topic Re: SAS auto generating Kerberos TGT in Administration and Deployment

SAS auto generating Kerberos TGT

nhvdwalt — Tue, 20 Jun 2017 07:10:09 GMT

Hi all,

Outside of SAS Grid and outside of Hadoop...

Does anyone know if it's possible for SAS to automatically requests a TGT i.e. kinit when a user logs onto UNIX ?

I can include a call to kinit somewhere e.g. Workspace_Server_usermods.sh, but then I need a keytab file, which I'm trying to avoid.

I know the Object Spawner in SAS Grid can do this, but I'm looking for this functionality outside of Grid.

Thanks a mil,

Nico.

Re: SAS auto generating Kerberos TGT

alexal — Tue, 20 Jun 2017 07:21:05 GMT

@nhvdwalt,

If you configure PAM authentication and uncomment the following line in /<SASHome>/SASFoundation/9.4/utilities/bin/sasauth.conf:

PAM_SETCREDENTIALS=TRUE

The Kerberos ticket will be created every time when the sasauth process will be called.

Let me know if you have any questions.

Re: SAS auto generating Kerberos TGT

nhvdwalt — Tue, 20 Jun 2017 08:39:16 GMT

Thanks alexal, you have no idea how long I've looked for this 🙂

If I test it through PROC PERMTEST, it's works, but not via Enterprise Guide. Would I need to restart the Object Spawner ?

Off topic.....Is it possible to get notification for new posts on the site ? I've looked through my settings but cannnot find anything.

Thanks,

Nico.

Re: SAS auto generating Kerberos TGT

alexal — Tue, 20 Jun 2017 09:00:09 GMT

@nhvdwalt,

>> you have no idea how long I've looked for this

You are welcome.

>> Would I need to restart the Object Spawner ?

Yes, also you should add the following script to WorkspaceServer_usermods.sh

workspace_user=$(whoami)
workspace_user_ccaches=$(find /tmp -maxdepth 1 -user ${workspace_user} -type f -name "krb5cc_*" -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' | head -n 1)
if test ! -z "$workspace_user_ccaches"; then
echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."
echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"
export KRB5CCNAME=$workspace_user_ccaches
echo "KRB5CCNAME has been set to ${KRB5CCNAME}."
else
echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."
fi

>> Is it possible to get notification for new posts on the site ?

Yes, you can subscribe to the topic or the board. Click on the wheel in the right top corner.

Re: SAS auto generating Kerberos TGT

nhvdwalt — Tue, 20 Jun 2017 10:54:47 GMT

Thanks a mil, all working now 🙂