AUTHDOMAIN credentials

[Ololade]

Hello Everyone,

I am new to SAS 9.4 and I am having issues with AUTHDOMAIN.

Can anyone point me to where authdomain credentials(username and password) are stored or written on SAS Metadata.

I keep getting the error "credentials could not be obtained from sas metadata server".

This error is specific to kcauthdomain,segkcauthdomain and coreauthdomain.

Thank you

[PaulHomes]

What is the specific problem you are having with auth domains? What are you trying to do when you get your error message?

I think of auth domains as a tagging mechanism - they are used to tag which credentials/logins can be used with which servers. If you look in SAS Management Console you can find them used on server connections (e.g. Server Manager > SASApp - Logical Workspace Server > SASApp - Workspace Server > Connection: SASApp - Workspace Server > Properties > Options tab) and logins (e.g. User Manager > SAS Demo User > Properties > Accounts tab). Credentials/logins for the DefaultAuth authentication domain, whether stored and fetched from metadata, or captured from user login prompts and temporarily stored in memory, can be automatically used to connect to servers tagged with the same DefaultAuth auth domain. With other authentication domains (e.g. OracleAuth) this is commonly used for storing credentials in metadata to connection to databases. The name has no specific meaning for connections and logins other than to help admins know which is which. Good alignment of authentication domains can make for easier administration and a good user experience.

For more info see the About Authentication Domains and Manage Authentication Domains sections in the SAS® 9.4 Management Console: Guide to Users and Permissions.

You can view and edit the list of available auth domains by right mouse clicking over Server Manager or User Manager in SAS Management Console and selecting the Authentication Domains menu item. You usually also have the opportunity to add new auth domains wherever you need to specify them.

If you want to see where auth domains are used then one way to do this is to use our free Metacoda Metadata Explorer plug-in. By searching for all auth domains in metadata and selecting one, the Associated Objects tabs will show which servers and logins are in that auth domain (see screenshot below). The next release of the Metacoda Plug-ins will have a new Auth Domain Reviewer plug-in which will make this info easier to find.

[Ololade]

Thank you so much Paul.

Whenever i run the fcf_autoexec.sas file on base sas, there is this portion of the code below

libname db_kc
&dbflavor
authdomain="&kcAuthDomain."
&kcDBConnOpts
&kcDBLibOpts
&dbmax_text_option;

libname seg_kc
&dbflavor
authdomain="&segkcAuthDomain."
&segKCDBConnOpts
&segKCDBLibOpts
&dbmax_text_option;

libname db_core
&dbflavor
authdomain="&coreAuthDomain."
&coreDBConnOpts
&coreDBLibOpts
&dbmax_text_option
;

The program then stops and says the credentials for the kcauthdomain cannot be obtained from metadata server.
I was wondering if there is a place in metadata that stores these logins so i can add them or modify them.

When i edit the authdomain, i can only edit the name but there is no place for logins.

Do i need to create the users on user manager and associate it with the authdomains in question for it to work? I hope this helps explain my situation better.

Thank you again.

[PaulHomes · Accepted solution]

I would ask how is the SAS process that uses that autoexec being started and which operating system identity (and SAS metadata identity) is launching it? Is it a metadata aware client application (like SAS Enterprise Guide) or a simple batch or DMS SAS process?

The authdomain= option on the libname statement is used to look up any available credentials in that auth domain for the current SAS metadata identity. Your autoexec is using macro variables for them so are you sure the macro variables are being resolved (look in the SAS log). The libname statement authdomain option searches for logins for that auth domain through the identity hierarchy for the current SAS metadata identity: the user, the users direct groups, the users indirect groups, and the implicit groups.  Often for database connections the credentials are stored in a group and the user is made a member of the group so that they have access to the shared credentials.

I would suggest you look through the groups to see if any have logins for those authentication domains and see if the user that is launching the SAS process is a member of those groups.

If you can post the SAS log (suitable sanitized) it would make things easier.

[Ololade]

Thank you so much Paul.
You just cured my sleepless nights.
I did as instructed and looked into the database groups created on SAS Metadata. I added the member that is currently running the metadata and also added the logins for each group.
It worked.

Thank you again.

[PaulHomes]

No problem. Great to hear you got it working. If this was a process that used to work then I'd recommend looking into what changed that broke it and why it was changed. This is in case 1) the previous logins and memberships were slightly different and 2) is there a likelihood the changes will be repeated and break it again.

[Neetu]

one of the other quick way of finding this is go to user manager search option and navigate to advance search .Once advance search window opens apply filter where authentication domain ="" with the domain you are looking, and just do a search. It will list you a group ..open that group and navigate to the accounts tab of that group. this is the credential that your authentication domain is using, modify it and test your connectivity again

[Ololade]

Thank you so much.

This did come in handy!!