SAS connectivity to Teradata not working with SSO/IWA

[RupaJ]

Hello - Have been struggling with this issue for more than 2 weeks now. Need some direction here pls.  

 Here is the libname that throws error from SAS Enterprise guide. 

libname <libname> teradata server=abc schema=<schema name> ;

Here is the error it throws

ERROR: Teradata connection: MTDP: EM_GSSCALLFAIL(236): call to gss_call failed. .

ERROR: Error in the LIBNAME statement.

How do I enable more logging on SAS to debug the SSO /IWA issue? I tested the same from SAS commandline (./sas -nodms) and get the same error. 

[SASKiwi]

Have looked at the doc? https://documentation.sas.com/?docsetId=acreldb&docsetTarget=p1djetrmbn53w3n0z737je0qpqt5.htm&docset...

Are you using Kerberos and what user credentials are you using?

[RupaJ]

Hi @SASKiwi - We are using kerberos and yes I did take a look at the document. It says the kerberos tickets generated are either expired or does not exist. However the tcikets are getting generated with proper validity. Our system admin checked it. 

@SimonDawson - Thanks for pointing at that. I shall get bteq installed on SAS server and test it outside of SAS and check what happens. 

Thanks both of you for pointers. Hopefully I can get this fixed today. 

[SimonDawson]

This is unlikely to be an issue with SAS if the GSS calls inside Teradata fail for both SAS Foundation on the server and from SAS Enterprise Guide.

I'd have your Teradata DBA deploy the client software to the SAS box so that BTEQ is available.

Logon as a user to the host, run BTEQ and use the .LOGON directive but hit enter for both the username and password without typing anything. ie. Leaving them empty, if the prompt returns and you are logged in then you know your DBA has configured it correctly on the Teradata side. If you get the same EM_GSSCALLFAIL message then this is something for your Teradata folks to look up at not your SAS folks.

[RupaJ]

@SimonDawson

I tried connecting from bteq to Teradata and here is what I get. 

*** CLI error: MTDP: EM_GSSCALLFAIL(236): call to gss_call failed. Failure Server not found in Kerberos database
*** Return code from CLI is: 236
*** Error: Logon failed!

*** Total elapsed time was 1 second.

My linux administrator is not sure how to fix the error "Failure Server not found in Kerberos database". Any direction here pls?

Thanks!

[SimonDawson]

I'd engage Teradata technical support. This same error occurs with no involvement of any SAS software. Teradata software is the only thing in the mix now.

[RupaJ · Accepted solution]

Thanks @SimonDawson. It was an issue of not adding the main DSN to the Teradata keytab file. Once that was modified, the issue resolved. Thanks for your inputs on trying to login with bteq. That was very helpful in determining the root cause. 

[SimonDawson]

Glad to hear your Teradata system administrators were able to get to the bottom of it.