Hi,
I understand where is your question coming from, but something I could explain to you in 30 min face to face, it can take quite long to explain here.
Have you already read those?
Authentication Models: http://support.sas.com/documentation/cdl/en/bisecag/67045/HTML/default/viewer.htm#p0sajzx39gs312n18ud96czemphr.htm
Authentication mechanisms: http://support.sas.com/documentation/cdl/en/bisecag/67045/HTML/default/viewer.htm#n12nk3oh7y2himn141rhgwc800zj.htm
Host Authentication: http://support.sas.com/documentation/cdl/en/bisecag/67045/HTML/default/viewer.htm#p0rjglixjfbdokn12sbp72tqb8xq.htm
Web Authentication: http://support.sas.com/documentation/cdl/en/bimtag/68217/HTML/default/viewer.htm#n1bhp608f0hsoen10i1vi0p9l5f7.htm
I think one that it would be of your special interest is the Identity passing, as one of your main questions: http://support.sas.com/documentation/cdl/en/bisecag/67045/HTML/default/viewer.htm#p0unn7osq3uuvyn0zp0200hbt9gr.htm
All in all, please consider:
- Web Report (Web Report Studio): it runs on a Pooled Workspace Server session with a trusted connection, unless the report includes a stored process, then the stp will run on a stored process server.
- Stored Processes: it runs on a Stored process Server session, with a trusted connection.
Both of above, the trusted connection will happen with sastrust@saspw towards the metadata and your SAS General Servers service account (usually, sassrv)
- Workspace server: will authenticate agains the user account, unless you have SAS Token Authentication, then you will hace a trusted authentication (as on Stored Process and Pooled Workspace Server).
About Web Authentication
a) By default, SAS web applications use the form-based authentication that is provided by the SAS Logon Manager application. When credentials are provided to SAS Logon Manager, the credentials are sent to the SAS Metadata Server for authentication. The metadata server then authenticates the credentials against its authentication provider. The default provider is the host operating system.
b) As an alternative, you can configure the SAS web applications to authenticate on the middle tier. When users log on to a SAS web application, SAS Web Application Server handles the initial authentication for container-managed security.
Performing web authentication facilitates single sign-on. Most likely, your organization has several applications behind a common set of reverse proxy and HTTP servers. By having a common server handle authentication, users do not need to re-authenticate for access to each application.
... View more
