SAML SSO for SASStudio

[pgielen]

Hi,

We want to use SAML for our new SAS 9.4 server.

SSO is working fine for SASAmin but when we login to SASStudio in a web browser, we only get logged in the web part.

After that we get a login for the SASApp, when we fill in the same credentials , as that we use for SSO we are logged in in SASStudio.

when i cancel the login i can see this error. provided in the screenshot

is there anyone who get SSO working for SAML and web based SASStudio on a windows server ?

Thanks in advance for your help

[gwootton · Accepted solution]

The SAML credentials wouldn't be valid to start a Workspace Server process, so you'd need to store host credentials in metadata for each user, or use token authentication so the Workspace Server runs using a shared account.
How to Configure SAS Token Authentication
https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/p06o3ymf2cuw16n1cmyi47t9icsn.htm

[pgielen]

Thank you for your reply , the sas token is not an option.

We tried that, but than all users are working in the same directory, they all need access to their own files and shares.

[pgielen]

sorry SAS is still very new to me.

Can you tell me how i can store host credentials in metadata for each user ?

Patrick

[AhmedAl_Attar]

Hi @pgielen 

I don't think storing users credentials in the Metadata would be a workable solution!

Just think about what would you do, if and when users change their Passwords? how would you keep your metadata in sync?

just my two cents

[gwootton]

Each user would need to store their host launch credentials (user ID and password) under the DefaultAuth authentication domain. Whenever their host credential password changed as @AhmedAl_Attar mentioned they would need to update this.
Your users could store a credential using the Enterprise Guide, SAS Management Console, or Personal Login Manager desktop applications, or through the SAS Environment Manager mid tier application (https://midtier.example.com:8343/SASEnvironmentMgrMidTier/).

Environment Manager - Update a Stored Password
https://go.documentation.sas.com/doc/en/bicdc/9.4/evadmfun/n1rx8gbcz1v4jcn1rhnnbxgdh495.htm#n01imi2e...

SAS Management Console - Update the Password in a Login
https://go.documentation.sas.com/doc/en/bicdc/9.4/mcsecug/n1kxhdu1ams2rzn180hnad7xwzm1.htm#n028hk1vq...

[pgielen]

Thank you all, for your help.

I will dive further into this, was really hoping we could get rid of Kerberos.