topic Re: Question regarding configuration of Kerberos for SAS Logon Manager in SAS Viya in Administration and Deployment

Question regarding configuration of Kerberos for SAS Logon Manager in SAS Viya

EyalGonen — Wed, 04 Jun 2025 11:23:39 GMT

Hi experts,

I am reading the doc for SAS Viya LTS 2024.09 about configuring Kerberos and something is not clear to me.

I need to configure Kerberos just for inbound SAS Logon Manager and no outbound Kerberos to any data source - that is only for SAS Visual Analytics and SAS Studio users with no access to any external services/data sources.

So, do I need to copy and modify only the sas-bases/examples/kerberos/http folder to site-config or do I need to also copy and modify sas-bases/examples/kerberos/sas-servers folder too?

My doubt raises from the fact that it is my understanding that Kerberos is used only for inbound and outbound but not for internal authentication within SAS Viya so hence my confusion about whether the "sas-servers" folders is needed to be used or only the "http" folder is enough.

Re: Question regarding configuration of Kerberos for SAS Logon Manager in SAS Viya

gwootton — Tue, 17 Jun 2025 20:13:10 GMT

I think you'd only need to do http if you're just using Kerberos for SASLogon authentication and not for authenticating to downstream services. This would fall under "Configuring Kerberos Single Sign-On for the SAS Viya Platform" in the README.md in that http directory.

Re: Question regarding configuration of Kerberos for SAS Logon Manager in SAS Viya

EyalGonen — Sun, 14 Dec 2025 11:48:36 GMT

Hi @gwootton

Just thought of something... if I just configure "http" Kerberos authentication then I assume I do not need to enable any kind of delegation at all for the HTTP principal. What do you think?

Re: Question regarding configuration of Kerberos for SAS Logon Manager in SAS Viya

gwootton — Mon, 15 Dec 2025 14:03:54 GMT

I believe you are correct, no delegation would be needed if you're only authenticating to Viya and not expecting that authentication to then be used to authenticate to anything else.