topic Oauth setup for SAS VIYA in Administration and Deployment

Oauth setup for SAS VIYA

srinivasa_attot — Thu, 06 Mar 2025 04:59:52 GMT

Hi Friends,

We have successfully deployed SAS VIYA on Kubernetes and all the required pods are running. Now we are planning to enable oauth authentication. As per the document, the details were updated. When trying to access using oauth, I am seeing the below error. Can someone please help?

Error: There was an error when authenticating against the external identity provider: Keys cannot be null or empty

Regards,

Sirnivas

Re: Oauth setup for SAS VIYA

gwootton — Thu, 06 Mar 2025 14:06:02 GMT

This error suggests the tokenKey or tokenKeyUrl field is empty in your sas.logon.oauth.providers definition.

Re: Oauth setup for SAS VIYA

srinivasa_attot — Thu, 06 Mar 2025 16:26:57 GMT

Hi @gwootton,

They are empty and not mandatory fields.

Regards,

Srinivas

Re: Oauth setup for SAS VIYA

smopati — Thu, 06 Mar 2025 16:29:15 GMT

Srinivas,

Do you have a discovery URL instead, so it can obtain the jwks_uri from it ?

Re: Oauth setup for SAS VIYA

gwootton — Thu, 06 Mar 2025 17:02:49 GMT

You must have either discoveryUrl, tokenKey, or tokenKeyUrl populated, but no one of them is mandatory.

Re: Oauth setup for SAS VIYA

srinivasa_attot — Fri, 07 Mar 2025 05:41:39 GMT

No Discovery url is added. But when i tried after adding it gave me a different error.

Error is "The system could not obtain group memberships for <user>

Re: Oauth setup for SAS VIYA

gwootton — Fri, 07 Mar 2025 15:15:19 GMT

This means your authenticated identity is not in the identities service, so SASLogon cannot build your authentication token.

This usually means either you have not configured identity provisioning, or your identity provider is using a different field for account ID than what is being sent by your OIDC provider.