sasadm@saspw password recovery

[japsas100]

Hi ,

Can we decrypt the sasadm@saspw encoded password with any tool? I know SAS support has tool to decrypt the password with some proprietary algorithm tool. However due to security issue we can't send encoded password to sas for decrypt .

We also don't want to reset the password. 

Any advise please.

[gwootton]

Why do you want to decrypt it?

If the password has been lost/forgotten, you should reset it rather than trying to recover it.

[japsas100]

@gwootton 

If we want reset then it time consuming process it include testing in lower env before making any changes in prod.

We need the decrypt password to launch the sas amangement console and deployment manager to reset the sas internal account passowrd.

[gwootton]

You can set another user (like your own account) as unrestricted in Metadata by adding them to the adminUsers.txt file in the Metadata Server directory:

Unlock an Internal Account
https://go.documentation.sas.com/?cdcId=bicdc&cdcVersion=9.4&docsetId=bisecag&docsetTarget=p135ufuc5...

I believe SAS Deployment Manager will accept the encoded password for the sasadm@saspw account.

[japsas100]

@gwootton 

Can we add any other unrestricted ID without recycle the services?

[gwootton]

The Metadata Server reads the adminUsers.txt file when it starts, so the Metadata Server would need to be restarted for the addition to take effect.

[japsas100]

Thanks @gwootton 

ok, as per the documentation, its mentioned to stop/start all the services. 

"If you do not know the password for the sasadm@saspw account, you will first need to reset it. Follow these steps:

1. Stop all SAS services"

If we add the another user in adminUsers.txt file, Do we need to restart only metadata services? If yes can we reset the sasadm@saspw password  without stop/start all the services including metadata?

[gwootton]

Restarting the Metadata Server while other processes that depend on it are running can cause issues.

[japsas100]

@gwootton 

If no jobs are running at a time, can we reset the sasadm@saspw password by logging with another user in smc with only stop/start metadata services?

[gwootton]

User jobs are not the only processes that depend on the Metadata Server. The compute tier services like the Object Spawner and middle tier services like the web application servers establish connections to Metadata as well.

[SASKiwi]

How about arranging a secure WebEx session with SAS Tech Support. If you allow remote access to your session they can copy and paste the encoded password into their own session for decrypting. This sounds like a pretty secure solution to me.

If you could decrypt it with any tool then it isn't going to be secure at all.

[japsas100]

@SASKiwi 

I was thinking about ftp and webex option. However management not allowing to sharing password with these option.

Is there any way to launch smc/dm with encoded passowrd?

[SASKiwi]

@japsas100  - I always invoke SMC using IWA so no password is required.

[japsas100]

@SASKiwi 

How we can setup to access the smc using IWA ?

[SASKiwi]

@japsas100  - Tick the IWA box in the connection profile: