User not able to connect to SAS Server using IWA

[vkrishna]

Hello all,

SAS programmer not able to connect to SAS windows server using Integrated Windows authentication from SAS EG. I found this error - "The buffers supplied to a function was too small" in SAS Integration technologies configuration connection test with Kerberos authentication. The user recently migrated to a new domain in Active Directory. I have verified the appropriate groups for access and user is able to connect to SQL server to from SQL server management studio. It's working for all other users except this user. I'm not sure how to proceed further. Can someone help me with this?

SAS 9.4 M5 - All-in-one server 

Windows Server 2012 R2

Spoiler

System.Runtime.InteropServices.COMException (0x80042002): <connectionAttempts>

                <connectionAttempt>

                                <description>The buffers supplied to a function was too small.

</description>

                                <status>0x80090321</status>

                                <saslogin></saslogin>

                                <sasmachinednsname>SAS.abc.def.com</sasmachinednsname>

                                <sasport>8591</sasport>

                                <sassecuritypackage>Kerberos</sassecuritypackage>

                                <sasclassid>440196D4-90F0-11D0-9F41-00A024BB830C</sasclassid>

                                <sasprogid>SAS.Workspace.1.0</sasprogid>

                                <threadid>9720</threadid>

                                <name>test</name>

                </connectionAttempt>

</connectionAttempts>

   at SASObjectManager.IObjectFactory2.CreateObjectByServer(String Name, Boolean synchronous, IServerDef pIServerDef, String LoginName, String Password)

   at SAS.BI.Itconfig.Library.ServerTests.SASServerTest.CreateConnectionWithObjectFactoryMulti()

   at SAS.BI.Itconfig.Library.ServerTests.SASServerTest.CreateConnection()

SAS Enterprise Guide errorSAS Integration Technologies

[alexal]

@vkrishna,

Have you had a chance to check metadata server logs?

[vkrishna]

@alexal, I haven't noticed anything unusual in SAS metadata logs. User connection not reaching the metadata server. You want me to enable the trace login?

[alexal]

@vkrishna,

Thanks for the confirmation. I'm wondering if that user has Windows Defender Credential Guard enabled on his machine or the server?

[vkrishna]

@alexal, we tried with different user machine and if it is related to SAS server it should not work for others too right? I think it might be related to the User profile. 

[alexal]

@vkrishna,

I'm wondering if that user has Windows Defender Credential Guard enabled on his machine?

[vkrishna]

Thank You @alexal.

We resolved this access issue. Users active directory profile member of more than 100 groups removing the unnecessary groups resolved the Kerberos authentication issue.