BookmarkSubscribeRSS Feed
🔒 This topic is solved and locked. Need further help from the community? Please sign in and ask a new question.
dgower
Obsidian | Level 7

Hi All,

 

We have a LSF gridsetup with SAS 9.4 and Studio all on Windows servers.  This is a new install and users are getting the error "User <domain>\<userid> has insufficient permissions to create C:/Users/<userid>/.images...".  The strange thing is that it was working previously, so something has changed, but I cannot determine what.  If I make the user a local admin, the error goes away; however, when I check the effective permissions on the c:\users location on all the grid nodes, they have Modify permissions.  Users that already have a user profile folder under c:\users do not get the error.  I've already asked our server admins if anything has changed, but I get the standard "no".  Anyone have any suggestions on what to look at?

 

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions
dgower
Obsidian | Level 7

I found the setting that was causing this problem.  In Management Console under Logical Stored Process Server properties on the load balancing tab, we had GRID set for the balancing algorithm.  I corrected this by changing it to cost, and the problem went away.  User profiles were then created on the GRID compute nodes upon users logging into Studio.

View solution in original post

5 REPLIES 5
SASKiwi
PROC Star

When does this error occur? Try logging onto the SAS application server and creating a file manually in the folder that is giving the permissions error. Do you strike the same problem?

dgower
Obsidian | Level 7

Sorry, I forget that part.  They get the error when trying to submit any code.  I had the users RDP into the servers, navigate to their home folders, and they were able to create files.  Once they remote into the servers, their profile and home folder are created, and then the error stops.  Obviously SAS users should not have to remote into all 7 of our grid compute nodes to create their profiles before being able to use SAS.  We also have SAS 9.2 and 9.3 running via Display Manager from Citrix; the error does not happen when using the old versions, it's unique to SAS Studio 3.5 and SAS 9.4.

 

Due to a similar error that was preventing users from even logging into Studio, I changed the following in the local sasv9.cfg files:

 

-SET MYSASFILES "?FOLDERID_Documents\My SAS Files\9.4"
-SASUSER "?FOLDERID_Documents\My SAS Files\9.4"
-WORK "!TEMP\SAS Temporary Files"

 

to all point to a shared storage array that SAS uses.  So it's strange to me that it's trying to write anything the c:\users\<userid> on the SAS servers to begin with.

 

 

SASKiwi
PROC Star

What is your security set-up for SAS Studio? It looks your SAS servers run on Windows. Are you using single signon (SSL) by any chance? I'm not an expert in this area but we have run into problems with SSL and ensuring permissions are delegated correctly across all SAS servers. The key here seems to be getting your Kerberos settings correct if that is involved.

dgower
Obsidian | Level 7

Yes, we have all Windows servers.  SAS has confirmed that SAS Studio needs to be able to write to c:\users\<userid>\.images and there's no option to change that location.  As for the security setup, I'm not sure exactly how to answer that, but we don't utilize single sign on.  Our users login with their domain credentials in the form of <domain>\<userid>.  The logical workspace server settings are "Use Server Access Security" is checked, "Authentication service" is set to Host, and  "Security package" is set to kerberos.  These are the same settings we used for SAS 9.2 and 9.3, but those versions ran from Citrix servers where users' profiles were created upon running any application from Citrix if they weren't already present.  I've confirmed that the sassrv account, which is used to run the SAS services, has trusted for delegation set.  Thanks for any advice or suggestions that you can think of to try.

dgower
Obsidian | Level 7

I found the setting that was causing this problem.  In Management Console under Logical Stored Process Server properties on the load balancing tab, we had GRID set for the balancing algorithm.  I corrected this by changing it to cost, and the problem went away.  User profiles were then created on the GRID compute nodes upon users logging into Studio.

suga badge.PNGThe SAS Users Group for Administrators (SUGA) is open to all SAS administrators and architects who install, update, manage or maintain a SAS deployment. 

Join SUGA 

CLI in SAS Viya

Learn how to install the SAS Viya CLI and a few commands you may find useful in this video by SAS’ Darrell Barton.

Find more tutorials on the SAS Users YouTube channel.

Discussion stats
  • 5 replies
  • 2439 views
  • 2 likes
  • 2 in conversation