss.so.

0509-150 Dependent module <config>/SASFoundation/9.3/utilities/bin/authgss.so could not be loaded.

20210205-12:42:04 GSS could not be loaded.

20210205-12:42:04 Using maxtries: 5

20210205-12:42:04 Using maxtries period: 60

20210205-12:42:04 Using maxtries wait: 300

20210205-12:42:04 Authenticating user testuser via pw

20210205-12:42:04 Authenticating user testuser via password database

20210205-12:42:05 User testuser did not authenticate. Reason: 'User password uses unknown/unsupported encryption.' (pw)

20210205-12:42:05 Request failed: 'User password uses unknown/unsupported encryption.'

Sasauth-access.log:-

20210205-12:42:05 User testuser did not authenticate. Reason: 'User password uses unknown/unsupported encryption.' (pw)

Re: user ID or password is not valid SAS EG

alexal — Fri, 05 Feb 2021 13:42:11 GMT

Switch to PAM and let your system decrypt the passwords: https://support.sas.com/kb/49/432.html

Re: user ID or password is not valid SAS EG

sathya66 — Fri, 05 Feb 2021 15:06:24 GMT

Thanks,
Any idea why the password encryption is not working now. what might have changed . This is working fine for already existing user (tried to reset the password for already existing user and it is not working for the user so we put non expiry settings for the rest of the users for now).
If we go for PAM, do we need to change any config changes from sas side (methods=pam in sasuath.conf ?) other than in the link below.

Re: user ID or password is not valid SAS EG

alexal — Fri, 05 Feb 2021 15:09:59 GMT

Something has been changed on your system, so the encryption method has changed. SAS doesn't support the encryption method that you are currently using, thus you need to use PAM and let your system decrypt passwords. No, you do not have to change anything other than sasauth.conf and /etc/pam.d/sasauth file and restart both metadata and object spawner.