topic Re: SAS Environment Manager Login error in Administration and Deployment

SAS Environment Manager Login error

veeraraghavulu — Thu, 21 Mar 2024 08:22:49 GMT

Hi Team,

After SSL upgrade, created a new hyperic-keystore file, it through the below error message and can able to see the updated validity period in the web url cerificate.
Could you please help on this?

Re: SAS Environment Manager Login error

gwootton — Thu, 21 Mar 2024 13:53:24 GMT

The SAS Environment Manager server log should contain additional information on the failure. When logging in to EV it calls the SAS middle tier to get information on the authenticated user to confirm they are a member of one of SAS Environment Manager user groups. This error means that request failed or did not return one of those groups.

If this is happening after changing the certificate and that new certificate has been issued by a different issuing certificate than the old one, it could be that the Environment Manager process does not trust the new certificate. It sounds like certificate itself was updated successfully if this page is being served using the new certificate. If the issuing certificate changed, did you add the new root CA and issuing (intermediate) CA to the SAS trust store?

Manage Certificates in the Trusted CA Bundle Using the SAS Deployment Manager
https://go.documentation.sas.com/doc/en/bicdc/9.4/secref/n0n1y5gwevy312n13h5bm4yf6quy.htm

Re: SAS Environment Manager Login error

veeraraghavulu — Thu, 21 Mar 2024 14:43:06 GMT

Hi Mate,

We used self signed certificates. Was installed root, intermediate and
certificates using deployment manager as mentioned in the link.
All the web urls have been working as expected except sas environment
manager url.
After enter the credentials, it shows as mentioned in the screenshot. Also
Verified the url certificate for hostname:7443, the validity has updated
till 2025 as expected.

Re: SAS Environment Manager Login error

gwootton — Fri, 22 Mar 2024 13:54:47 GMT

A self-signed certificate does not have a root or intermediary certificate, so you'd need to add the self-signed certificate to the trust store as well. Was that done?
Did you see any errors in the Environment Manager server.log that correspond to your login attempt?

Re: SAS Environment Manager Login error

veeraraghavulu — Mon, 25 Mar 2024 09:27:46 GMT

Hi Mate,

was added the certificates in the same way mentioned in the link through deployment Manager. Also didn't see ant errors in the server.log file.
Apart from SAS environment Manager web url, all other web url's like sas studio, logon, grid manager and so on working as expected with updated expiry dates except this url.
Creating keystore with below commands with password as hyperic, environment Manager web url working as expected but sas environment Manager agent service has not working and through the error as

openssl pkcs12 -export -chain -inkey <hostname.key> -in <hostname.crt> -name aliasname -CAfile trustedcerts.pem -out hyperic.p12

keytool -importkeystore -deststorepass hyperic -destkeypass hyperic -destkeystore hyperic.keystore -srckeystore hyperic.p12 -srcstoretype PKCS12 -srcstorepass hyperic -alias hostname
here we used aliasname as hostname

when we use below commands,

openssl pkcs12 -export -inkey hostname.key -in hostname.crt -name hq -password pass:hyperic -out hyperic.p12
keytool -importkeystore -deststorepass hyperic -destkeypass hyperic -destkeystore hyperic.keystore -srckeystore hyperic.p12 -srcstoretype PKCS12 -srcstorepass hyperic -alias hq

sas environment manager and agent both services up and running but throwing below screenshot.

Re: SAS Environment Manager Login error

gwootton — Mon, 25 Mar 2024 14:42:23 GMT

You should engage with SAS Technical Support so they can review your server log and trust store.

Re: SAS Environment Manager Login error

sangavis37 — Tue, 02 Apr 2024 07:34:50 GMT

You may have already tried this but I wanted to check if you tried/are using one of the accounts that is part of environment manager super users group or you can try sasevs@saspw. If you have sso enabled, try from a private browser.