BookmarkSubscribeRSS Feed

SAS Enterprise Guide: Welcome to SAS Viya 3.5?

Started ‎04-07-2020 by
Modified ‎03-13-2023 by
Views 24,775

Updated March 2023. Please note. This article is only appropriate for usage with Viya 3.5. This article is not appropriate for use with Viya 2020.x and upwards. For connectivity between Enterprise Guide and Viya 2020.x please consult the documentation for the use of SAS/CONNECT and connecting to a CAS Server. If you wish to understand the use of SAS/CONNECT in relation to releases of Viya 2022.x (May 2022 and onwards) then take a look at this blog.

 

In late 2019 you may have heard of plans to support SAS Enterprise Guide integration with SAS Viya 3.5. Now you may be looking for it, but cannot find it in your Viya 3.5 environment. 

 

Whether you perform a programming only or a full Viya 3.5 deployment, it seems it's not there. Also, after a quick look at the official documentation, what's new pages, or product reference, not much shows up. So, what's going on?

 

SAS' vision is aligned with our customer requests and with the market direction, towards web interfaces such as SAS Studio and away from full desktop clients such as SAS Enterprise Guide. Yet, you may remember that SAS Enterprise Guide has been able to leverage Viya 3.5 functionality for a while, at least since SAS 9.4M5 - but, as always, the devil is in the details. Up to version 8.1, SAS Enterprise Guide can connect to a CAS server running in a Viya 3.5 environment; to do that, it requires an initial connection to a SAS 9 server - either part of a SAS 9 environment that includes, at least, a metadata server, an object spawner and a workspace server, or locally co-located on the client.

SAS9andViyaIntegrations - EG71toViya35 (1).png

 SAS Enterprise Guide -> SAS 9 Metadata Server -> SAS 9 Object Spawner -> SAS 9 Workspace -> CAS

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

 

SAS9andViyaIntegrations - EG71localtoViya35.png

 SAS Enterprise Guide  -> local SAS 9 -> CAS

 

Starting with SAS Enterprise Guide 8.2, it is now possible to avoid any intermediate SAS 9 components and directly connect from the client to a Viya 3.5 workspace server. You can work on most of your existing projects, process flows, programs, including the capability to submit code that gets executed in CAS.

 

SAS9andViyaIntegrations - EG82ClienttoViya35.png

 SAS Enterprise Guide 8.2 -> SAS Viya 3.5 Object Spawner -> SAS Viya 3.5 Workspace -> (CAS)

 

What are the benefits, with respect to the previous release? In a short sentence, you get the capability to leverage the power of SAS Enterprise Guide, without the requirement to install (and maintain) a full SAS 9 environment.

 

Yet, this new capability does not promote SAS Enterprise Guide to a full-class SAS Viya 3.5 product. In fact, this configuration is similar to a "programming only" environment, such as SAS Studio 5.2 (basic), with no other interaction with microservices nor other Viya 3.5 services. This similarity with SAS Studio is not incidental.

 

Availability to Customers

As we already stated at the beginning, SAS is moving towards web interfaces such as SAS Studio and away from full desktop clients such as SAS Enterprise Guide. I find myself using, every day more often, the web versions of Microsoft Office 365 applications, and I revert to a local installation of Microsoft PowerPoint or Microsoft Word only when I need a functionality still not available with the online version.

 

SAS Studio 5.2 delivers many new features that help closing the capabilities gap with SAS Enterprise Guide. Some examples are a data step debugger, the ability to create queries, the new integration with GIT, and many more.

 

For these reasons, SAS Enterprise Guide 8.2 does not come by default with any SAS Viya 3.5 solution and is provided to customers only after explicit request. 

 

Deployment Notes

Although SAS Enterprise Guide 8.2 can connect to SAS Viya 3.5 without requiring any other SAS 9 component, you still need a SAS 9 depot to deploy it. In fact, SAS Enterprise Guide is not included in any Viya 3.5 repository; you should get a SAS 9 order that includes, at least, SAS Enterprise Guide itself, and use it to download a SAS 9 depot. Then, unless you need to deploy any other SAS 9 component for different purposes, I suggest you install the standalone version of SAS Enterprise Guide, as documented in Appendix A of the SAS Deployment Wizard and SAS Deployment Manager 9.4: User's Guide, available at http://support.sas.com/deploywizug94.html.

You may be required to manually install, as a pre-requisite, .Net 4.7.1 (or later, but in the 4.x family). Once you get a SAS 9 depot, the SAS Enterprise Guide standalone installer is available at <depotroot>\standalone_installs\SAS_Enterprise_Guide_Independent_Installer\8_2, while .Net 4.7.1 can be found at <depotroot>\products\dotnet471__99110__prt__xx__sp0__1\w32\native, or online at https://dotnet.microsoft.com/download/dotnet-framework.  

 

SAS Enterprise Guide Configuration

To integrate SAS Enterprise Guide with SAS Viya 3.5, the first step to perform is to define a new direct connection from SAS Enterprise Guide to a SAS object spawner deployed in the SAS Viya 3.5 environment.

 

Start SAS Enterprise Guide, then select Tools->Connections (if you receive a request to start a new project, simply close the dialog)

 

20200124_04_EGConnection.png

 

If you are used to administering SAS Enterprise Guide in the SAS 9 world, you may be familiar with the dialog that opens to define a new profile. Well, with SAS Viya 3.5, that's NOT what we are going to use. A connection profile is useful to connect to a SAS Metadata server, but here you do not have any!

 

20200124_05_EGProfiles.png

 

Select the next option on the left list, Servers, then click the Add button:

 

20200124_06_EGAddServers.png

 

This opens a new dialog where you can define a direct connection to a SAS object spawner (used to start on-demand SAS Workspace Servers for SAS Enterprise Guide). Enter a Name, Server hostname or IP address, and Save. All other defaults should be fine for most cases (The SAS Viya 3.5 object spawner listens by default on port 8591; if you configured it to use a different port number, then adjust the Port field accordingly).

 

20200124_07_EGDefineWS.png

 

Done. You have a new connection to SAS Viya 3.5:

 

20200124_08_EGServers.png

 

You can now test the connection. In SAS Enterprise Guide Servers pane, click on the server that you just defined and, when prompted, enter a valid username and password. If the connection is successful, you will be able to see a green checkmark and to expand the Libraries and File Navigation lists:

 

20200124_09_EGServersPane.png

 

If it worked, congratulations. Yet, there are chances that your connection is still not successful at this point. If this is the case, then read on!  

 

Unable to connect - Encryption

A possible issue that you may encounter is due to TLS errors:

 

20200124_10_EGErrorEncryption.png

 

By default, all communication to and within SAS Viya 3.5 full-deployments on Linux is encrypted. Therefore, getting SAS Enterprise Guide to connect to the SAS object spawner on Viya 3.5 may require some configuration and manipulation of certificates. The above dialog is complaining about the root certificate that was used to sign the certificate presented by the server when SAS Enterprise Guide tried to connect. This root certificate is self-generated by the SAS Secrets Manager server in SAS Viya 3.5, so it is almost always unknown to - and untrusted by - the Windows client machine hosting SAS Enterprise Guide.

Steps to ensure the correct certificates are in place

In order to properly configure encrypted communication, the following steps are required:

  1. Locate the file containing the proper certificates on the Viya 3.5 machine hosting the SAS object spawner
  2. Import the root certificate into the Windows Trusted certificate stores (used by SAS Enterprise Guide)

Locate the SAS Viya 3.5 root CA certificate

The CA certificates used to sign the certificates that SAS Viya 3.5 servers use can be located in /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts, on the machine hosting the SAS object spawner SAS Enterprise Guide tried to connect to. There are multiple files in this directory: locate the one named vault-###-ca.crt.

 

cloud-user@intviya03 ~]$ ls -l /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts
total 608
-rw-r--r--. 1 sas sas   1940 Jan 20 12:20 httpproxy-sasviya02-ca.crt
-rw-r--r--. 1 sas sas 164539 Jan 20 12:20 trustedcerts.jks
-rw-r--r--. 1 sas sas 177100 Jan 20 12:20 trustedcerts.p12
-rw-r--r--. 1 sas sas 263069 Jan 20 12:20 trustedcerts.pem
-rw-r--r--. 1 sas sas   3456 Jan 20 12:19 vault-sasviya02-ca.crt

 

Copy this file to the Windows client machine.

Split the certificates and import into the Windows Trusted Root Certification Authority

The vault-###-ca.crt file actually contains two certificates: the SAS Viya 3.5 root CA certificate and the intermediate CA certificate.  The following shows an abbreviated example file:

 

[cloud-user@intviya03 ~]$ cat /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/vault-sasviya02-ca.crt
-----BEGIN CERTIFICATE-----
MIIFJzCCAw+gAwIBAgIUGv2hqQyshabrbJTwf4zspx8xdLIwDQYJKoZIhvcNAQEL
BQAwGzEZMBcGA1UEAxMQU0FTIFZJWUEgUm9vdCBDQTAeFw0yMDAxMjAxNzE2MzRa
Fw0zMDAxMTcxNzE3MDNaMBsxGTAXBgNVBAMTEFNBUyBWSVlBIFJvb3QgQ0EwggIi
.....
p7VBZCGJDaei3e+9an69eRS9rOskgFLyHpE5
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEeDCCAmCgAwIBAgIUVyAf6FoJWD7h4yIYTXogFyEpXZQwDQYJKoZIhvcNAQEL
BQAwGzEZMBcGA1UEAxMQU0FTIFZJWUEgUm9vdCBDQTAeFw0yMDAxMjAxNzE2MzRa
Fw0yNzAxMTgxNzE3MDRaMCMxITAfBgNVBAMTGFNBUyBWSVlBIEludGVybWVkaWF0
.....
r6zQrd5NqY+FqiP9CpUAc+wMhXg/WYOyMQ5uhQW50lnNsdxev9PF/5eIgBw=
-----END CERTIFICATE-----

 

As you can see, the certificates are delineated by the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. You need to split them into separate files. Use a text editor to create a new empty file, paste all the text from the first tag  -----BEGIN CERTIFICATE----- to the first -----END CERTIFICATE----- (tags included). Save the file in a temp directory on the Windows client machine naming it SASViyaCARoot.crt. Repeat the process with a second file, pasting all the lines included in the second set of tags (tags included) and saving it as SASViyaCAIntermediate.crt

 

The detailed steps for importing the certificates into the Windows CA stores are documented in the SAS Viya Administration guide.  Use the Certificates Snap-In of the Microsoft Management Console and walk through the steps of importing of certificates.  In the end, the certificates should be available and visible within the MMC:

 

20200124_11_WindowsRootCerts-1024x493.png

 

After the import, SAS Enterprise Guide should be able to successfully validate the SAS Viya 3.5 certificates and you will be able to connect ... unless you also encounter the next issue.  

 

Unable to connect - Networking

A second kind of connection issue may arise in very specific situations.

 

20200124_12_EGErrorNetwork.png

 

SAS Viya 3.5 introduces better support for hosts with multiple network interfaces or multiple IP addresses, with the capability to specify, during the initial deployment, to which IP address services should bind. In detail, it is possible to specify an address/hostname/interface for internal connections, and different ones for external connections. The following shows an example network configuration file:

 

[cloud-user@intviya01 ~]$ cat ~/sas_viya_playbook/host_vars/sasviya03.yml
---
network_conf:
SAS_HOSTNAME: intviya03.race.sas.com
SAS_BIND_ADDR: 192.168.1.3
SAS_EXTERNAL_HOSTNAME: sasviya03.race.sas.com
SAS_EXTERNAL_BIND_ADDR_IF: "eth0"

When this capability is used to bind internal connections to an IP address that is not reachable from external clients, SAS Enterprise Guide incurs in the issue presented above. In fact, the SAS object spawner binds to, and only listens on, the specified internal address (in the example above, it is 192.168.1.3), to which SAS Enterprise Guide cannot connect.

 

In this case, you have to explicitly tell the SAS object spawner to listen on the external address, by overriding a configuration property. You can follow these steps:

  1. Logon to the server(s) hosting the SAS object spawner with the sas installation user
  2. With your favorite text editor, add the following lines at the end of the file /opt/sas/viya/config/etc/spawner/default/spawner_usermods.sh:
    ### Force the object spawner to communicate using the external network
    #setup the required environment variables - this function is sourced in spawner.sh
    sas_setup_external_network
    #add the hostknownby option
    if [ -n "${SAS_EXTERNAL_HOSTNAME}" ] ; then
      USERMODS="$USERMODS -hostknownby ${SAS_EXTERNAL_HOSTNAME}"
    fi
    #remove the dnsname option
    spawner_options="${spawner_options//-dnsname *[1-9]/}"
  3. Restart the SAS object spawner. As an example, on a RHEL 7 system, the command would be
    sudo systemctl restart sas-viya-spawner-default

With the changes above, the SAS object spawner binds to all available interfaces - thus, SAS Studio (Basic) is unaffected by the change -, but manages connections with SAS Enterprise Guide using the specified external hostname and interface.

 

Further details

SAS Enterprise Guide cannot automatically leverage any load-balancing or failover capability, even if the SAS Viya 3.5 programming environment has been deployed on multiple servers. As a manual workaround, it is possible to repeat multiple times the steps outlined above, to define a connection to each individual server, and manually switch from one to another when required.

The direct connection between SAS Enterprise Guide and the SAS object spawner and the SAS workspace server, as we have seen, does not leverage SAS Viya 3.5 REST APIs nor the HTTPS protocol; it’s still using the traditional SAS proprietary IOM protocol, secured by TLS. For this reason, the same technique described here can be used to create a direct connection to a SAS 9 object spawner.

Finally, Kerberos authentication is not enabled by default on the SAS Viya 3.5 object spawner. To use IWA for direct connections from SAS Enterprise Guide 8.2, you will require additional Kerberos prerequisites and SAS object spawner configuration. This will be the subject for another post is perfectly explained in this post from @StuartRogers !

 

As previously stated please remember. This article is only appropriate for usage with Viya 3.5. This article is not appropriate for use with Viya 2020.x and upwards. For connectivity between Enterprise Guide and Viya 2020.x please consult the documentation for the use of SAS/CONNECT and native features for Enterprise Guide submissions to CAS.

Comments

 

Suppose you have a bundle like Office Analytics licensed but you are trying to avoid the complexities of a metadata deployment in SAS 9.4M6. Before this change you would have to tell your client they were limited to SAS Studio Basic as their programming environment.

 

Now SAS Enterprise Guide 8.2 is also an option!

 

Use SAS Studio Basic Object Spawner with Enterprise Guide 8.2Use SAS Studio Basic Object Spawner with Enterprise Guide 8.2

 

Here are the steps I did to confirm this with SAS Studio 3.8 and SAS 9.4M6.

 

Deploy SAS Studio Basic 3.8 as documented in the SAS Studio Basic 3.8 Admin Guide (Chapter 4).

 

https://go.documentation.sas.com/api/docsets/webeditorag/3.8/content/webeditorag.pdf

 

This should result in a deployment URL of something like this:

 

http://sas94vprod.XXXX.com:38080

 

Provided that you accepted the defaults in the deployment wizard then you also have an object spawner running on sasv94vprod.XXXX.com at port 38591. This is the object spawner that you want to use in the EG server connection dialog. 

 

Specify sign-in credentials that match any sign-in credentials that you would use with the SAS Studio Basic web application. Click on "Save" and now you should be able connect to the SAS Studio Basic services with EG.

 

License Issues

 

The main thing to keep in mind is that this only works if you have a license that supports deploying Enterprise Guide with a metadata server.  You could do a metadata deployment, but to simplify your deployment you are choosing a metadata-less route. 

 

To confirm this run PROC SETINIT.

 

Product expiration dates:
---Base SAS Software 30DEC2020 (CPU A)
---SAS/STAT 30DEC2020 (CPU A)
---SAS/GRAPH 30DEC2020 (CPU A)
---SAS/IML 30DEC2020 (CPU A)
---SAS/CONNECT 30DEC2020 (CPU A)
---SAS Integration Technologies 30DEC2020 (CPU A)
---SAS Enterprise Guide 30DEC2020 (CPU A)

 

The key one is SAS Integration Technologies. That is the key license to enable this support.

 

If you only have:

 

---SAS Workspace Server for Local Access
30JUN2020 (CPU A)

 

Then you don't have the proper license to connect with Enterprise Guide 8.2. SAS Studio Basic will work fine, but not EG.

 

Another possible issue is that port 38591 may not be open on your SAS server. Your firewall or security policy may block inbound traffic which will prevent Enterprise Guide 8.2 from functioning in this manner. I don't believe the planning documentation references this port for a SAS Studio Basic deployment - only the web port at 38080 or 38443. See https://linuxhint.com/list_open_ports_firewalld/ if you are using firewalld.

 

 

 

Version history
Last update:
‎03-13-2023 11:45 AM
Updated by:

sas-innovate-2024.png

Available on demand!

Missed SAS Innovate Las Vegas? Watch all the action for free! View the keynotes, general sessions and 22 breakouts on demand.

 

Register now!

Free course: Data Literacy Essentials

Data Literacy is for all, even absolute beginners. Jump on board with this free e-learning  and boost your career prospects.

Get Started

Article Tags