Kerberos and SAS ® 9.4: A Three-Headed Solution for Authentication
Stuart J Rogers · 2013
Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography. With the release of SAS® 9.4, there are three ways Kerberos can be used with the SAS® Business Analytics Framework. Kerberos provides Integrated Windows authentication from a range of clients to a range of servers. This paper reviews how Kerberos is used with the SAS Business Analytics Framework. It explores the considerations and constraints when using Kerberos and summarizes solutions for some common issues. Once we provide a better understanding of the Kerberos authentication protocol, we examine how the SAS Business Analytics Framework can leverage Kerberos authentication. We look at the different parts of the SAS Business Analytics Framework and see how they fit into the Kerberos authentication protocol. This continues into reviewing how the support of Kerberos authentication has changed over the SAS releases from SAS® 9.2 to SAS 9.4. When examining the SAS Business Analytic Framework, we consider the server tier, middle tier, and client tier. Of specific interest within this section of the paper are those SAS client applications that do not support the use of the Kerberos authentication protocol. In addition, we review some of the constraints for using Kerberos authentication. We illustrate how the use of Kerberos is tied into the domain trust structure and show some of the prerequisites of using Kerberos. Of these prerequisites, we identify the clear importance of the Service Principal Name and how this is central to the Kerberos authentication protocol. Finally, we review some of the common issues that arise when using Kerberos and identify solutions to those error messages. Although troubleshooting Kerberos authentication issues is beyond the scope of this paper, it should be made easier by the understanding of the authentication process we present. Understanding the steps in the authentication process is the first and biggest step in being able to troubleshoot issues.