implementation of SSO for SAS Fat clients SAS EG, SAS DI Studio & SMC

[siddhu1]

Hi,
I Want to implement the SSO for the SAS fat clients like SAS Enterprise guide, sas di studio and SAS Management Console.
Generally used to open SAS tools from Citrix Windows 2019 server and the code executes on linux server.
Can anyone help us to implement the SSO using the IWA method for sas fat clients.

Kind Regards,

Siddhu

[JuanS_OCS]

Hi @siddhu1 ,

since your servers are on Linux, you are bound to set up Kerberos IWA system between the servers and your clients (and, preferably, between your SAS servers and your DBMS). 

IWA with Kerberos is described in the SAS documentation. If you have any more specific question, please feel free to raise those questions!

Best ,

Juan

[siddhu1]

Hi,
Do we need to setup any SPN's (service prinicpal name ) for linux servers (of each meta, compute servers) with the AD of Windows server  before setting up the kerberos configuration. Is it possible to provide any step on this.

Kind Regards,

Siddhu1

[JuanS_OCS]

Hi,

yes, you will need SPNs and a UPN, and to enable (contrained) Keberos delegation.

Again, it is all well documented by SAS: https://documentation.sas.com/doc/en/bicdc/9.4/bisecag/n1d1zo1jsf2o0en1ehu4c4simfky.htm

If what you need is an overview, you can find a nice one provided by @PaulHomes here: https://platformadmin.com/blogs/paul/2015/01/iwa-sas-94m2-linux/

It is based on an old maintenance (2), but I am sure that, by reading the documentation provided by SAS, you can make the adjustments required for your actual SAS environment.

Kind regards,

Juan

[siddhu1]

Hi,
Need some clarification while creating the SPN's as meta and three compute servers are on linux and SAS EG is installed on the windows server 2019 machine.
Do we need to use SAS or Host in the SPN statement as it is quite confusing which one to use.
Set -A SAS/<meta servernamr> servicename
Set -A SAS/<computesever1> servicename
Set -A SAS/<computeserver2> servicename
OR
Set -A host/<meta servernamr> servicename
Set -A host/<computesever1> servicename
Set -A host/<computeserver2> servicename
Can someone clarify on this.

Kind Regards,
Siddhu1

[gwootton]

The Metadata Server and Object Spawner use the service principal SAS/hostname by default, though this can be overridden using the "SAS_SERVICE_PRINCIPAL_NAME" environment variable, which would be required if the SPN and UPN do not match. That would be the case if you were assigning multiple SPNs to a single AD identity.

[siddhu1]

Hi Greg,
Thanks for your response.
I have created the SPN's for the one meta and three compute servers. 
Could you please let me know whether we need one keytab file for all servers or separately required for each server.

Kind Regards,
Siddhu1

[gwootton]

You could use a single keytab for all, the process will search for the SPN it wants within the keytab file.