topic Re: Authorization errors post Integrated Windows Authentication in Administration and Deployment

Authorization errors post Integrated Windows Authentication

kumarsandip975 — Fri, 20 Mar 2026 22:49:32 GMT

Dear All,
Recently, we implemented IWA authentication on our SAS 9.4 running on windows server.

We do use NTFS , and when user is trying to access shared file from libname, getting error.

73 libname lib1 "\\aSASXXX-xxx1.xxx.xx\SASSTU_xxx_xxx";

ERROR: User does not have appropriate authorization level for library LIB1.

ERROR: Error in the LIBNAME statement.

I was going through this post : 41477 - Authorization errors can occur when you use Integrated Windows Authentication
As suggested, I tried to add spn's cifs/myfileshare and delegate my service account on AD as object spawner is ruuning with service account, but still having same issues.

Could you please suggest if I missing anything.

Only difference is my SPN and delegation as CIFS/ , is it a case sensitive?

Re: Authorization errors post Integrated Windows Authentication

SASKiwi — Sun, 22 Mar 2026 05:26:10 GMT

What SAS user interface is used here? If it is Enterprise Guide, then change your EG server connection to not use IWA (just Windows account and password) and test the same LIBNAME again. If this works then the problem is with IWA and SPNs for the storage being accessed. If it doesn't work then the problem is with the Windows account permissions on the folders in the LIBNAME and has nothing to do with IWA.

Re: Authorization errors post Integrated Windows Authentication

kumarsandip975 — Sun, 22 Mar 2026 10:14:40 GMT

@SASKiwi We are using SAS Studio, before IWA implementation, it was working. We have no issue with access.

libname lib1 "\\aSASxxxt-srv1.xxxt.xx\SASSTU_xxx_DATA";
libname lib1 "\\xxxxxxx.xxx001.xx.xxx.xxx\SASSTU_xxx_DATA";
libname lib1 "\\10.xxx.00.xx\SASSTU_xxx_DATA";

When I tried with name and address , it worked , but not with alias.

Note: Alias path we are able to access from local pc file explorer, as we have given share access to everyone, and it should work from SAS Studio.

Re: Authorization errors post Integrated Windows Authentication

gwootton — Mon, 30 Mar 2026 14:53:37 GMT

Is there an SPN defined for the alias (cifs/<alias>, assigned to the account for the host that is hosting the file share?
If so, is delegation allowed to that SPN?

Re: Authorization errors post Integrated Windows Authentication

kumarsandip975 — Fri, 03 Apr 2026 20:00:10 GMT

@gwootton yes, spn(cifs/aliases) are defined on CN=Host and we delegated the same to service account.

Re: Authorization errors post Integrated Windows Authentication

gwootton — Fri, 10 Apr 2026 13:00:09 GMT

I ran into a similar issue recently and the issue ended up being that the computer account (not the service account) where the SAS job was running needed delegation permitted to the CIFS SPN.

Re: Authorization errors post Integrated Windows Authentication

kumarsandip975 — Mon, 13 Apr 2026 21:52:25 GMT

@gwootton Should I consider below setting registering SPN's and delegation?

1. Registering SPN's -

1.1. Where to register SPN's - user object or computer object? - computer object.

1.2. Why ? These are file servers, SMB/CIFS services run under LocalSystem.

2. Delegation SPN's -

2.1. As SAS Object Spawner service is running with service account. Delegation always should on the ACCOUNT THAT STARTS THE CONNECTION, and If delegation is needed, configure constrained delegation.

Re: Authorization errors post Integrated Windows Authentication

gwootton — Tue, 14 Apr 2026 16:10:00 GMT

In my case, the "account that starts the connection" was the computer account where SAS was running despite the launcher of sas, the object spawner, running as a service account. So, it was necessary to trust for delegation from the computer account to the cifs/file-server SPN.