SAS EG - What username is EG trying to use when accessing local files?

[stuart_snap]

Hi,

We are 99% complete with a new server SAS and EG install and server move, but have one last error. Everything on the new server side is working fine.  We can access all files, schedule processes, assign libraries, etc.  Working nicely.

However, when my users assign the new metadata server on their computers they get this error when trying to assign libraries that are local and not on the server...

libname comp '\\fileserver\users\Stuart Spencer\Comp Plan\';

ERROR: User does not have appropriate authorization level for library COMP.

ERROR: Error in the LIBNAME statement.

I know the path is correct, because the exact same code works when I run it on the server... I only get the error when we run things on our local comps through EG.  What USER is it trying to use in this case?  As far I can tell, all the users have the correct permissions, so i am trying to find the missing link.

Thanks!

SS

[ChrisBrooks]

This may sound like a silly question but if the library location is local why does the path include the word fileserver?

[ChrisHemedinger · Accepted solution]

I'm guessing that the Windows machine where SAS is running is not marked as Trusted for Delegation.  That's necessary when you are accessing a network resource via a SAS connection that's spawned from a client app like EG.  Trusted for Delegation gives Windows permission to use those user credentials for the addition network hop.  More on this in the SAS Admin guide.  Updating the machine for this requires a small action by a domain admin.

[SASKiwi]

The permissions used by EG are those of the user name entered in the EG connection profile. Are you explicitly putting a user name in the profile or are you using IWA. If you are using IWA then sorting out the permissions delegation as mentioned by @ChrisHemedinger is a lot more complicated to set and may involve Kerberos configuration.

[stuart_snap]

We are indeed using IWA. I have our old server still up and I thought I had permissions set the same, but I will look again. I'll check the trusted delegation settings as well, per @ChrisHemedinger

Thanks!

[stuart_snap]

We added the Trusted for Delegation settings and it now works if we use our usernames directly to connect to the server through the EG sessions. We still get an error if we try to use IWA... but we are fine just not using IWA.

Thanks!

SS