Architecting, installing and maintaining your SAS environment

Single Sign-On configuration for SAS Visual Analytics

Accepted Solution Solved
Reply
Contributor
Posts: 20
Accepted Solution

Single Sign-On configuration for SAS Visual Analytics

Hello,

 

I start configuring a Visual Analytics mono server platform in Single Sign-On mode only for HTTPS access.

 

Do you know, in the numerous publications on the SSO topic, what is the reference documentation to follow in the case of a Visual Analytis configuration on Windows server ?

 

Best regards,

Gaetan


Accepted Solutions
Solution
‎02-09-2017 11:20 AM
Contributor
Posts: 20

Re: Single Sign-On configuration for SAS Visual Analytics

Hi Paul,

more precisions are necessary :

- OS : Windows Server 2012

- SAS Version : SAS9.4M3

- SSO Mechanism : IWA

 

Now, I succeeded today an operational single sign-on configuration.

Concerning the documentation, here is my feedback:

 

Step 1 : Configure configuration in Active Directory and produce keyab file :

 

Step 2 : SAS Web App Server configuration

 

Step 3 : SAS Metadata Configuration

 

(optional) : Fallback processing (In my organization, Firefoox can't use IWA, so I need to redirect Firefox's users to a prompt credentials screen)

 

Obviously, all these steps are perfectly described in your post Paul :

A recommended step in your post, which I have not yet had time to realize, is to redeploy the Web applications to keep the modifications to the passage of the next maintenance (M4 in my case)

 

In conclusion, my configuration was made quite simply. My main recommendation is to validate the compliance of the Kerberos keytab file with the "kinit" executable before proceeding SAS configuration.

 

Gaétan

View solution in original post


All Replies
SAS Super FREQ
Posts: 291

Re: Single Sign-On configuration for SAS Visual Analytics

Contributor
Posts: 20

Re: Single Sign-On configuration for SAS Visual Analytics

Hi Anja,

 

The topic in this link is SSL, but I configured yet SSL.

 

For SSO, list of documents :

 

http://support.sas.com/documentation/cdl/en/bimtag/69826/HTML/default/viewer.htm#n1bhp608f0hsoen10i1...

http://support.sas.com/resources/papers/proceedings16/SAS3443-2016.pdf

http://support.sas.com/resources/papers/proceedings16/SAS3720-2016.pdf

 

I think the document, coming from the last link, is best suited to my configuration.

Was anyone able to apply this procedure ?

 

Gaétan

PROC Star
Posts: 392

Re: Single Sign-On configuration for SAS Visual Analytics

It would help people to give more targeted links to resources if you gave a bit more information about your environment. Which version of SAS Visual Analytics are you using? On which server platform (Windows, Linux etc).Which SSO mechanism are you trying to integrate with (IWA, WebSeal, SiteMinder etc).

 

There are a lot of options and flexibility in how SSO can be done, so it can be complex to setup and troubleshoot. Providing more info about your environment will help.

 

Your last comment seems to suggest it might be Integrated Windows Authentication (IWA). If so, then the Support for Integrated Windows Authentication page in the SAS 9.4 Intelligence Platform: Middle-Tier Administration Guide book is a good starting point. I have also found the following paper very useful: SAS Global Forum Paper SAS102-2014: An Advanced Fallback Authentication Framework for SAS® 9.4 and S... by Zhiyong Li & Mike Roda.

 

I have also written a few blog posts related to IWA based SSO (including SAS Visual Analytics Guest Access with IWA Fallback) that might be of some use. They are all tagged IWA and listed at https://platformadmin.com/blogs/paul/tag/iwa/

 

Solution
‎02-09-2017 11:20 AM
Contributor
Posts: 20

Re: Single Sign-On configuration for SAS Visual Analytics

Hi Paul,

more precisions are necessary :

- OS : Windows Server 2012

- SAS Version : SAS9.4M3

- SSO Mechanism : IWA

 

Now, I succeeded today an operational single sign-on configuration.

Concerning the documentation, here is my feedback:

 

Step 1 : Configure configuration in Active Directory and produce keyab file :

 

Step 2 : SAS Web App Server configuration

 

Step 3 : SAS Metadata Configuration

 

(optional) : Fallback processing (In my organization, Firefoox can't use IWA, so I need to redirect Firefox's users to a prompt credentials screen)

 

Obviously, all these steps are perfectly described in your post Paul :

A recommended step in your post, which I have not yet had time to realize, is to redeploy the Web applications to keep the modifications to the passage of the next maintenance (M4 in my case)

 

In conclusion, my configuration was made quite simply. My main recommendation is to validate the compliance of the Kerberos keytab file with the "kinit" executable before proceeding SAS configuration.

 

Gaétan

PROC Star
Posts: 392

Re: Single Sign-On configuration for SAS Visual Analytics

Hi Gaétan,

 

Great to hear you have it all working now.

 

That's good advice about kinit. When working on complex configurations I think it's always a good idea to confirm that all the lower level pre-requisites are working before moving onto configuring/troubleshooting the higher level components.

 

Cheers

Paul

Trusted Advisor
Posts: 1,141

Re: Single Sign-On configuration for SAS Visual Analytics

Nice summary @Gaetan !

☑ This topic is solved.

Need further help from the community? Please ask a new question.

Discussion stats
  • 6 replies
  • 879 views
  • 10 likes
  • 4 in conversation