SAS Enterprise Miner environment file

[Shakir_Juolay]

We have SAS Enterprise Miner servers installed on Test and Production servers. I can access the Test server, however I cannot access the Production server even after changing the sassw.config file to point to the sas-environment.xml for Production. I get the error message of 

"The application was unable to load the SAS environment definitions. The file location or file contents might be invalid. Please contact your administrator for assistance."

I dont have issues with Test environment, also I can access the Production environment on other machine where all ports are open by default.

Could anyone help me in knowing which ports need to be opened for Production on my machine. I can access the Production sas-environment.xml in Google Chrome.

[Shakir_Juolay]

Also one more difference the Test environment file is on http while Production is on https. When I open the Production file in Chrome it says the URL is not secure.

[nhvdwalt]

The client probably needs a certificate for the SSL to work. 

[Shakir_Juolay]

How to get one and use it with the client?

[JuanS_OCS]

Hello @Shakir_Juolay,

https/certificate might be one of your issues, but it is definetely not the one related to this message.

When you use SAS Enterprise Miner, you can do it in 2 ways:

1- Using the client installed in your machine. this client will look into the sassw.config file, locally in your SASHOME folder. This filw can reference a local sas-environment.xml or a sas-environment.xml file located directly on your web server (an URL). This client will be able to connect to all the environments as defined on the sas-environment.xml where your sassw.config is pointing to. When you log in, you have available a drop-down list with all the available environments.

2- Connecting directly to the web application server:  it will download a copy of the EM client. This client will be able to connect only to the environment where you downloaded the client from. When you log in, you cannot select any environment, it will conect only to the default, that environment.

Therefore, please first ensure the client you use, then ensure that sassw.config and sas-environment.xml has the environments you need. Please ensure as well, if you have an URL, that you can type the URL in your explorer and it will display the contents of the sas-environments.xml with no problems and a green tick (to ensure you have no problems with certificates)

On both cases, your SASPrivateJRE certificate store would need to have the certificate chains from every environment.

[Shakir_Juolay]

Dear @JuanS_OCS,

Thank you for the detailed explanation.

1. I am currently using the client installed on my machine. During installation I had given a http URL for the Test web server's sas-environment.xml file. I can use the client for the Test Server. After IT finished the installation of the Prod Server I modified the sassw.config file to point to the https Prod web server's sas-environment.xml. This is the only change I made, and I get the error mentioned earlier. Do I have to do any additional steps for SASPrivateJRE certificate store to have the certificate chains from Prod environment in my installation? Is there any link to order number?

2. I do not know how to connect directly to the web server, can you point me to some material to do so?

Thanks in advance.

Regards,

@Shakir_Juolay

[JuanS_OCS]

Dear @Shakir_Juolay,

you are welcome. Forget for now about the SASPrivateJRE, and let's focus on the connection to your sas-environment.xml file.

1. I can imagine that during the installation of Test and Production servers, you provided different location (URL)  of your sas-environment.xml, or maybe even it is not there. You should make it available the same than for the Test server. So, please do those checks:
   
   1. Verify the location of sas-environment.xml file on Test and Production, and both with the right information
   2. Verify the location of sassw.config file on Test and Production, ponting both to their own sas-environment.xml file
   3. Please send us the sassw.config file of your Miner client.
2. The access to SAS Enterprise Miner web app is through an URL looking like this: http (or https)://myserver.mynet.mycompany.com:port/ SASEnterpriseMinerJSW/Status You can find the detailed information on your SAS Management Console or documentation of your SAS environment.

Kind regards,

Juan

[AnandVyas]

Hi @Shakir_Juolay

Can you try to copy the URL you have changed in your sassw.config and try to open it in browser and see if the XML file is displayed?

In order to be sure that the link is correct and also as you have mentioned in the query that you are able to access the prod environment on other machine, could you try using the same exact link on the machine where you are able to access prod env and let know of the results?

Thanks,
AV

[Shakir_Juolay · Accepted solution]

Thank You all for your replies.

@nhvdwalt Yes the client's Private Java certificate store needed the certificate chain for the Web Server.

@AnandVyas I can access the environment xml file in browser but with red icon.

@JuanS_OCS The ../SASEnterpriseMinerJSW/Status link is not working. I am assuming the sever should be the Web Server. Am I right? Or should it be another server like metadata or compute server?

This is how I solved my issue.

1. Accessed the environment file using Mozilla Firefox
2. Click Advanced and add exception for the security certificate.
3. Click Get Certificate and Confirm Security exception. (This will save web server's security certificate in Mozilla Firefox certificate store)
4. Go to Options > Advanced > Certificates > View Certificates > Servers. Click on the entry for web sever and Export the certificate as a <sever name>.der
5. From the Windows command prompt run the below commands (changing the folder paths as per your machine)
   1. "C:\Program Files\Java\jre7\bin\keytool.exe" -import -alias <sever name> -keystore "C:\Program Files\SASHome\SASPrivateJavaRuntimeEnvironment\9.4\jre\lib\security\cacerts" -file "<file path>\<sever name>.der" -storepass changeit
   2.  "C:\Program Files\Java\jre7\bin\keytool.exe" -import -alias  <sever name> -keystore "C:\Program Files\Java\jdk1.8.0_60\jre\lib\security\cacerts" -file "<file path>\<sever name>.der" -storepass changeit
   3. "C:\Program Files\Java\jre7\bin\keytool.exe" -import -alias  <sever name> -keystore "C:\Program Files\Java\jre7\lib\security\cacerts" -file "<file path>\<sever name>.der" -storepass changeit
   4. "C:\Program Files\Java\jre7\bin\keytool.exe" -import -alias <sever name> -keystore "C:\Program Files\SASHome\SASPrivateJavaRuntimeEnvironment\9.4\jre\lib\security\jssecacerts" -file "<file path>\<sever name>.der" -storepass changeit

Though I ran all four I think only the fourth one should suffice.

Basically your Web Servers security certificate should be imported in your Private JRE's certificate store located in jsscacerts file.

Thanks to the below two links and SAS Support Team.

http://www.grim.se/guide/jre-cert

http://support.sas.com/rnd/javadoc/93/Components/com/sas/net/ssl/doc-files/ssl_import_server_certifi...