How to remove host authentication from EG

[Jagamohan123]

Hi Team,

I have created a new SAS Application server named as SASApp_Pricing and while connecting to it from EG, asking host credentials.

Once I provide host credentials, it is taking me to the correct files provided in File navigation configuration tab. Till now, the configuration is working as per my clients requirement.

Now, The problem is that we can not share the host credentials to all  SAS end users so, in that case seeking your help.

Query:  What configuration needed and where so that the server connection from EG won't ask for host credentials.

Please refer attached screen shot for more details. 

Thanks,

Jagamohan 

[JuanS_OCS]

Hello @Jagamohan123,

I think SAS EG should be not asking for credentials, at all. You should give a look into IWA Authentication, and then let the users to connect with the IWA (Integrated Windows Authentication) in the SAS EG connection profile. Then, the users won't need to use user or password, SAS will trust the Windows credentials, automatically. You will need to have the Windows users of course in the metadata with right permissions and Log on as Batch job security policy.

Integrated Windows Authentication (explanation)

http://documentation.sas.com/?docsetId=bisecag&docsetTarget=n0go7pclcqr6q2n1bxfuk46hmtdy.htm&docsetV...

Kerberos and SAS®9.4: A Three-Headed Solution for Authentication (great paper by @StuartRogers)

http://support.sas.com/resources/papers/proceedings13/476-2013.pdf

How to Configure Integrated Windows Authentication (all your Workspace Servers)

http://documentation.sas.com/?docsetId=bisecag&docsetTarget=n1d1zo1jsf2o0en1ehu4c4simfky.htm&docsetV...

[Jagamohan123]

Hi,

Thanks a lot...

I have gone thorough the links and the case is different here...

Users are getting this authentication problem only while connecting to newly added server not to existing servers.

The configuration is identical in both existing and new server.

Thanks,

Jagamohan

[JuanS_OCS]

Hello @Jagamohan123,

I think you are missing something. If behaviour is different, some of the configuration would be different as well. Perhaps something you have not seem.

Are the 2 application servers based on the same or different object spawners? Is the metadata configuration the same? is the sasv9 and sasv9_usermods similar for both Workspace servers? Do they have the same or different Authentication Domain? Are they on the same or different hosts/servers?

[alexal]

@Jagamohan123,

I suppose that new application server context is located on a new machine? If my assumption is correct, have you created a new SAS/ SPN and new Keytab for that machine?

[Jagamohan123]

Hi Juan,

Thank you s much for your reply.

yes, it was IWA issue. 

Thanks,

Jagamohan

[JuanS_OCS]

Hello @Jagamohan123,

I wonder what would you answer to @alexal, he left good questions and it would help here.