Increased Security Using Git Starting in SAS® Studio Stable 2024.06

[#1]

Beginning in stable 2024.06, a SAS Administrator can define a domain to be associated with a security credential in SAS® Environment Manager when using HTTPS authentication or SSH authentication with password-protected SSH keys. This allows you to manage your credentials outside of your regular SAS Studio preferences, and manage multiple sets of credentials for different connections.

Once the domain is defined, the end user can define their credentials for the domain in SAS Environment Manager. The end user can then point to that domain when they define their local repository instead of specifying their password or personal access token (PAT). Note that your information is not exposed in SAS Studio when defining your PAT or password. 

Note: The steps below assume that a remote Git repository has already been defined and that you have basic familiarity with Git technology and your hosting service.

Using HTTPS Authentication with Git

SAS Administrator steps

The SAS Administrator should complete the following steps:

1. From SAS Environment Manager, click Domains. Then, click the New icon.

2. In the New Domain form, enter any value for the ID that is not already in use. Keep the type as Authentication (password) and specify the Identities’ user name.

3. Once the SAS Administrator enters a valid value for the Identities, the User ID, Password, and Confirm Password fields are displayed. The SAS administrator can enter a bogus/fake personal access token as a placeholder. The end user will override this for themselves later.

Note: The end user can change the password to their actual personal access token when they enter their credentials.

4. Navigate to Configuration ► All services ► select SAS Studio.
5. For sas.studio, click Edit (the Pencil icon).
6. Enable allowGit and allowGitPassword (if they are not enabled already).

7. Click Save
8. Sign out of SAS Environment Manager.

End User steps

The end user should complete the following steps:

1. From SAS Environment Manager ► click My Credentials ► select the domain that was created ►click Edit (the Pencil icon). In the example below, the domain is git_domain. 

2. Enter the user ID and password associated with the remote Git repository.

3. Click Save.
4. Sign out of SAS Environment Manager.
5. Sign on to SAS Studio.
6. Navigate to Options ►Manage Git Connections ► click Profiles ► click the + icon.

      The Add a Profile window is displayed. 

7. Click the HTTPS tab at the top of the profile window. If the SSH and HTTPS tabs are not displayed, see step six under the SAS Administrator section above.
8. Enter a profile name, your name, and email address.
9. For the Credentials method: field, select the Use authentication (password) domain option from the drop-down list.

10. Select the domain for SAS Studio to use when cloning the repository. This domain should have the same name that you used above.

Note: Beginning in Stable 2024.08, the Domain name field was renamed to Domain ID.

11. Click Git Repositories ► Repositories ► click the + icon ► select the Clone a repository option from the drop-down list.

11. Enter a remote repository HTTPS address, an empty folder on the file system, and the git_domain profile that you created earlier.
12. Click Clone. 

13. Click Close from Manage Git Connections.
14. Click the Git icon to view the new repository that you defined in the list of repositories.

SSH Authentication When SSH Keys are Passphrase-Protected

SAS recommends that you use ED25519 SSH keys if they are supported by your remote repository. You can generate the SSH keys by using the PuTTYgen key generator or Git Bash with the following command:

ssh-keygen -t ed25519 -C "your_email@example.com"

 

SAS Administrator steps

The SAS Administrator should complete the following steps:

1. From SAS Environment Manager, select Domains ► the New icon.

1. In the New Domain form, enter any value for the ID that is not already in use. Keep the type as Authentication (password) and specify the Identities’ user name.

2. Once the SAS Administrator enters a valid value for the Identities, the User ID, Password, and Confirm Password fields are displayed. The SAS administrator can enter a temporary password since the end user can change the temporary password to the real password when they enter their credentials.

3. Navigate to SAS Environment Manager ► Configuration ► All services.
4. Search for SAS Studio.

5. Within the SAS Studio service ► sas.studio, click Edit (the Pencil icon).
6. Enable allowGitSSHPassword.
7. Click Save.
8. Sign out of SAS Studio.

End User steps

The end user should complete the following steps:

1. From SAS Environment Manager, ► select My Credentials ► the domain that was created ►click Edit (the Pencil icon). In this example, the domain is ssh_domain.
2. Enter the passphrase associated with the remote repository.

3. Open SAS Studio. Then, navigate to Options ►Manage Git Connections ► select Profiles ► click the + icon.

The Add a Profile window is displayed.

4. Click SSH at the top of the profile window. 
5. Enter a profile name, your name and email address, and a location to the public and private SSH Keys.
6. Select the Use a password-protected SSH key check box.
7. For the Credential method field, select the Use authentication (password domain) option.

8. Select the domain for SAS Studio to use when cloning the repository. 

Note: Beginning in 2024.08, the Domain name field was renamed to Domain ID.

9. Clone the Git repository from Manage Git Connections ► Clone a repository.

10. Click Clone.

After a short refresh, the repository should be displayed.

11. Click Close from the Manage Git Connections window.

By completing these steps, you can define a secure HTTPS or SSH Profile to work with your repositories without exposing your PAT or passphrase in SAS Studio.