SWAT Connection with password prompt or integration with LDAP

[Mena11]

Hi everyone,

I would have some questions about how to connect to CAS via SWAT. I am a system administrator and for security reasons we do not like that users passwords are written in the code or put in some file on the client (although they are entered in a protected .authinfo).

Are there other ways to allow authentication to CAS, perhaps through a prompt or integration with LDAP?

Thanks

Davide

[alexal]

@Mena11 ,

You could encode your password in .authinfo file, please see the instructions here https://go.documentation.sas.com/?cdcId=pgmsascdc&cdcVersion=9.4_3.5&docsetId=authinfo&docsetTarget=.... If you still do not want to use .authinfo file, then you could provide username and password in your program, for example here is what you can use in Python SWAT:

import swat
conn = swat.CAS(host, port, username, password)

[SundareshS · Accepted solution]

I also use the getpass module so that users enter the password if they are working on a notebook interactively. Otherwise I use authinfo.

import getpass
.....
s = swat.CAS( ...., user, getpass.getpass())

[joeFurbee]

Adding to the comment from @SundareshS. While not a specific SWAT example, in section 1.2 of this SASGF 2020 paper from @anbout , Ten Minutes to Your First Hello World: REST APIs, outlines how to use getPass(). The accompanying Jupyter notebook is located in the supporting GitHub repository.

[anbout]

Hey @joeFurbee , thanks for the mention.  I have also used getpass() with SWAT just like I did in my SGF paper that you mentioned.  I would suggest that you might want too review how I have used it ... including the command to reset the pw variable to Null immediately after use.  If you just use getpass() to prompt without the additional steps, then the variables will remain actively assigned and could be printed or otherwise called.

Also, while I am on this topic, in order to secure the connections for SWAT, I ended up installing JupyterHub co-located with my Viya installation so that I could reference the security certs co-located on the Linux host without having to do any certificate distribution to workstations.