Help running sas-viya batch job submissions

[kams]

Hello,

I am trying to initiate a batch program run using the sas-viya CLI. Our POC environment has been integrated with OAuthv2 and LDAP (SSO). To run the program, I first ran the auth login command to generate a token and then tried submitting the program as follows. It gives me an error and the program does not get submitted. Has anyone encountered this error? 

Batch plugin version: sas-batch-cli-40.2.13-20250307.1741305600

AUTH plugin version: 1.29.3

SAS Viya release: 20250211

./sas-viya auth login
Enter credentials for https://viya-poc.mycompany.com:

Userid> johndoe

Password> Login succeeded. Token saved.

./sas-viya batch jobs submit-pgm --context default --pgm-path /home/johndoe/test.sas
Failed to create the file set.
The request was not performed because of the following internal error: Folders.CreateFolder: parentURI must not be empty

[gwootton]

When using the CLI with --pgm-path, the CLI creates a "file set" with the batch service, then uploads the --pgm-path file into that file set. The file set is effectively a new folder in the path /Users/<userid>/Application Data/sas-batch/fileSets, for the userid running the batch server.

This error appears to be from the folders service, saying when we tried to create that new folder we didn't specify that path. This is probably the result of the batch service call to the folders service requesting the URI for that path not returning a result, possibly due to a permissions issue on the user's folder (/Users/userid).

Are you using reusable batch servers? Have you modified the default permissions to the SAS Content folders for users? The batch service log may have additional detail on the failure.

[kams]

Hey!

Thanks for the quick response. For some reason I am unable to find 'sas-folders' deployment in my K8s cluster. I searched for the directory under sas-bases/base/components and I couldn't find it there either. 

[doug_sas]

sas-folders and sas-types are now merged into the sas-file-store service/pod.

[kams]

My response was deleted?! I redacted information now .

{"level":"error","version":1,"source":"sas-batch","messageKey":"0xc000e7a5d0 The error returned by models/apis.getUsersAppDataFolderURI was caused by the following error: statusCode=404, errorCode=11500, message=No folder with the ID of \"\" was found., details=[path: /folders/folders/@appDataFolder correlator:]","properties":{"logger":"service/batch/api/folders","req":"POST /batch/fileSets","tenant":"provider","caller":"logs/logs.go:117"},"timeStamp":"2025-04-07T19:33:12.054866+00:00","message":"0xc000e7a5d0 The error returned by models/apis.getUsersAppDataFolderURI was caused by the following error: statusCode=404, errorCode=11500, message=No folder with the ID of \"\" was found., details=[path: /folders/folders/@appDataFolder }

[gwootton]

This seems to be saying the call to /folders/folders/@appDataFolder (which should resolve to the folder for the current user's application data directory, e.g. /Users/sasdemo/Application Data) is failing to do so.

What happens when you call that endpoint in your browser? (https://viya.example.com/folders/folders/@appDataFolder)

Does the folder /Users/userid/Application Data exist?

I believe this call should create the folder if it's missing, suggesting that Application Data doesn't exist and the user does not have permission to create it. Do you have full permissions on your user folder?

[kams]

Yes it does. As I pointed out in my initial query, we use OAuth. Does batch submission require a different method to authenticate if using OAuth (auth token for instance)? 

[gwootton]

By "yes it does" are you saying that the folder /Users/userid/Application Data exists, or that you have full permissions on your user folder (/Users/userid), or both?

When using Single-Sign On with OIDC or SAML, this is the authentication to SAS Logon Manager. SAS Logon Manager issues oauth tokens for use authenticating to the individual services, like batch.

So, when you login to the CLI when using SSO/OIDC, you would use the command sas-viya auth loginCode. This would provide you with a link to access in your browser to get a code after having logged in using your SSO method. You provide the resulting code to the CLI, and it acquires an access-token and refresh-token from SAS Logon which it uses to call services through the various plugins. When not using SSO, you would use sas-viya auth login which would prompt for a user ID and password, and acquire a token using the supplied credentials.

These authentication options are not specific to the batch plugin to the CLI or the batch service.

[kams]

Wow! 

This worked. Thank you so much! 

I have a mixed feeling about using this method for batch submissions as we used to have wrapper scripts for running batch programs in SAS 9.x We would simply ask users to append their programs with the wrapper script and internally it would execute the sas_en binary along with relevant parameters (queue name, Rlang option etc.). With SAS viya CLI, the process is now more complicated , as we'd have to generate the auth code by doing a SSO login on the browser, then come back and paste the code. I searched the community but I am not able to find an article that has steps to automate batch execution. 

But thank you so much for your input. Appreciate it.

[gwootton]

The CLI will make use of the refresh token to get a new access token so you wouldn't need to login each time, but login periodically (based on your configured refresh token validity, 14 days by default).

The interactive SSO/authCode method is because authentication is not being performed by SAS but the SSO provider (OIDC/SAML).

[doug_sas]

Look in the sas-batch-<hash> pod logs to see if there is a more detailed error.