topic Re: SAML SSO for SASStudio in Administration and Deployment

SAML SSO for SASStudio

pgielen — Thu, 31 Jul 2025 13:31:00 GMT

Hi,

We want to use SAML for our new SAS 9.4 server.

SSO is working fine for SASAmin but when we login to SASStudio in a web browser, we only get logged in the web part.

After that we get a login for the SASApp, when we fill in the same credentials , as that we use for SSO we are logged in in SASStudio.

when i cancel the login i can see this error. provided in the screenshot

is there anyone who get SSO working for SAML and web based SASStudio on a windows server ?

Thanks in advance for your help

gwootton — Thu, 31 Jul 2025 13:53:38 GMT

The SAML credentials wouldn't be valid to start a Workspace Server process, so you'd need to store host credentials in metadata for each user, or use token authentication so the Workspace Server runs using a shared account.
How to Configure SAS Token Authentication
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/p06o3ymf2cuw16n1cmyi47t9icsn.htm

pgielen — Thu, 31 Jul 2025 13:57:11 GMT

Thank you for your reply , the sas token is not an option.

We tried that, but than all users are working in the same directory, they all need access to their own files and shares.

pgielen — Thu, 31 Jul 2025 14:26:00 GMT

sorry SAS is still very new to me.

Can you tell me how i can store host credentials in metadata for each user ?

Patrick

AhmedAl_Attar — Thu, 31 Jul 2025 14:36:35 GMT

I don't think storing users credentials in the Metadata would be a workable solution!

Just think about what would you do, if and when users change their Passwords? how would you keep your metadata in sync?

just my two cents

gwootton — Thu, 31 Jul 2025 15:03:34 GMT

Each user would need to store their host launch credentials (user ID and password) under the DefaultAuth authentication domain. Whenever their host credential password changed as @AhmedAl_Attar mentioned they would need to update this.
Your users could store a credential using the Enterprise Guide, SAS Management Console, or Personal Login Manager desktop applications, or through the SAS Environment Manager mid tier application (https://midtier.example.com:8343/SASEnvironmentMgrMidTier/).

Environment Manager - Update a Stored Password
https://go.documentation.sas.com/doc/en/bicdc/9.4/evadmfun/n1rx8gbcz1v4jcn1rhnnbxgdh495.htm#n01imi2ex150rfn102y94vzgs92f

SAS Management Console - Update the Password in a Login
https://go.documentation.sas.com/doc/en/bicdc/9.4/mcsecug/n1kxhdu1ams2rzn180hnad7xwzm1.htm#n028hk1vq5owo0n1msv1j69x27ot

pgielen — Thu, 31 Jul 2025 15:36:08 GMT

Thank you all, for your help.

I will dive further into this, was really hoping we could get rid of Kerberos.