topic Re: Group Membership error in Administration and Deployment

Group Membership error

Unarinen12 — Mon, 21 Oct 2024 08:21:26 GMT

Hi Team,

I am currently experiencning the following issues can someone advise

Version and License

Using the Azure marketplace SAS Viya Pay-As-You-Go plan.

sasViyaCadenceVersion: 2024.08

Setup and requirements

We ran the deployment via Azure. There are 2 issues that need to be resolved:

Run Code: Only viya_admin user can connect to and use compute context to run code. Other users created in keycloak and added to SASAdminstriators group can sign in, but can't connect and run code
Connect to Azure blob storage (with Microsoft sign-in): I followed the documentation for connecting to blob storage which suggested setting up Microsoft authentication. We followed the documentation here (https://go.documentation.sas.com/doc/en/sasadmincdc/v_056/calauthmdl/n1iyx40th7exrqn1ej8t12gfhm88.htm#n1btw367gbj4t7n1is4wg18q5mdk) which does successfully create a user sign in which seems to function, but provides the following error.

It is unclear whether this error suggests an error on the side of Azure or SAS Viya (or Keycloak). We couldn't find any documentation to suggest how to fix this.

The only changes made after the Azure deployment were adding additional users on keycloak and setting up the oauth.providers specified in the documentation linked above.

Re: Group Membership error

gwootton — Tue, 22 Oct 2024 19:21:49 GMT

In addition to logging in (authentication), you must also provide Viya with a list of users (identity provisioning).
Your authentication provider can be an LDAP server, OIDC, SAML or Kerberos.
Your identity provider can either be LDAP or SCIM.
The account identifier must match between your authentication and identity providers exactly.
The error message saying the system could not obtain group memberships means authentication was successful, but when SAS Logon Manager called the identities service to request the groups the authenticated user is a member of, this request failed, suggesting identity provisioning has not been configured.
The identities service also providers uid/gid numbers to allow users to run compute sessions.

This documentation goes into more detail on Identity Management:
https://go.documentation.sas.com/doc/en/sasadmincdc/v_057/calids/titlepage.htm

Re: Group Membership error

JuanS_OCS — Mon, 28 Oct 2024 09:29:00 GMT

Hello @Unarinen12 ,

on top of what @gwootton , keycloack is not per-se supported by SAS. There has been some testing but it is very limited. Therefore you use it at your own risk, basically. Feel free to reach out to SAS Tech Support and Azure support, but please do note that remark.

https://communities.sas.com/t5/Administration-and-Deployment/Using-keycloak-in-managing-user-permissions-in-SAS-Viya/td-p/909750

https://communities.sas.com/t5/SAS-Viya-on-Microsoft-Azure/SAS-Viya-on-Azure-and-Azure-AD/td-p/861120

https://github.com/sassoftware/vscode-sas-extension/issues/1198

Is Keycloak a component brought by you or by the SAS pay-as-you-go deployment?