Constrained Delegation in a 9.4 M8 Linux Grid

CCC1492_ME — Tue, 23 Jan 2024 21:08:33 GMT

We are attempting to stand a SAS 9.4 M8 Linux Grid using the Workspace Orchestrator for the first time. Previously we used LSF, but LSF does not support Constrained Delegation in Kerberos, only unconstrained. We have not been successful. Anyone out here have any solutions or thoughts? These would be greatly appreciated. The SAS documentation does not rectify this issue.

Thx

Re: Constrained Delegation in a 9.4 M8 Linux Grid

gwootton — Tue, 23 Jan 2024 22:26:28 GMT

What issue are you encountering when trying to configure constrained delegation?
You'd need to have keytab(s) for the object spawner and grid on the compute hosts and pointed to in those configuration files, and the SAS_CONSTRAINED_DELEG_ENABLED environment variable set to 1 for both object spawner (level_env_usermods.sh) and workload orchestrator (sgmg_usermods.sh).

If you aren't using the standard SPN as the UPN (SAS/hostname and HTTP/hostname), the SAS_SERVICE_PRINCIPAL variable would also need to be set to the UPN in those places.

You may wish to engage SAS Technical Support to help you through any issues you're encountering.

How to Configure Integrated Windows Authentication
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1d1zo1jsf2o0en1ehu4c4simfky.htm

How to Configure Kerberos Constrained Delegation
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/p1jg2eif6qym5qn1co79sdclcyt7.htm

topic Constrained Delegation in a 9.4 M8 Linux Grid in Administration and Deployment

Constrained Delegation in a 9.4 M8 Linux Grid

Re: Constrained Delegation in a 9.4 M8 Linux Grid