topic Re: How to force IWA connection from EG to SAS Metadata Server to automatically append the domain na in Administration and Deployment

How to force IWA connection from EG to SAS Metadata Server to automatically append the domain name?

EyalGonen — Sun, 11 Sep 2022 10:37:09 GMT

Hi experts,

Question is how to force IWA from EG 8.x on Windows desktop to SAS 9.4M7 Metadata Server on Linux to automatically append the domain name to the account name (user name)?

Currently, when an end user opens up EG and selects to use the IWA option to connect to the Metadata Server, the username that SAS Metadata Server looks up is “username” whereas we want the SAS Metadata Server to lookup “username@domain” or "domain\username" in the list of accounts it maintains for proper identification of the end user.

Anyone has any idea if this is doable and how to accomplish?

Thanks,

Eyal

Re: How to force IWA connection from EG to SAS Metadata Server to automatically append the domain na

gwootton — Mon, 12 Sep 2022 13:50:16 GMT

What problem are you trying to solve? Do you have multiple users with the same userid and different domains, or a userid perhaps specified under a different authentication domain that should not be considered for authentication?

The documentation mentions using SASUSEKERBNAME when you have different users with the same user ID under different domains.

SAS 9.4 Administration - How to Configure Integrated Windows Authentication - User Logins
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1d1zo1jsf2o0en1ehu4c4simfky.htm#n15h2oxulh91hln160fqqmdkrkvl

SAS 9.4 Administration - Windows User ID Formats
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1xabf7u29o4lfn1l7l8ac7bfxme.htm

Re: How to force IWA connection from EG to SAS Metadata Server to automatically append the domain na

EyalGonen — Thu, 15 Sep 2022 07:40:12 GMT

Hi @gwootton

Thanks for replying. It is a complicated setup - don't want to bother you with the details.

The SASUSEKERBNAME option you mentioned ... will that work with SAS Metadata Server on Linux (as in this case)? Is this variable set up on the EG client?

Re: How to force IWA connection from EG to SAS Metadata Server to automatically append the domain na

gwootton — Thu, 15 Sep 2022 12:16:09 GMT

I've not used it before, but from the documentation it seems like:
- This would work with Metadata on Linux
- This is done on the server side

So, I'm thinking in your <SASConfig>/Levn/SASMeta/MetadataServer/MetadataServer_usermods.sh you would add:
export SASUSEKERBNAME=true

Re: How to force IWA connection from EG to SAS Metadata Server to automatically append the domain na

Sajid01 — Tue, 20 Sep 2022 15:25:09 GMT

Hello @EyalGonen

If your objective it is to use user@domain.com for authentication then you look for direct LDAP authentication (https://documentation.sas.com/doc/en/bicdc/9.4/bisecag/n0w8oa3erw568vn192xwf0872npk.htm).

One has manually add the user@domain while creating a user identity in the metadata server.

However according to this https://documentation.sas.com/doc/en/bicdc/9.4/bisecag/n0hc2dvantejyvn1fip0iy3iydop.htm does not support SSO.
Do read this reference, even though a bit dated but very useful. https://support.sas.com/rnd/itech/doc9/admin_oma/security/auth/security_impauthalt.html