Authorization errors post Integrated Windows Authentication

[kumarsandip975]

Dear All,
Recently, we implemented IWA authentication on our SAS 9.4 running on windows server. 

We do use NTFS , and when user is trying to access shared file from libname, getting error. 

73 libname lib1 "\\aSASXXX-xxx1.xxx.xx\SASSTU_xxx_xxx";

ERROR: User does not have appropriate authorization level for library LIB1.

ERROR: Error in the LIBNAME statement.

I was going through this post : 41477 - Authorization errors can occur when you use Integrated Windows Authentication
As suggested, I tried to add spn's cifs/myfileshare and delegate my service account on AD as object spawner is ruuning with service account, but still having same issues. 

Could you please suggest if I missing anything. 

Only difference is my SPN and delegation as CIFS/ , is it a case sensitive?

 

[SASKiwi]

What SAS user interface is used here? If it is Enterprise Guide, then change your EG server connection to not use IWA (just Windows account and password) and test the same LIBNAME again. If this works then the problem is with IWA and SPNs for the storage being accessed. If it doesn't work then the problem is with the Windows account permissions on the folders in the LIBNAME and has nothing to do with IWA.

[kumarsandip975]

@SASKiwi We are using SAS Studio, before IWA implementation, it was working. We have no issue with access. 

libname lib1 "\\aSASxxxt-srv1.xxxt.xx\SASSTU_xxx_DATA"; 
libname lib1 "\\xxxxxxx.xxx001.xx.xxx.xxx\SASSTU_xxx_DATA";  
libname lib1 "\\10.xxx.00.xx\SASSTU_xxx_DATA";

When I tried with name and address , it worked , but not with alias. 

Note: Alias path we are able to access from local pc file explorer, as we have given share access to everyone, and it should work from SAS Studio. 

 

 

[gwootton]

Is there an SPN defined for the alias (cifs/<alias>, assigned to the account for the host that is hosting the file share?
If so, is delegation allowed to that SPN?

[kumarsandip975]

@gwootton yes, spn(cifs/aliases) are defined on CN=Host and we delegated the same to service account. 

[gwootton]

I ran into a similar issue recently and the issue ended up being that the computer account (not the service account) where the SAS job was running needed delegation permitted to the CIFS SPN.

[kumarsandip975]

@gwootton Should I consider below setting registering SPN's and delegation? 

1. Registering SPN's -

1.1. Where to register SPN's - user object or computer object? - computer object.

1.2. Why ? These are file servers,  SMB/CIFS services run under LocalSystem.

2. Delegation SPN's -

2.1. As SAS Object Spawner service is running with service account. Delegation always should on the ACCOUNT THAT STARTS THE CONNECTION, and If delegation is needed, configure constrained delegation.

[gwootton]

In my case, the "account that starts the connection" was the computer account where SAS was running despite the launcher of sas, the object spawner, running as a service account. So, it was necessary to trust for delegation from the computer account to the cifs/file-server SPN.