User is not able to login in SAS DI /SAS EG

[MG18]

HI All, 

Recently I have changed the password for unxsas user which is Installer user at OS level. After this I am not able to login to the SAS DI even after giving correct password. 

Has anyone faced this kind of problem in SAS DI /SAS EG ?

VERSION:- 9.3

O.S. :- AIX

Many thanks in advance .

[Criptic]

Hey @MG18 ,

Might be that the password is stored in a Metadatagroup/User and the Auth Domain of that group/user is used to authenticate all users. Take a look at your Workspace Server Definition inside of SAS Management Console.

Kind regards

Criptic

[kdebruhl]

I like @Criptic ideas.

But I also wonder if you're even making it far enough in the process that the Workspace server is being launched.  Have you checked the metadata log to see if the user is being properly authenticated?

We have our logs in a central location: <LevN>/Logs/SASMeta_MetadataServer_2019_xxxx.log

I'd check for valid or invalid client connections:

2019-05-07T09:35:00,139 INFO [20001221] 928359:<installer id> - Client connection 928359 for user <userid> closed.
2019-05-07T09:36:51,683 INFO [20001240] :<installer id> - Access denied.

Then at least you will know if your user id is being authenticated properly to the metadata server (i.e. log in to DI Studio).  If so, then @Criptic may be correct that the workspace server is not being launched with the correct credentials.

Just a thought... Hope it points you in the right direction.

[MG18]

@Criptic 

I am facing this issue all ALL external users but only sasadm@saspw user is able to login.

I have checked that All services are up and running through O.S. level and when i am trying to validate the workspace server through the SAS SMC . It is asking for user_id and password and it is failing with below error :- 

Error :- 

[5/22/19 2:22 PM] SEVERE: No host credentials exist to start server SASApp - Workspace Server (A5YFBUZL.AU000009). Either the client needs to send in host credentials, or credentials need to be specified for the server.
[5/22/19 2:22 PM] SEVERE: The application could not log on to the server "DAMLAPP1:8591". The user ID "sasadm@saspw" or the password is incorrect.
[5/22/19 2:22 PM] SEVERE: The user "SAS Administrator" could not log on to the server "SASApp - Logical Workspace Server".

Has anyone faced this issue ? 

[Criptic]

@MG18 

If you take a look at the Properties > Options of the SASApp Logical Workspace Server my guess is that the authentication Service is host. If so you Need to provide an OS user + Password - for testing the sas install user should work.

Moving Forward it depends on what your security recuirements are - the easiest way to do it is to create add to the SASUSER Group an account with AuthDomain WSAuth and harcode the os user + pwd in there and then Change the authentication of the Logical Workspace Server to SAS Token and then in the Workspace Server Change it so that the account with AuthDomain WSAuth is used - Problem is now all users are starting their processes under that ID. But for more indepth stuff you really should contact SAS directly and ask for some Consulting or read the SAS Security Administration Guide. I will try to help with further Questions but I'm no expert on this stuff.

[Kurt_Bremser]

sasadm is an internal user that only exists in SAS metadata (therefore the @saspw authentication domain). It does not have an account in the operating system.

But such an account is required for a workspace server, therefore you cannot use sasadm for this. Use a proper account that exists both as a system user and a user in metadata (with the proper connection between both) to validate your workspace server.

And you MUST NOT (never, ever) use sasadm for anything but administering the SAS installation. Because of its unlimited capabilities, this would be a very dangerous thing to do.