topic Re: SAS Viya 3.5 CAS Host Account in Administration and Deployment

SAS Viya 3.5 CAS Host Account

jwward65 — Thu, 14 Oct 2021 13:53:59 GMT

I have found lots of information regarding the CASHostAccountRequired group and everything I found says to use this functionality, the user needs to have a CAS Host Account, but yet I cannot find any information or documentation on how to actually accomplish this. Does anyone have any guidance on this?

Scenario:

We have ALL users in Active Directory groups that are in the custom CASHostAccountRequired group, but yet only some users are not able to start a CAS session! I can't figure out why this doesn't effect ALL users.

Re: SAS Viya 3.5 CAS Host Account

gwootton — Thu, 14 Oct 2021 20:05:07 GMT

If a user is a member of the custom group CASHostAccountRequired, it instructs their CAS session to start as that user rather than the user "cas". So by a CAS host account we mean that the user must exist on the CAS server hosts. I'm guessing that the users who cannot start CAS sessions are not able to own processes on the CAS server hosts. Sounds like however you are provisioning accounts on the servers, like PAM/SSSD, is pulling a different set of identities than Viya.

Re: SAS Viya 3.5 CAS Host Account

jwward65 — Mon, 18 Oct 2021 12:33:37 GMT

Ended up figuring it out with SAS TS. Apparently the SSSD service on one of the nodes wasn't refreshing and any new users added to the Active Directory group wasn't being recognized on this node. In working with our Linux admin, once SSSD was stopped, cache cleared and restarted, it resolved the issue.

For reference, this was what was run to refresh the SSSD service...

service sssd stop ; rm -f /var/lib/sss/db/* /var/log/sssd/* ; service sssd start

Thanks,

John