ERROR: Invalid credentials when starting Workspace Server via SAS X command

[bheinsius]

Hi,

This is 94M3 on Linux.

I can run this command from the linux bash shell, it runs fine:

/apps/sas/SASConfig/Lev3/SASApp/WorkspaceServer/WorkspaceServer.sh -sysin /tmp/mySasProgram.sas

Now I run this command from a SAS Enterprise Guide-started Workspace Server session from an X command with this code:

x '/apps/sas/SASConfig/Lev3/WorkspaceServer/WorkspaceServer.sh -sysin /tmp/mySasProgram.sas';

It does not run fine. The Workspace Server session is started but metadata libraries are not assigned.

The log shows:

2017-08-03T17:56:06,321 ERROR [00000006] :bart.heinsius - ERROR: Invalid credentials
2017-08-03T17:56:06,321 ERROR [00000006] :bart.heinsius - ERROR: Access denied.

The metadata server log shows (don't mind the time stamps):

2017-08-02T18:36:01,320 WARN  [01144984] : SYSTEM@MUNTSE-S-10161 - SAS token not found from bart.heinsius.

2017-08-02T18:36:01,320 WARN  [01144984] : SYSTEM@MUNTSE-S-10161 - New client connection (36753) rejected from server port 38561 for user bart.heinsius@!*(generatedpassworddomain)*!. Peer IP address and port are [::ffff:144.209.58.209]:38902 for APPNAME=SAS.

2017-08-02T18:36:01,320 INFO  [01144984] : SYSTEM@MUNTSE-S-10161 - Client connection 36753 closed.

It seems that the shell spawned by the xcmd is not the same as my normal login shell.

Why is this? What can I do to fix it?

Bart

[LinusH · Accepted solution]

I'm not sure I can answer your question, but why are you doing it like this?
The worspcace server is normally started by the object spawner.
If you need to run jobs in batch/background, use the BatchServer.
If you want to spawn sessions from a current SAS session, an alternative is MP Connect.

[PaulHomes]

Hi Bart,

If you turn on debugging for the SAS Object Spawner and launch a SAS Workspace Server you will see there are several additional parameters and environment variables passed to WorkspaceServer.sh to make it behave like a workspace server. Here is an example:

2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo - Command being used is /opt/sas94m3/config/Lev1/SASApp/WorkspaceServer/WorkspaceServer.sh.
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -    >noterminal< (Standard options)
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -    >noxcmd< (Standard options)
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -    >netencryptalgorithm< (Standard options)
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -       >SASProprietary<
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -    >metaserver< (Standard options)
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -       >sas94m3lnx01.corp.example.com<
2017-08-04T07:51:33,779 DEBUG [00260251] :sasdemo -    >metaport< (Standard options)
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >8561<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >metarepository< (Standard options)
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >Foundation<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >locale< (Client requirement)
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >en_AU<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >objectserver< (Standard options)
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >objectserverparms< (Standard options)
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >protocol=bridge spawned spp=42875 cid=122 dnsmatch=sas94m3lnx01.corp.example.com pb classfactory=440196D4-90F0-11D0-9F41-00A024BB830C server=OMSOBJ:SERVERCOMPONENT/A53NPRYA.AZ00000C cel=credentials recon<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -  Environment variables are:
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >METAUSER<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >sasdemo@!*(generatedpassworddomain)*!<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -    >METAPASS<
2017-08-04T07:51:33,780 DEBUG [00260251] :sasdemo -       >********<
2017-08-04T07:51:33,975 INFO  [00260251] :sasdemo - Created process 10308 using credentials sasdemo (child id 122).

Notice the METAUSER and METAPASS environment variables? I believe that these are a single use SAS token used for the spawned SAS Workspace Server process to connect to the SAS Metadata Server for pre-assigning libraries etc. If you look in the SAS Metadata Server log around the same time you can see a SAS Token Authentication connection:

2017-08-04T07:51:34,105 INFO  [17675655] :sasdemo - New client connection (356460) accepted from server port 8561 for SAS token user sasdemo.  Encryption level is Credentials using encryption algorithm SASPROPRIETARY.  Peer IP address and port are [::ffff:192.168.92.25]:34946 for APPNAME=SAS Workspace Server.
2017-08-04T07:51:34,105 INFO  [17675655] :sasdemo - Request made to cluster SASMeta - Logical Metadata Server (A53NPRYA.AX000001).
2017-08-04T07:51:34,105 INFO  [17675655] :sasdemo - Redirect client in cluster SASMeta - Logical Metadata Server (A53NPRYA.AX000001) to server SASMeta - Metadata Server (A53NPRYA.AZ000001) at sas94m3lnx01.corp.example.com:8561.

I am wondering if those environment variables are being inherited by the additional spawned process you are launching and because the single-use SAS token has already been used you are getting an authentication error due to it's replay (trying to use a token again).

When you launch WorkspaceServer.sh -sysin from a console none of these additional parameters and environment vars are being added so it is essentially similar to sas -sysin to run a batch job (but with all of the platform configs and autoexecs being used).

To confirm this, you could try creating a wrapper shell script and unsetting METAUSER and METAPASS before calling WorkspaceServer.sh.

I hope this helps. Like @LinusH I am wondering what you are trying to achieve here? Are you trying to spawn an additional "true" workspace server from within a workspace server? Or are you just trying to run a batch job from a workspace server?

Cheers

Paul

[nhvdwalt]

I agree with @LinusH. This is an usual use case. Its like Enterprise Guide calling itself in a way. I would also reconsider. "Usually" X commands are used to call commands, etc. ouside of SAS e.g. OS commands, custome UNIX scripts, etc. Any SAS code you need to run can run from that same session that is running the X command. But again, there are many use cases out there in the real world...so let's see.

[bheinsius]

Thank you to all.

Switching to the SASApp Batch Server fixed it.

My use case is to allow EG users to schedule their SAS model through the Linux AT command, from EG.

The EG user runs my schedule code node that prompts him for a model to run (mymodel in the example code below) and a time to run it (23:45 in de example code below).

My schedule code node then creates an AT command file at /tmp/at_command.txt:

(simplified)

/apps/sas/SASConfig/Lev3/SASApp/BatchServer/sasbatch.sh -sysin /sascode/runmodel.sas -set model mymodel

and submits the following code to schedule it using Linux AT:

x "at -m -f /tmp/at_command.txt 23:45";