Thanks Greg. From your description, this approach should give similar details :   "D:\Program Files\SASHome\SASPrivateJavaRuntimeEnvironment\9.4\jre\bin\keytool.exe" -list -v^  -keystore "D:\Program Files\SASHome\SASSecurityCertificateFramework\1.1\cacerts\trustedcerts.jks"^  -storepass xxxx > "D:\sas\Batch\Sysadmin\Security\trustedcerts_jks.lst"   I can see how an app might be useful. There 142 occurences of trustedCertEntry in our listing !   It is tempting to start over and create a new .jks file with just our 2 entries .  ... View more

Another mystery.   Where is  SAS Usage Note 57370. 2016. “Downloading, installing, and using the TLS/SSL Diagnostic Tool for SAS® 9.4.” Available at http://support.sas.com/kb/57/370.html ? It is the last reference from Stuart Rogers' definitive 2016 paper Tips and Techniques for Using Site-Signed HTTPS with SAS® 9.4  : Paper Template   Could it be referencing keytool.exe or openssl.exe? ... View more

Good call. The .pem files have additional text from the creation tool:    Bag Attributes localKeyID: 90 4D C7 DB 9F 31 E5 4D B6 99 2F E3 BA A8 17 3B 44 28 6A 0E . . . -----BEGIN CERTIFICATE-----   Not completely invalid as certutil.exe can read it : certutil -verify "C:\temp\xxx.pem"   Returns 'CertUtil: -verify command completed successfully.'   Some manual editing is needed and I will ask for a specific format next time. ... View more

Similar issue. Do we know what mechanism SAS Deployment Manager uses to validate .pem files ? We have added a new root certificate but the intermediate chain.pem and .pem files are being rejected as not Base-64.   No validation details are being written to %SASHOME%\InstallMisc\InstallLogs\certframe_wx6_certadd_2024-12-09-13.45.29.log Both certutil.exe -verify and openssl.exe rsa -modulus are accepting the format but not sasdm.exe. Waiting to hear from SAS TS. I think the documentation at SAS Help Center: Manage Certificates in the Trusted CA Bundle Using the SAS Deployment Manager could be improved with Greg's approach.    ... View more

Thanks Paul. That is exactly what I was looking for. I have modified logconfig.xml previously but it was trial and error. ... View more

Mystery solved.  2 years ago, I created a Metadata group to segregate a new team which was Indirectly Denying access. Not obvious but %mdsecds showed the blockage :   %mdsecds(identitynames="team1user, team2user", identitytypes="Person,Person", folder="\DeptData", membertypes="Library"); proc print data=work.mdsecds_join noobs; var objname publictype identityname ReadMetadata WriteMetadata ; run;   Regarding meta libs, even with meta data bound libraries, it is going to be tough to block direct access to D:\data\saslib1. The locations are also defined as SMB shares \\server\data and ACLs need to work for both local and network access.  Difficult to change and test on Windows. I may start another thread to discuss.     ... View more

That makes complete sense but is not what we see. I will set up some dummy libs on our test server.   ... View more

I forgot to mention that int[] is sufficient for most of our numeric data. We have some key fields stored as long integers which we will store as character in SQL . Since much of this data is used for modelling, the users have agreed that numeric precision is not a priority compared with storage capacity. ... View more

The intention is to add data change control which seems more manageable in SQL Server using change tracking. Also, a lot of the data might benefit from partitions - concatenating multiple periods using SQL views for time series analysis. SQL Server seems to have better view performance than SAS but it is more difficult to measure. ... View more

Thanks for pointing me to the FedSQL paper - very useful reference. proc sql _method lets me look under the covers when testing.  ... View more

Thanks. I have been asked for an initial assessment and don't have many details yet. Since a lot of workload is moving from on-prem servers to Azure, I am assuming Azure Active Directory will replace our local domain controllers. SAS94 will stay local for at least the next 2 years.   ... View more

Thanks for the response. It looked like it was possible and I hope my organisation is prepared to support Kerberos/IWA/NTLM. For once, there is some budget.... ... View more