SAS Visual Analytics Guest Access with IWA Fallback

Yesterday I wrote a post about configuring a SAS® 9.4 M2 installation on Linux for Integrated Windows Authentication (IWA) with mid-tier fallback form-based authentication to handle situations where IWA was not available or was disabled. I also repeated this configuration with a SAS Visual Analytics 7.1 installation (based on SAS 9.4 M2). This means that domain users within an organisation, who can participate in IWA, can simply open a browser, navigate to SAS Visual Analytics, and be logged in automatically using their Windows login. Other users without a domain account, on a machine that is not in the domain, or who have deliberately disabled IWA in their browser, will see the familiar SAS Logon Manager login form where they can manually provide a user id and password.

One of the other reasons I built this configuration was to find out what happened with SAS Visual Analytics Guest Access in an IWA fallback configuration like this. Essentially, I wanted to find out if I could get maximum flexibility by supporting IWA users, form-based authentication users, and guest/anonymous access all at the same time.

One of the reasons I wanted to test this was a reference I remembered seeing in the SAS documentation. The Web Authentication section of the SAS 9.4 Intelligence Platform: Security Administration Guide, Second Edition, lists one of the limits of Web Authentication as “Not compatible with anonymous access”. This is also repeated in the PUBLIC Access and Anonymous Access section too.

It makes sense that anonymous access is not compatible with web authentication in a standard non-fallback configuration. If authentication is automatic and it fails then access is denied. An IWA fallback configuration is slightly different though – you have a choice whether to do web authentication or SAS authentication (e.g. IWA or non-IWA). If you choose SAS authentication then perhaps anonymous access might still be available as an option. I decided to test it out.

I ran 4 test scenarios to see how they were handled in an IWA with fallback configuration:
Continue reading “SAS Visual Analytics Guest Access with IWA Fallback”

IWA with SAS 9.4 M2 on Linux

I’ve just finished a challenging but very rewarding experience configuring a SAS 9.4 M2 platform on Linux to use Integrated Windows Authentication (IWA), for both server and mid-tiers ….. without using Quest Authentication Services.

The SAS platform has supported IWA on Linux since SAS 9.3 but until recently has only supported it when you “purchase, install, and configure an additional third-party product (Quest Authentication Services 4.0)”.

I’ve been wanted to do a SAS + Linux + IWA config for a while but had put it off because of the Quest requirement. What brought it back to the front of my mind was talking to someone recently about implementing IWA for a SAS Visual Analytics installation on Linux. They wanted to provide seamless login via IWA for most users, but also provide form-based logins for people who couldn’t use IWA.

I remembered seeing this section from the What’s New in SAS 9.4 (SAS 9.4 Intelligence Platform):

In the second maintenance release for SAS 9.4, Integrated Windows Authentication on Linux systems no longer requires the use of Quest Authentication Services. SAS can leverage the libraries that are shipped with the supported operating system or that are provided in most third-party authentication solutions.

It sounded like SAS 9.4 M2 would allow me to build such a config, without using Quest, and use the standard Linux libgssapi_krb5 package instead. At the same time I also remembered reading a great SAS Global Forum paper by Zhiyong Li on mid-tier fallback authentication: this is where you can configure the SAS mid-tier to fallback to form-based authentication in situations where IWA is not available or has been disabled (like you might do when you want to login using a different second identity). These both sounded like great challenges [ and fun 🙂 ], so I set about confirming my understanding of these possibilities with SAS 9.4 M2 by doing both at the same time.

After a few days of research, implementation, testing and debugging, I finalized the config last night. I got quite a buzz out of some of the mind-bending troubleshooting sessions and it was a very rewarding outcome. Other than a few relatively minor issues to resolve, it is all working very well now.

If I get some time I’ll try to write up a few blog posts with more detail on the steps, issues, troubleshooting techniques and resolutions. In the meantime here’s an outline of the approach I took:
Continue reading “IWA with SAS 9.4 M2 on Linux”

New Admin Forum on SAS Communities

I read some great SAS news this weekend. I found out there’s a new admin related forum on the SAS Communities site! If you head over to and look in the list of Communities and Forums you’ll see a new header, Deployment & Administration of SAS Software, and a new forum called SAS Deployment:

In the announcement Mark Schneider, R&D Director – Deployment, SAS Institute Inc. said the following:

“We’ve received quite a few requests for a SAS Community for SAS Administrators, and as an initial response, we’ve created this SAS Deployment Community.”

Thanks to Mark and the SAS Communities administrators for setting up this new forum.

When I read the announcement I also wondered whether the phrase “initial response” and the fact that the new forum is listed under a heading of its own, could mean we might possibly see additional forums in the future on other specific admin topics (like EG Admin, Web Admin, Security Admin etc). What do you think? From my perspective I’m just pleased there’s an admin forum. If it sees so much activity that more specific ones get created down the track that could be a bonus, but for now I’m just happy there’s a new home for admin discussions.

Hope to see you in the new SAS Communities admin forum. 🙂

Resources for Designing and Configuring I/O Subsystems for SAS® Software

As a SAS platform administrator, I often find myself discussing the importance of well designed I/O subsystems with customers and I.T administrators/architects. Sometimes it can be a challenge explaining how important it is for SAS applications to have a high sustained sequential I/O throughput. In some cases they may not consider I/O requirements for SAS software as any different to other applications they are running. In other cases, with the knowledge that it is enterprise software, they may make the well intended assumption to treat it like databases they have experience of and aim for high numbers of small transactional random I/O’s per second. It can be unfortunate when I/O storage decisions and purchases happen before a consultant with SAS software experience gets involved. The purpose of this post is to provide links to a number of resources that can help you make your case for a well designed and configured I/O subsystem for your SAS software installation. I like to provide references to papers by SAS Institute employees because of the value that vendor statements have in reinforcing what I am saying.

These are the papers from SAS Institute that I refer to most often when talking about I/O. They contain very useful information you can use when putting forward your case for high performance I/O subsystems in hardware purchases. If your I.T. administrators are up to a little extra reading it can also provide them with some of the insight they might need when choosing and tuning hardware suitable for use with SAS software. I think the “How to Maintain Happy SAS® Users” paper is a great read for both SAS administrators and the I.T. administrators who work with them.

How to Maintain Happy SAS® Users
Margaret Crevar, SAS Institute Inc., Cary, NC
SAS Global Forum 2009 Paper 310-2009
PDF available from
Frequently Asked Questions Regarding Storage Configurations
Margaret Crevar & Tony Brown, SAS Institute Inc.
PDF available from
Best Practices for Configuring your IO Subsystem for SAS®9 Applications
Margaret A. Crevar, Tony Brown & Leigh A. Ihnen, SAS Institute Inc.
SAS Global Forum 2007
PDF available from
Improving SAS® I/O Throughput by Avoiding the Operating System File Cache
Leigh Ihnen & Mike Jones, SAS Institute Inc., Cary, NC
SAS Global Forum Paper 327-2009
PDF available from

If you would like to add to this list any other papers or resources you know of, that help explain the I/O characteristics of SAS software and appropriate I/O architecture guidelines/recommendations, then please let me know.

Updated 15Sep2010: added Frequently Asked Questions Regarding Storage Configurations to the list of papers.
Updated 04Dec2010: thanks to June’s comment, updated link to more recent version of the How to Maintain Happy SAS® Users paper.