SAS Enterprise Guide: Welcome to SAS Viya 3.5?
Updated March 2023. Please note. This article is only appropriate for usage with Viya 3.5. This article is not appropriate for use with Viya 2020.x and upwards. For connectivity between Enterprise Guide and Viya 2020.x please consult the documentation for the use of SAS/CONNECT and connecting to a CAS Server. If you wish to understand the use of SAS/CONNECT in relation to releases of Viya 2022.x (May 2022 and onwards) then take a look at this blog.
In late 2019 you may have heard of plans to support SAS Enterprise Guide integration with SAS Viya 3.5. Now you may be looking for it, but cannot find it in your Viya 3.5 environment.
Whether you perform a programming only or a full Viya 3.5 deployment, it seems it's not there. Also, after a quick look at the official documentation, what's new pages, or product reference, not much shows up. So, what's going on?
SAS' vision is aligned with our customer requests and with the market direction, towards web interfaces such as SAS Studio and away from full desktop clients such as SAS Enterprise Guide. Yet, you may remember that SAS Enterprise Guide has been able to leverage Viya 3.5 functionality for a while, at least since SAS 9.4M5 - but, as always, the devil is in the details. Up to version 8.1, SAS Enterprise Guide can connect to a CAS server running in a Viya 3.5 environment; to do that, it requires an initial connection to a SAS 9 server - either part of a SAS 9 environment that includes, at least, a metadata server, an object spawner and a workspace server, or locally co-located on the client.
SAS Enterprise Guide -> SAS 9 Metadata Server -> SAS 9 Object Spawner -> SAS 9 Workspace -> CAS
Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.
SAS Enterprise Guide -> local SAS 9 -> CAS
Starting with SAS Enterprise Guide 8.2, it is now possible to avoid any intermediate SAS 9 components and directly connect from the client to a Viya 3.5 workspace server. You can work on most of your existing projects, process flows, programs, including the capability to submit code that gets executed in CAS.
SAS Enterprise Guide 8.2 -> SAS Viya 3.5 Object Spawner -> SAS Viya 3.5 Workspace -> (CAS)
What are the benefits, with respect to the previous release? In a short sentence, you get the capability to leverage the power of SAS Enterprise Guide, without the requirement to install (and maintain) a full SAS 9 environment.
Yet, this new capability does not promote SAS Enterprise Guide to a full-class SAS Viya 3.5 product. In fact, this configuration is similar to a "programming only" environment, such as SAS Studio 5.2 (basic), with no other interaction with microservices nor other Viya 3.5 services. This similarity with SAS Studio is not incidental.
Availability to Customers
As we already stated at the beginning, SAS is moving towards web interfaces such as SAS Studio and away from full desktop clients such as SAS Enterprise Guide. I find myself using, every day more often, the web versions of Microsoft Office 365 applications, and I revert to a local installation of Microsoft PowerPoint or Microsoft Word only when I need a functionality still not available with the online version.
SAS Studio 5.2 delivers many new features that help closing the capabilities gap with SAS Enterprise Guide. Some examples are a data step debugger, the ability to create queries, the new integration with GIT, and many more.
For these reasons, SAS Enterprise Guide 8.2 does not come by default with any SAS Viya 3.5 solution and is provided to customers only after explicit request.
Deployment Notes
Although SAS Enterprise Guide 8.2 can connect to SAS Viya 3.5 without requiring any other SAS 9 component, you still need a SAS 9 depot to deploy it. In fact, SAS Enterprise Guide is not included in any Viya 3.5 repository; you should get a SAS 9 order that includes, at least, SAS Enterprise Guide itself, and use it to download a SAS 9 depot. Then, unless you need to deploy any other SAS 9 component for different purposes, I suggest you install the standalone version of SAS Enterprise Guide, as documented in Appendix A of the SAS Deployment Wizard and SAS Deployment Manager 9.4: User's Guide, available at http://support.sas.com/deploywizug94.html.
You may be required to manually install, as a pre-requisite, .Net 4.7.1 (or later, but in the 4.x family). Once you get a SAS 9 depot, the SAS Enterprise Guide standalone installer is available at <depotroot>\standalone_installs\SAS_Enterprise_Guide_Independent_Installer\8_2, while .Net 4.7.1 can be found at <depotroot>\products\dotnet471__99110__prt__xx__sp0__1\w32\native, or online at https://dotnet.microsoft.com/download/dotnet-framework.
SAS Enterprise Guide Configuration
To integrate SAS Enterprise Guide with SAS Viya 3.5, the first step to perform is to define a new direct connection from SAS Enterprise Guide to a SAS object spawner deployed in the SAS Viya 3.5 environment.
Start SAS Enterprise Guide, then select Tools->Connections (if you receive a request to start a new project, simply close the dialog)
If you are used to administering SAS Enterprise Guide in the SAS 9 world, you may be familiar with the dialog that opens to define a new profile. Well, with SAS Viya 3.5, that's NOT what we are going to use. A connection profile is useful to connect to a SAS Metadata server, but here you do not have any!
Select the next option on the left list, Servers, then click the Add button:
This opens a new dialog where you can define a direct connection to a SAS object spawner (used to start on-demand SAS Workspace Servers for SAS Enterprise Guide). Enter a Name, Server hostname or IP address, and Save. All other defaults should be fine for most cases (The SAS Viya 3.5 object spawner listens by default on port 8591; if you configured it to use a different port number, then adjust the Port field accordingly).
Done. You have a new connection to SAS Viya 3.5:
You can now test the connection. In SAS Enterprise Guide Servers pane, click on the server that you just defined and, when prompted, enter a valid username and password. If the connection is successful, you will be able to see a green checkmark and to expand the Libraries and File Navigation lists:
If it worked, congratulations. Yet, there are chances that your connection is still not successful at this point. If this is the case, then read on!
Unable to connect - Encryption
A possible issue that you may encounter is due to TLS errors:
By default, all communication to and within SAS Viya 3.5 full-deployments on Linux is encrypted. Therefore, getting SAS Enterprise Guide to connect to the SAS object spawner on Viya 3.5 may require some configuration and manipulation of certificates. The above dialog is complaining about the root certificate that was used to sign the certificate presented by the server when SAS Enterprise Guide tried to connect. This root certificate is self-generated by the SAS Secrets Manager server in SAS Viya 3.5, so it is almost always unknown to - and untrusted by - the Windows client machine hosting SAS Enterprise Guide.
Steps to ensure the correct certificates are in place
In order to properly configure encrypted communication, the following steps are required:
- Locate the file containing the proper certificates on the Viya 3.5 machine hosting the SAS object spawner
- Import the root certificate into the Windows Trusted certificate stores (used by SAS Enterprise Guide)
Locate the SAS Viya 3.5 root CA certificate
The CA certificates used to sign the certificates that SAS Viya 3.5 servers use can be located in /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts, on the machine hosting the SAS object spawner SAS Enterprise Guide tried to connect to. There are multiple files in this directory: locate the one named vault-###-ca.crt.
cloud-user@intviya03 ~]$ ls -l /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts total 608 -rw-r--r--. 1 sas sas 1940 Jan 20 12:20 httpproxy-sasviya02-ca.crt -rw-r--r--. 1 sas sas 164539 Jan 20 12:20 trustedcerts.jks -rw-r--r--. 1 sas sas 177100 Jan 20 12:20 trustedcerts.p12 -rw-r--r--. 1 sas sas 263069 Jan 20 12:20 trustedcerts.pem -rw-r--r--. 1 sas sas 3456 Jan 20 12:19 vault-sasviya02-ca.crt
Copy this file to the Windows client machine.
Split the certificates and import into the Windows Trusted Root Certification Authority
The vault-###-ca.crt file actually contains two certificates: the SAS Viya 3.5 root CA certificate and the intermediate CA certificate. The following shows an abbreviated example file:
[cloud-user@intviya03 ~]$ cat /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/vault-sasviya02-ca.crt -----BEGIN CERTIFICATE----- MIIFJzCCAw+gAwIBAgIUGv2hqQyshabrbJTwf4zspx8xdLIwDQYJKoZIhvcNAQEL BQAwGzEZMBcGA1UEAxMQU0FTIFZJWUEgUm9vdCBDQTAeFw0yMDAxMjAxNzE2MzRa Fw0zMDAxMTcxNzE3MDNaMBsxGTAXBgNVBAMTEFNBUyBWSVlBIFJvb3QgQ0EwggIi ..... p7VBZCGJDaei3e+9an69eRS9rOskgFLyHpE5 -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEeDCCAmCgAwIBAgIUVyAf6FoJWD7h4yIYTXogFyEpXZQwDQYJKoZIhvcNAQEL BQAwGzEZMBcGA1UEAxMQU0FTIFZJWUEgUm9vdCBDQTAeFw0yMDAxMjAxNzE2MzRa Fw0yNzAxMTgxNzE3MDRaMCMxITAfBgNVBAMTGFNBUyBWSVlBIEludGVybWVkaWF0 ..... r6zQrd5NqY+FqiP9CpUAc+wMhXg/WYOyMQ5uhQW50lnNsdxev9PF/5eIgBw= -----END CERTIFICATE-----
As you can see, the certificates are delineated by the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. You need to split them into separate files. Use a text editor to create a new empty file, paste all the text from the first tag -----BEGIN CERTIFICATE----- to the first -----END CERTIFICATE----- (tags included). Save the file in a temp directory on the Windows client machine naming it SASViyaCARoot.crt. Repeat the process with a second file, pasting all the lines included in the second set of tags (tags included) and saving it as SASViyaCAIntermediate.crt
The detailed steps for importing the certificates into the Windows CA stores are documented in the SAS Viya Administration guide. Use the Certificates Snap-In of the Microsoft Management Console and walk through the steps of importing of certificates. In the end, the certificates should be available and visible within the MMC:
After the import, SAS Enterprise Guide should be able to successfully validate the SAS Viya 3.5 certificates and you will be able to connect ... unless you also encounter the next issue.
Unable to connect - Networking
A second kind of connection issue may arise in very specific situations.
SAS Viya 3.5 introduces better support for hosts with multiple network interfaces or multiple IP addresses, with the capability to specify, during the initial deployment, to which IP address services should bind. In detail, it is possible to specify an address/hostname/interface for internal connections, and different ones for external connections. The following shows an example network configuration file:
[cloud-user@intviya01 ~]$ cat ~/sas_viya_playbook/host_vars/sasviya03.yml --- network_conf: SAS_HOSTNAME: intviya03.race.sas.com SAS_BIND_ADDR: 192.168.1.3 SAS_EXTERNAL_HOSTNAME: sasviya03.race.sas.com SAS_EXTERNAL_BIND_ADDR_IF: "eth0"
When this capability is used to bind internal connections to an IP address that is not reachable from external clients, SAS Enterprise Guide incurs in the issue presented above. In fact, the SAS object spawner binds to, and only listens on, the specified internal address (in the example above, it is 192.168.1.3), to which SAS Enterprise Guide cannot connect.
In this case, you have to explicitly tell the SAS object spawner to listen on the external address, by overriding a configuration property. You can follow these steps:
- Logon to the server(s) hosting the SAS object spawner with the sas installation user
- With your favorite text editor, add the following lines at the end of the file
/opt/sas/viya/config/etc/spawner/default/spawner_usermods.sh:### Force the object spawner to communicate using the external network #setup the required environment variables - this function is sourced in spawner.sh sas_setup_external_network #add the hostknownby option if [ -n "${SAS_EXTERNAL_HOSTNAME}" ] ; then USERMODS="$USERMODS -hostknownby ${SAS_EXTERNAL_HOSTNAME}" fi #remove the dnsname option spawner_options="${spawner_options//-dnsname *[1-9]/}" - Restart the SAS object spawner. As an example, on a RHEL 7 system, the command would be
sudo systemctl restart sas-viya-spawner-default
With the changes above, the SAS object spawner binds to all available interfaces - thus, SAS Studio (Basic) is unaffected by the change -, but manages connections with SAS Enterprise Guide using the specified external hostname and interface.
Further details
SAS Enterprise Guide cannot automatically leverage any load-balancing or failover capability, even if the SAS Viya 3.5 programming environment has been deployed on multiple servers. As a manual workaround, it is possible to repeat multiple times the steps outlined above, to define a connection to each individual server, and manually switch from one to another when required.
The direct connection between SAS Enterprise Guide and the SAS object spawner and the SAS workspace server, as we have seen, does not leverage SAS Viya 3.5 REST APIs nor the HTTPS protocol; it’s still using the traditional SAS proprietary IOM protocol, secured by TLS. For this reason, the same technique described here can be used to create a direct connection to a SAS 9 object spawner.
Finally, Kerberos authentication is not enabled by default on the SAS Viya 3.5 object spawner. To use IWA for direct connections from SAS Enterprise Guide 8.2, you will require additional Kerberos prerequisites and SAS object spawner configuration. This will be the subject for another post is perfectly explained in this post from @StuartRogers !
As previously stated please remember. This article is only appropriate for usage with Viya 3.5. This article is not appropriate for use with Viya 2020.x and upwards. For connectivity between Enterprise Guide and Viya 2020.x please consult the documentation for the use of SAS/CONNECT and native features for Enterprise Guide submissions to CAS.
Suppose you have a bundle like Office Analytics licensed but you are trying to avoid the complexities of a metadata deployment in SAS 9.4M6. Before this change you would have to tell your client they were limited to SAS Studio Basic as their programming environment.
Now SAS Enterprise Guide 8.2 is also an option!
Here are the steps I did to confirm this with SAS Studio 3.8 and SAS 9.4M6.
Deploy SAS Studio Basic 3.8 as documented in the SAS Studio Basic 3.8 Admin Guide (Chapter 4).
https://go.documentation.sas.com/api/docsets/webeditorag/3.8/content/webeditorag.pdf
This should result in a deployment URL of something like this:
http://sas94vprod.XXXX.com:38080
Provided that you accepted the defaults in the deployment wizard then you also have an object spawner running on sasv94vprod.XXXX.com at port 38591. This is the object spawner that you want to use in the EG server connection dialog.
Specify sign-in credentials that match any sign-in credentials that you would use with the SAS Studio Basic web application. Click on "Save" and now you should be able connect to the SAS Studio Basic services with EG.
License Issues
The main thing to keep in mind is that this only works if you have a license that supports deploying Enterprise Guide with a metadata server. You could do a metadata deployment, but to simplify your deployment you are choosing a metadata-less route.
To confirm this run PROC SETINIT.
Product expiration dates: ---Base SAS Software 30DEC2020 (CPU A) ---SAS/STAT 30DEC2020 (CPU A) ---SAS/GRAPH 30DEC2020 (CPU A) ---SAS/IML 30DEC2020 (CPU A) ---SAS/CONNECT 30DEC2020 (CPU A) ---SAS Integration Technologies 30DEC2020 (CPU A) ---SAS Enterprise Guide 30DEC2020 (CPU A)
The key one is SAS Integration Technologies. That is the key license to enable this support.
If you only have:
---SAS Workspace Server for Local Access 30JUN2020 (CPU A)
Then you don't have the proper license to connect with Enterprise Guide 8.2. SAS Studio Basic will work fine, but not EG.
Another possible issue is that port 38591 may not be open on your SAS server. Your firewall or security policy may block inbound traffic which will prevent Enterprise Guide 8.2 from functioning in this manner. I don't believe the planning documentation references this port for a SAS Studio Basic deployment - only the web port at 38080 or 38443. See https://linuxhint.com/list_open_ports_firewalld/ if you are using firewalld.
