sas-airflow-provider OAuth

[misul]

Hello,

I am experimenting with sas-airflow-provider (https://github.com/sassoftware/sas-airflow-provider). I am trying to use the SASJobExecutionOperator to launch SAS Job Definition objects from Airflow. Note: I am using SAS Viya 3.5, not 4.0!

Everything worked in the development environment, where we have fewer restrictions, but I am missing something in production.

Everything is as straightforward as in the documentation:

1. Task to execute SAS code using a SAS Job:

sas_job_1_task = SASJobExecutionOperator(
task_id='airflow-sas-job-example-1',
job_name='/Public/Airflow/airflow-sas-job',
connection_name='sas_default',
job_exec_log=True,
add_airflow_vars=True,
parameters={
**job_parameters,
"code_name": "airflow-sas-code.sas"
},
dag=dag,
)

2. sas_default connection:

3. Airflow log file:

{base.py:84} INFO - Retrieving connection 'sas_default'
{sas.py:55} INFO - Using custom TLS CA certificate bundle file
{sas.py:63} INFO - Creating session for connection named sas_default to host https://mycompany.com/
{sas.py:83} INFO - Get oauth token (see README if this crashes)
{taskinstance.py:3311} ERROR - Task failed with exception
<...>
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))

4. No sessions were created on the SAS Viya side.

My guess is that something is missing related to OAuth. For the connection, I provide only the SAS Viya user and password, as well as a certificate, but no OAuth token.

Among the parameters sent to SAS Viya, I believe there are default values related to authorization, as shown below:

Basic {base64(client_id:client_secret)}

• client_id defaults to "sas.cli"
• client_secret defaults to an empty string

But this shouldn't be a problem, right? I'm not sure how to proceed or resolve this issue, not much expertise in this area.

Mindaugas

[gwootton · Accepted solution]

SASLogon returns an oauth token when you log in. The client ID and secret (sas.cli:) is valid, this is the client used by the sas-admin CLI.
The failure here seems to be saying that when airflow is trying to connect to the environment https://mycompany.com/SASLogon to get a token, the network connection is being reset on the other side. I would suspect this has something to do with firewall limitations in place on your production environment preventing a connection from the host where the task is running.

[misul]

You were right; this was a WAF-related issue. We had an IP filter for access, and after adding the IP to the whitelist, everything works fine!