EG Scheduling / authentication domain

[tlk]

Hello everyone,

I have a lot of users that schedule Eg project every night.   It run locally on their desktop.  They access Oracle DB using authentication domain.  We are looking for a way to put all schedule project on a server to provide more stability.   If we use an administrative account to run those schedule but still want to use the authentication domain from each user, Is it possible ?

Security dept. is not to keen on granting all DB acces to this administrative account.

Thanks.

Laurent

[SASKiwi]

I'm assuming you are using SAS 9.4 here - yes, this is entirely possible. I'm assuming the authentication domain has it's own Oracle-specific user account and password. This entirely independent of the user account scheduling the SAS job.

BTW, I hope you are aware that EG projects can only run from EG. If you want to schedule them on a SAS server you will need to export the EG projects to SAS programs.

[tlk]

Thanks for your reply. It also mean that we have to put all the authentication domain on that scheduling account. Or the scheduling account could read the right authentication domain from those user depending on a parameter from the project to know which one to take.

We are looking also at the export options.

Thanks

[SASKiwi]

I don't follow your logic. The way we use an authentication domain is to have the Oracle data connections defined in metadata as data libraries. There is a static Oracle user account (not an OS user account) defined in the auth domain and it handles all database connections. The metadata libraries need to be predefined as they will work in any SAS environment: EG, batch, SAS Studio etc. It doesn't matter what user account uses these libraries and whether it is using EG or a scheduled job or project it just works.  

[tlk]

Thanks,  what I am trying to say is that an authdomain is link to a specific user.   When SAS execute a project is getting the authdomain of the user who is actually connected to SAS/eg.

We're trying to see every possibility.    We are looking to have a production user that will have all access necessary in the B and will be define as OPS in Oracle so ther will be no need to pass credential to Oracle (it mean that Oracle will permit the connection because the user was authenticated by th OS)

Thanks again.

[SASKiwi]

OK, so it looks like you want to use OS accounts to connect and authenticate against Oracle rather than separate Oracle-specific accounts - is this correct? In my world this is called IWA - Integrated Windows Authentication. I know how to do this for SQL server but not Oracle. You can test such data connections in a LIBNAME statement. For SQL Server it looks like this:

libname SQLSRVR odbc noprompt = "server=SQLServerName;DRIVER=SQL Server Native Client 11.0;Trusted Connection=yes" DATABASE = MyDatabase schema = dbo;

Note, there is no user account or password supplied. The "Trusted Connection=yes" option says use my Windows account to authenticate with SQL Server. For Oracle the equivalent option is "Integrated Security=yes".