Answer
First of all, let’s talk about how authentication works in SAS. SAS has a few authentication methods:
- Internal authentication mechanisms. The internal mechanisms are SAS internal authentication and SAS token authentication.
- External authentication mechanisms. External mechanisms include direct LDAP authentication, host authentication (credential-based), Integrated Windows authentication, and web authentication.
- Credential management provides single sign-on through reuse of cached credentials or retrieval of stored passwords.
- Pluggable authentication modules (PAM) extend UNIX host authentication.
All of these authentication methods are described in SAS® 9.4 Intelligence Platform: Security Administration Guide, Third Edition -> Introduction to Auth.... We are going to focus only on Pluggable authentication modules (PAM), which extends UNIX host authentication.
By default, if you didn’t select PAM authentication during initial deployment, SAS will use host authentication, which means sasauth module will make authentication calls to the OS.
A Kerberos authentication in SAS can be utilized either through PAM and/or IWA/GSSAPI. In our case, we will be configuring only PAM.
1. I assume that you have already configured Kerberos authentication on your system, either through SSSD or something else. So the first step would be enabling PAM authentication in SAS. The process of enabling PAM in SAS is described in a SAS note below:
SAS Installation Note 49432: Configuring PAM on Linux to authenticate through SAS® against Active Di...
2. Next, make sure that this line is uncommented in /SASHome/SASFoundation/9.4/utilities/bin/sasauth.conf:
PAM_SETCREDENTIALS=TRUE
Without this setting, sasauth module won’t call pam_setcred, which is responsible for a Kerberos ticket creation.
3. Restart the object spawner
/SASConfig/Lev/ObjectSpawner/ObjectSpawner.sh restart
4. After that everytime the user authenticates is SAS, a Kerberos ticket should be created on the system. Please note that you have to use file-based tickets in your Kerberos configuration. SAS doesn’t support tickets from a keyring.
5. The last step will be the workspace server configuration, you have to let the workspace server know which ticket it has to use. You can do that through a custom script added to the WorkspaceServer_usermods.sh.
If you are using Linux:
workspace_user=$(whoami)
workspace_user_ccaches=$(find /tmp -maxdepth 1 -user ${workspace_user} -type f -name "krb5cc_*" -printf '%T@ %p\n' | sort -k 1nr | sed 's/^[^ ]* //' | head -n 1)
if test ! -z "$workspace_user_ccaches"; then
echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."
echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"
export KRB5CCNAME=$workspace_user_ccaches
echo "KRB5CCNAME has been set to ${KRB5CCNAME}."
else
echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."
fi
Please note if you are using Centrify, file name pattern for a Kerberos ticket might not start with krb5cc. In some cases, and of course depends on your configuration a file name might start with tkt. If that applies to you, you have to adjust -name option in the script above.
If you are using AIX:
workspace_user=$(whoami)
workspace_user_ccaches=$(find /var/krb5/security/creds/* ! -name . -prune -type f -name "krb*" -user $(whoami) | sort -k 1nr | head -1)
if [ ! -z "${workspace_user_ccaches}" ]
then echo "Most recent krb5 ccache found for '${workspace_user}' at '${workspace_user_ccaches}'."
case "${OS}" in
AIX) istat ${workspace_user_ccaches} | grep '^Last modified'
;;
*) echo "Cache last modified: $(stat -c%y ${workspace_user_ccaches})"
;;
esac
export KRB5CCNAME=${workspace_user_ccaches}
echo "KRB5CCNAME has been set to ${KRB5CCNAME}."
else echo "No krb5 credentials caches were found in /tmp for '${workspace_user}'."
fi
6. Relogin to SAS Studio or SAS Enterprise Guide and make sure that environment variable with name KRB5CCNAME has been set:
%put KRB5CCNAME: %sysget(KRB5CCNAME);
As I said above, you can also utilize Kerberos authentication through IWA/GSSAPI, but that will be a subject for another post.
