Integrated windows authentication failed

[RupaJ]

Thanks @PaulHomes and @alexal!

We have centrify that authenticates the users. Would sssd-krb5-common package still be the one that will make it work? 

[alexal]

@RupaJ,

If you are using Centrify, you can resolve the problem just by adding /usr/share/centrifydc/kerberos/lib64/ to the LD_LIBRARY_PATH. Also, if you do not want to change LD_LIBRARY_PATH, you can create symlinks for these files in /lib64/.

/usr/share/centrifydc/kerberos/lib64/libgssapi_krb5.so
/usr/share/centrifydc/kerberos/lib64/libgssapi_krb5.so.2
/usr/share/centrifydc/kerberos/lib64/libgssapi_krb5.so.2.2

[alexal · Accepted solution]

I just want to say that the problem has been resolved. We have linked SAS to specific GSSAPI modules, changed a few settings in sasauth.conf, and the workspace server.

[RupaJ]

Thanks so much @alexal for your time!

Just to elaborate on what was done. I was waiting to understand few things. So the delay.

1) Create the symlinks for the GSSAPI libraries on the compute server.

        ln -s /lib64/libgssapi_krb5.so.2.2 /lib64/libgssapi_krb5.so

2)  Add the enviornment variable in the file level_env_usermods.sh in the path /opt/sas/config/Lev1/ on the compute server

      export TKSECURE_GSSAPI_LIBRARY=/lib64/libgssapi_krb5.so.2.2

3)  Add the below in the file /opt/sas/sashome/SASFoundation/9.4/utilities/bin/sasauth.conf on the compute server.

         gssLibrary=/lib64/libgssapi_krb5.so.2.2

4) Add the below script to /opt/sas/config/Lev1/SASApp/WorkspaceServer_usermods.sh

workspace_user=$(whoami)
workspace_user_ccaches=$(find /tmp -maxdepth 1 -user ${workspace_user} -type f -name "krb5cc_*" -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' | head -n 1)
 
if test ! -z "$workspace_user_ccaches"; then
            echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."
            echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"
            export KRB5CCNAME=$workspace_user_ccaches
            echo "KRB5CCNAME has been set to ${KRB5CCNAME}."
else
            echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."
fi 

I wish SAS documentation is modified to add these steps. It will save so much time. I hope this is useful for someone trying to configure SSO with centrify,