Credentials Not Passed to Connect Spawner When Using IWA

[JimmyJoeBob]

Scenario:

• SAS 9.4 M8 in Windows Server 2022 x64
• SAS EG 8.4 on Windows 10 x64
• All hosts are in the same AD forest/domain
• SAS was configured during installation for Integrated Windows Authentication (IWA), using a plan file recently produced by SAS engineers (our previous one didn't include SAS/CONNECT).
• SASMeta - Logical Metadata Server is configured for Host authentication, Security Package = Kerberos
  • - sspi option is part of the service startup arguments
• SASApp - Logical Workspace Server is configured for Host authentication, Security Package = Kerberos
• Connection: Connect Spawner is configured for Integrated Windows Authentication, DefaultAuth domain
  
  • Connect Spawner servide includes -sspi REG_NONE in its Parameters key
• Object Spawner includes -sspi REG_NONE in its Parameters key
• Kerberos Constrained Delegation (KCD) is configured and working for all other SAS usage (remote SQL, file shares).
• The library in the LIBNAME statement is an ODBC connection to a database on a remote MS-SQL server that authenticates using domain credentials.

When EG clients connect to SAS using stored credentials, the following code works as intended.

When EG clients connect to SAS using IWA, the code fails with ERROR: CLI error trying to establish connection: [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Login failed for user 'NT
AUTHORITY\ANONYMOUS LOGON'.

All other code works as desired, regardless of EG authentication. This leads me to believe that there's a post-setup SAS/CONNECT configuration I've missed, but I can't seem to locate it.

TIA,
Jim
SAS Admin, Central WA Univ

OPTIONS AUTOSIGNON=Yes SASCMD="!sascmd";

%LET StuCenLib =;
%LET StuEndLib =;

rsubmit task1 wait=no sysrputsync=yes;

	LIBNAME SS META LIBRARY="Static_Store";
	data Student_Census;
		set SS.STU_Student_Census;
	run;
	%sysrput StuCenLib=%sysfunc(pathname(work));
	%sysrput task1code = &sysinfo;
	LIBNAME SS CLEAR;

endrsubmit;

%PUT NOTE: %DateTimeStamp First data step began;


rsubmit task2 wait=no sysrputsync=yes;

	LIBNAME SS META LIBRARY="Static_Store";
	data Student_End;
		set SS.STU_Student_End;
	run;
	%sysrput StuEndLib=%sysfunc(pathname(work));
	%sysrput task2code = &sysinfo;
	LIBNAME SS CLEAR;

endrsubmit;

%PUT NOTE: %DateTimeStamp Second data step began;

waitfor _all_ task1 task2;
%PUT NOTE: %DateTimeStamp All data steps ended;
rget process=task1;
rget process=task2;

%PUT StuCenLib = &StuCenLib, StuEndLib = &StuEndLib;
%PUT Task1Code = &Task1Code, Task2Code = &Task2Code;

LIBNAME StuCen "&StuCenLib";
LIBNAME StuEnd "&StuEndLib";

%PUT NOTE: %DateTimeStamp Proc sql began;
proc sql;
	CREATE TABLE Cen_End AS 
		SELECT
			sc.STRM
			, sc.EMPLID
		FROM StuCen.Student_Census AS sc
			LEFT JOIN StuEnd.Student_End AS se
				ON se.STRM = sc.STRM
				AND se.EMPLID = sc.EMPLID
		WHERE missing(se.EMPLID)
	;
quit;