SAS Application deployment error - The Configure user authentication step has not been performed.

[Amitkum2]

Hi ,

While deploying the application server, i was getting the error :

The Configure user authentication step has not been performed. The step must be completed before running sas servers.

The issue occurred when i am configuring object spawner.  I am deploying the SAS9.4M8 to RHEL8.5 . We are using pam authentication method.

Below is the SS of the issue

[sys-halt]

Hi,

Can you confirm that you have run/executed the setuid.sh script, <SASHome>/SASFoundation/9.4/utilities/bin/setuid.sh, as root first, before configuration step?

Did you edited the file /<SASHome>/SASFoundation/9.4/utilities/bin/sasauth.conf for PAM authentication?

The sasauth.conf file ships with the default value of methods=pw, for local host authentication only. I believe in your case it needs to be set to method=pam.

[Amitkum2]

Hello @sys-halt ,

Yes, I did ran the setuid script with root.  Also the method in sasauth file is pam only

[sys-halt]

Can you confirm that the SAS installer account, sassrv, and sasdemo are not OS local host accounts and are LDAP/AD accounts?

Check the volume where you are deploying SAS (ex: /sas ) if having the nosuid and/or no_root_squash attributes set.  These attributes should not be set on SAS partition.

Also what is the output of this command: <SASHome>/SASFoundation/9.4/utilities/bin/elsconf -v

[Amitkum2]

Hello @sys-halt ,

Thanks for the response !

Below is the output of the script:

The SA installer account, sassrvd and sasdemo are unix accounts. Currently only sas installer account is onboarded to the servers. Other 2 accounts are not present on servers.

Could you please help how to check the volume attributes?

[JuanS_OCS]

Hello there,

I see you are in good care by @sys-halt . In the meantime, I would wonder about the following points:

- what are the exact messages in the referred log. I think that would give a lot of additional information.

- I assume you tested the accounts log in to the host? If not, please do so! Also, please provide the login information exactly as you would prompt it, meaning it is not the same to log in as "user", "user@domain", "user@host", etc.

- Do you have enabled during the installation any antivirus, security software or storage backup running? When possible, I would disable them or create required exceptions (during the installation).

A side note, which for now I would only like to put on the back of your mind. No need to take this action at this point:

- I also believe to notice the installation is done over a mount on a NAS? As NFS? LUN? Depending on the laid out infrastructure and configuration, this might be a potential source of all sort of issues. Not necessarily, but could be. File locks being released later than expected, timeouts, micro-disconnections, performance ... resulting, for example in some installation processes ending later than expected, ending in pre-step validation failures.

[Amitkum2]

Hello @JuanS_OCS ,

Below is the log :

i am logging in with userid then password.

No antivirus or any type of security is enabled.

[JuanS_OCS]

Hello @Amitkum2 ,

thanks for providing the log. Not sure if those lines or this file is enough. When there is no more information anywhere else, I suggest to re-run the SDW with the paremeter loglevel=2, which runs SDW in debug/trace mode, to give more information.

This being said, there are more things that I wonder now:

- How did you configure PAMD. (eg  https://sas.service-now.com/csm?id=kb_article_view&sysparm_article=KB0036255 ?)

- How did you configure sasauth.conf ( eg change method to PW)

- Did you create /etc/pam.d/sasauth as a copy of /etc/pam.d/system-auth, retaining  only those lines beginning with "auth" or "account"?

[Amitkum2]

Hello @JuanS_OCS ,

Yes, I followed SAS note and created sasauth in pam.d folder

https://sas.service-now.com/csm?id=kb_article_view&sysparm_article=KB0036255 

I did not changed sasauth.conf manually, I just created sasauth as mentioned in above sasnote

- Did you create /etc/pam.d/sasauth as a copy of /etc/pam.d/system-auth, retaining  only those lines beginning with "auth" or "account"?

Yes

[Amitkum2]

Hi @JuanS_OCS ,

I did ran with debug option and here is the error msg :

[JuanS_OCS]

Hello @Amitkum2,

I am quite surprised by this kind of message as early in the installation process.

Are you running Installation & Configuration together, or are you running first Installation only? 

If you are running Installation only, not Configuration, you should share this with SAS Technical Support as soon as possible.

If you are running Installation & Configuration together, I would like to discourage you to do so. Many reasons behind, the most important being:

1. Not really recommended for GRID environments. Plus if you have shared storage for your nodes, you will want to determine better how to deploy local vs shared, per node.

2. It will allow you to check and download for all the latest SAS hotfixes (yes, depot ones are not enough) and security patches before you run the configuration.

3. It is a best deployment practice, for the reasons above mentioned and many more.

This is still not ensuring the solution, but I think we need to separate concerns.

[sys-halt]

Hi @Amitkum2 ,

I do agree with everything @JuanS_OCS said . and if this is indeed a GRID deployment I would advise you to get professional service from SAS PSD team in your region. As SAS GRID deployment is not as simple as SAS 9.4 Platform, it has specials prerequisites, especially storage network file system requirements.  

When I do deployments with PAM, the sas installer, sassrv and sasdemo are all already created at AD/LDAP level and can login at OS level and have home directories created. You can of course configure it to auto-create home directories for users on first login.

But I see you mentioned that sas installer account is created at OS level and not in AD/LDAP and that sassrv and sasdemo do not exist yet.

In order to understand if the issue is with PAM configuration or not, I would then do the deployment without PAM. so create sassrv and sasdemo accounts at OS level same as sas installer and do a deployment test, if it went successful then your challenge is with PAM configuration.

[Amitkum2 · Accepted solution]

Hello @sys-halt  @JuanS_OCS ,

Thanks for the assistance !!

I have requested the account to be onboarded. Once done, will retry.