topic Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC in Administration and Deployment

implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

siddhu1 — Mon, 16 Jun 2025 09:51:20 GMT

Hi,
I Want to implement the SSO for the SAS fat clients like SAS Enterprise guide, sas di studio and SAS Management Console.
Generally used to open SAS tools from Citrix Windows 2019 server and the code executes on linux server.
Can anyone help us to implement the SSO using the IWA method for sas fat clients.

Kind Regards,

Siddhu

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

JuanS_OCS — Mon, 16 Jun 2025 09:58:13 GMT

Hi @siddhu1 ,

since your servers are on Linux, you are bound to set up Kerberos IWA system between the servers and your clients (and, preferably, between your SAS servers and your DBMS).

IWA with Kerberos is described in the SAS documentation. If you have any more specific question, please feel free to raise those questions!

Best ,

Juan

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

siddhu1 — Mon, 16 Jun 2025 10:42:10 GMT

Hi,
Do we need to setup any SPN's (service prinicpal name ) for linux servers (of each meta, compute servers) with the AD of Windows server before setting up the kerberos configuration. Is it possible to provide any step on this.

Kind Regards,

Siddhu1

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

JuanS_OCS — Mon, 16 Jun 2025 11:02:18 GMT

Hi,

yes, you will need SPNs and a UPN, and to enable (contrained) Keberos delegation.

Again, it is all well documented by SAS: https://documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1d1zo1jsf2o0en1ehu4c4simfky.htm

If what you need is an overview, you can find a nice one provided by @PaulHomes here: https://platformadmin.com/blogs/paul/2015/01/iwa-sas-94m2-linux/

It is based on an old maintenance (2), but I am sure that, by reading the documentation provided by SAS, you can make the adjustments required for your actual SAS environment.

Kind regards,

Juan

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

siddhu1 — Tue, 22 Jul 2025 17:05:49 GMT

Hi,
Need some clarification while creating the SPN's as meta and three compute servers are on linux and SAS EG is installed on the windows server 2019 machine.
Do we need to use SAS or Host in the SPN statement as it is quite confusing which one to use.
Set -A SAS/<meta servernamr> servicename
Set -A SAS/<computesever1> servicename
Set -A SAS/<computeserver2> servicename
OR
Set -A host/<meta servernamr> servicename
Set -A host/<computesever1> servicename
Set -A host/<computeserver2> servicename
Can someone clarify on this.

Kind Regards,
Siddhu1

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

gwootton — Fri, 25 Jul 2025 12:48:54 GMT

The Metadata Server and Object Spawner use the service principal SAS/hostname by default, though this can be overridden using the "SAS_SERVICE_PRINCIPAL_NAME" environment variable, which would be required if the SPN and UPN do not match. That would be the case if you were assigning multiple SPNs to a single AD identity.

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

siddhu1 — Wed, 30 Jul 2025 05:13:36 GMT

Hi Greg,
Thanks for your response.
I have created the SPN's for the one meta and three compute servers.
Could you please let me know whether we need one keytab file for all servers or separately required for each server.

Kind Regards,
Siddhu1

Re: implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

gwootton — Wed, 30 Jul 2025 17:42:41 GMT

You could use a single keytab for all, the process will search for the SPN it wants within the keytab file.