sas-airflow-provider OAuth

misul — Tue, 04 Mar 2025 17:09:00 GMT

Hello,

I am experimenting with sas-airflow-provider (https://github.com/sassoftware/sas-airflow-provider). I am trying to use the SASJobExecutionOperator to launch SAS Job Definition objects from Airflow. Note: I am using SAS Viya 3.5, not 4.0!

Everything worked in the development environment, where we have fewer restrictions, but I am missing something in production.

Everything is as straightforward as in the documentation:

1. Task to execute SAS code using a SAS Job:

sas_job_1_task = SASJobExecutionOperator( task_id='airflow-sas-job-example-1', job_name='/Public/Airflow/airflow-sas-job', connection_name='sas_default', job_exec_log=True, add_airflow_vars=True, parameters={ **job_parameters, "code_name": "airflow-sas-code.sas" }, dag=dag, )

2. sas_default connection:

3. Airflow log file:

{base.py:84} INFO - Retrieving connection 'sas_default' {sas.py:55} INFO - Using custom TLS CA certificate bundle file {sas.py:63} INFO - Creating session for connection named sas_default to host https://mycompany.com/ {sas.py:83} INFO - Get oauth token (see README if this crashes) {taskinstance.py:3311} ERROR - Task failed with exception <...> requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))

4. No sessions were created on the SAS Viya side.

My guess is that something is missing related to OAuth. For the connection, I provide only the SAS Viya user and password, as well as a certificate, but no OAuth token.

Among the parameters sent to SAS Viya, I believe there are default values related to authorization, as shown below:

Basic {base64(client_id:client_secret)}

client_id defaults to "sas.cli"
client_secret defaults to an empty string

But this shouldn't be a problem, right? I'm not sure how to proceed or resolve this issue, not much expertise in this area.

Mindaugas

Re: sas-airflow-provider OAuth

gwootton — Tue, 04 Mar 2025 19:32:13 GMT

SASLogon returns an oauth token when you log in. The client ID and secret (sas.cli:) is valid, this is the client used by the sas-admin CLI.
The failure here seems to be saying that when airflow is trying to connect to the environment https://mycompany.com/SASLogon to get a token, the network connection is being reset on the other side. I would suspect this has something to do with firewall limitations in place on your production environment preventing a connection from the host where the task is running.

Re: sas-airflow-provider OAuth

misul — Fri, 07 Mar 2025 07:37:13 GMT

You were right; this was a WAF-related issue. We had an IP filter for access, and after adding the IP to the whitelist, everything works fine!

topic sas-airflow-provider OAuth in Administration and Deployment

sas-airflow-provider OAuth

Re: sas-airflow-provider OAuth

Re: sas-airflow-provider OAuth