topic Re: Credentials Not Passed to Connect Spawner When Using IWA in Administration and Deployment

Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Mon, 12 Aug 2024 22:04:17 GMT

Scenario:

SAS 9.4 M8 in Windows Server 2022 x64
SAS EG 8.4 on Windows 10 x64
All hosts are in the same AD forest/domain
SAS was configured during installation for Integrated Windows Authentication (IWA), using a plan file recently produced by SAS engineers (our previous one didn't include SAS/CONNECT).
SASMeta - Logical Metadata Server is configured for Host authentication, Security Package = Kerberos
- - sspi option is part of the service startup arguments
SASApp - Logical Workspace Server is configured for Host authentication, Security Package = Kerberos
Connection: Connect Spawner is configured for Integrated Windows Authentication, DefaultAuth domain
- Connect Spawner servide includes -sspi REG_NONE in its Parameters key
Object Spawner includes -sspi REG_NONE in its Parameters key
Kerberos Constrained Delegation (KCD) is configured and working for all other SAS usage (remote SQL, file shares).
The library in the LIBNAME statement is an ODBC connection to a database on a remote MS-SQL server that authenticates using domain credentials.

When EG clients connect to SAS using stored credentials, the following code works as intended.

When EG clients connect to SAS using IWA, the code fails with ERROR: CLI error trying to establish connection: [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Login failed for user 'NT
AUTHORITY\ANONYMOUS LOGON'.

All other code works as desired, regardless of EG authentication. This leads me to believe that there's a post-setup SAS/CONNECT configuration I've missed, but I can't seem to locate it.

TIA,
Jim
SAS Admin, Central WA Univ

OPTIONS AUTOSIGNON=Yes SASCMD="!sascmd";

%LET StuCenLib =;
%LET StuEndLib =;

rsubmit task1 wait=no sysrputsync=yes;

	LIBNAME SS META LIBRARY="Static_Store";
	data Student_Census;
		set SS.STU_Student_Census;
	run;
	%sysrput StuCenLib=%sysfunc(pathname(work));
	%sysrput task1code = &sysinfo;
	LIBNAME SS CLEAR;

endrsubmit;

%PUT NOTE: %DateTimeStamp First data step began;


rsubmit task2 wait=no sysrputsync=yes;

	LIBNAME SS META LIBRARY="Static_Store";
	data Student_End;
		set SS.STU_Student_End;
	run;
	%sysrput StuEndLib=%sysfunc(pathname(work));
	%sysrput task2code = &sysinfo;
	LIBNAME SS CLEAR;

endrsubmit;

%PUT NOTE: %DateTimeStamp Second data step began;

waitfor _all_ task1 task2;
%PUT NOTE: %DateTimeStamp All data steps ended;
rget process=task1;
rget process=task2;

%PUT StuCenLib = &StuCenLib, StuEndLib = &StuEndLib;
%PUT Task1Code = &Task1Code, Task2Code = &Task2Code;

LIBNAME StuCen "&StuCenLib";
LIBNAME StuEnd "&StuEndLib";

%PUT NOTE: %DateTimeStamp Proc sql began;
proc sql;
	CREATE TABLE Cen_End AS 
		SELECT
			sc.STRM
			, sc.EMPLID
		FROM StuCen.Student_Census AS sc
			LEFT JOIN StuEnd.Student_End AS se
				ON se.STRM = sc.STRM
				AND se.EMPLID = sc.EMPLID
		WHERE missing(se.EMPLID)
	;
quit;

Re: Credentials Not Passed to Connect Spawner When Using IWA

SASKiwi — Wed, 21 Aug 2024 03:43:04 GMT

We've just been through a similar exercise ourselves, trying to get IWA and SSO going across all SAS clients and interfaces. This might be one thing you have missed and most likely need:

SAS Help Center: Windows Privileges

When your Connect Spawner runs under your server's local system account, then the above configuration must be done.

Re: Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Wed, 21 Aug 2024 14:38:11 GMT

Hm...

That was exactly what I asked our domain admins to do, but in reviewing the servers' delegation settings, I see that they set "Use any authentication protocol," not "Use Kerberos only" (I can view, but not change things in Active Directory Users and Computers).

Interesting that it works for everything except rsubmit...

I'll have them change this in my TST environment and see what shakes out.

T'anxQ!

Re: Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Wed, 21 Aug 2024 14:49:27 GMT

..actually...

I just reviewed the docs I referenced in the PowerShell script I built for them, and https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/p1jg2eif6qym5qn1co79sdclcyt7.htm says to set it as "Use any authentication protocol."

I thought I "smelled" an apparent disconnect in the SAS admin docs, but this discussion brought it together for me.

I'll let you know what happens.

Re: Credentials Not Passed to Connect Spawner When Using IWA

Sajid01 — Fri, 23 Aug 2024 14:49:00 GMT

Hello @JimmyJoeBob
I see this in the first post "ERROR: CLI error trying to establish connection: [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Login failed for user 'NTAUTHORITY\ANONYMOUS LOGON'."
This is an expected behavior.
SQL server needs credential to allow connection.

Re: Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Fri, 23 Aug 2024 15:03:44 GMT

Sajid,

As I outlined, SAS and the client are configured for Integrated Windows Authentication (IWA) and SAS and Active Directory are configured for Kerberos Constrained Delegation (KCD). This configuration works for every other use case except rsubmit. Calls to rsubmit work when the client is authenticated using stored credentials, which, from a security perspective is suboptimal.

Thx,

Re: Credentials Not Passed to Connect Spawner When Using IWA

gwootton — Fri, 23 Aug 2024 20:51:12 GMT

Have you engaged SAS Technical Support? Looks like your code isn't calling the Connect Spawner but using SASCMD to fork an MP CONNECT session off of the Workspace Server. I wonder if adding user=_sspi_ to your rsubmit would help.

Re: Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Wed, 28 Aug 2024 15:59:59 GMT

gwootton, you're correct about how this is working, and I'm working through email troubleshooting with SAS support. The good news is that I'm able to repro this in my home lab, so it doesn't seem to be something with our domain.

Re: Credentials Not Passed to Connect Spawner When Using IWA

JimmyJoeBob — Wed, 28 Aug 2024 21:47:14 GMT

My domain admins changed the delegation to "Trust this computer for delegation to any service (Kerberos only)" and saw no change in MPCONNECT behavior. That's mildly encouraging!

Re: Credentials Not Passed to Connect Spawner When Using IWA

CHandberg — Mon, 17 Nov 2025 07:23:02 GMT

Hi,

Did you solve your problem?

I'm experiencing similar problems, so if you ever found a solution it would be a great help if you could share.

Thank you in advance.

/Christian