Kerberos setup in SAS 9.4 M8(Hosted on Windows).

[kumarsandip975]

Dear Community,

I have a very basic question, but I guess it is important to decide when setting up kerberos in the sas 9.4 m8 environment(running on windows machine). 

We have services (object spawner) is running with local system, as per document https://documentation.sas.com/doc/en/bicdc/9.4/bisecag/p1jg2eif6qym5qn1co79sdclcyt7.htm , 

The delegation privilege is granted to the SAS Object Spawner.

• If the SAS Object Spawner is running on Windows under the local system account, select the host machine in Active Directory under Computers. On the Delegation tab, select the Trust this computer for delegation to specified services only option.
• If the SAS Object Spawner is running on Windows under a domain account, select the user account in Active Directory, typically under Users. On the Delegation tab, select the Trust this user for delegation to the specified services only option.

My question is - what options is really recommended, local system account or domain account ? 

[SASKiwi]

We've always used the local system account as it will always have the required permissions to run any services.

[gwootton]

I think this is a question of security posture. In this example were you to use local system you are allowing local system to delegate to specific services, so this would apply to any service running as local system and not just the object spawner. If you wanted to limit this delegation permission only to the object spawner, you'd need to use a service account.