Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-2222: Does Centrify work with SAS?

Centrify DirectControl ,  

16 June,17 at 11:36 PM

Applies to: All versions of Centrify DirectControl.

Question:
Does Centrify work with SAS?

Answer:
SAS (pronounced "sass", originally Statistical Analysis System) is an integrated system of software products provided by SAS Institute Inc. that enables programmers to perform retrieval, management, and mining report writing and graphics statistical analysis business planning, forecasting, and decision support etc. For more details, please go to www.sas.com.

Centrify typically provide SAS with two main benefits:

  1. AD based authentication services to SAS users.

  2. Extension of AD groups to SAS for centralized access control

This is accomplished by simply configuring SAS for PAM and NSS.  For NSS integration nothing special is required.  For PAM integration, SAS needs to be configured via PAM.  For the procedure to configure SAS via PAM see the SAS Configuration Guide available from the vendor.  

For reference we have invluded an excerpt from the 9.4 version of SAS Configuration Guide: 
http://support.sas.com/documentation/installcenter/en/ikfdtnunxcg/66380/PDF/default/config.pdf

(Centrify Corporation does not take any responsibility for the content or availability of this link and it was provided as a courtesy.  Customers should contact the vendor if there are any further questions)

From a licensing perspective, a system with SAS needs a Centrify Unlimited Standard Edition license.  If you’re also providing AD based SSO services to SAS’s web application using Centrify’s App SSO modules, then the web/app servers would need Centrify’s Application Edition.

PAM-configuration: 

SAS is pam-aware and so you just have to make a few configuration changes in the file – sasauth.conf located in <InstallDir>/SASFoundation/9.2/utilities/bin/.
When users are created they should be created with the same Logon ID in SAS as the user has in AD.  The user accounts should also be configured  for default authentication and no password. 
Both the user of the SAS Web Portal and the SAS Enterprise GUI may leverage the SAS Base Authentication which is “PAM aware” and thus supports AD authentication leveraging Centrify. 

Actual Changes to sasauth.conf
The file to edit is the sasauth.conf file in the <InstallDir>/SASFoundation/9.2/utilities/bin/sasauth.conf
The only thing you change in there was a line that read only

 "pw"

You need to change it to:

"pam pw"

Here is the excerpt from that file
##############################################################################
# Configuration for sasauth
# (c) 2006, SAS Institute, Inc.
#
# Modify as appropriate for your site.
#
# Settings are in name=value format.
#
##############################################################################
#############################################################################
# Name: methods       Authentication used.
#                     At least one must be specified. Separate multiple entries
#                     with spaces.
#                     Authentication is performed in the order
#                     specified, from left to right.
#                     Each method is attempted until one is
#                     found that has the user identity
#                     (even if the password is not valid).
# Values:
#
#   pw - Use standard /etc/passwd - /etc/shadow authentication.
#        On some hosts, this also includes protected password databases
#        or OS-provided enhanced security.
#
#   pam - Use PAM for authentication. The password database is also
#         used to determine the user's UID and GID.
#         pam.conf must be configured properly for sasauth. Refer to
#         "SAS(R) 9.2 Companion for UNIX Environments" for more information.
#
#   ldap - Use LDAP authentication. Be sure to define the LDAP
#          parameters below.
#
#   ext - Use a custom authentication mechanism. This mechanism is built
#         using the authentication kit, available from SAS Technical Support.
##############################################################################

methods=pam pw


After these changes, please restart SAS and attempt authentication.  If issue persists please contact the vendor SAS for further assistance including ensuring SAS is properly configured for PAM.

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.