14545 - Avoiding the user authentication window when submitting requests to the SAS® Stored Process Server

Usage Note 14545: Avoiding the user authentication window when submitting requests to the SAS® Stored Process Server

When submitting requests to the SAS^® Stored Process Server via the Web interface, users are prompted to provide a valid user name and password for authentication. However, in some situations you might want to permit users to avoid the user authentication window when submitting a request.

Use one of the following methods to avoid the StoredProcessServlet user authentication window from appearing.

Method 1:

As an alternative to using the host operating system accounts to authenticate users, you can configure trusted Web authentication. For more information, consult the "Changing to Trusted Web Authentication" section of the documentation for "Setting Up and Managing Middle-Tier Security".

Method 2:

To bypass the authentication window for some, but not all, stored processes, you should pass the _username and _password variables in the HTML form or on the url for the stored process (depending on how you are submitting it). If you use this approach, you can encode your password by using PROC PWENCODE. For example, if your password is "mypass", the PROC PWENCODE would be:

proc pwencode in="mypass";
run;

The encoded value for "mypass" is "{sas001}bX1wYXNz".

Here is an example of passing "_username=" and "_password=" in the url:

http://your.server:8080/SASStoredProcess/do?
_program=/yourfolder/your+stored+process&_username=sasdemo&_password={sas001}bX1wYXNz

If you submit your stored process using an HTML form, you can pass "_username=" and "_password=" name/value variables when you submit your request.

The following HTML file submits a request to the Stored Process Server, passing "_username" and "_password" (which is encoded). If you want to execute this HTML file on your Servlet Container, you can save it as a JSP file (for example "test.jsp").

   <HTML>
   <FORM method="POST" action="/SASStoredProcess/do">
   <INPUT TYPE="HIDDEN" NAME="_PROGRAM" VALUE="/Testlib/test1">
   <INPUT type="HIDDEN" name="_username" value="user123">
   <INPUT type="HIDDEN" name="_password" value="{sas001}bX1wYXNz">
   <INPUT TYPE="SUBMIT" VALUE="Submit">
   </FORM>
   </HTML>

Here is another example HTML file. It automatically redirects the request to the SAS Stored Process Server. This helps minimize exposure of the username and encoded password.

 <HTML>
 <BODY onLoad="document.sub.submit()">
 <FORM name="sub" method="POST" action="/SASStoredProcess/do">
 <INPUT TYPE="HIDDEN" NAME="_PROGRAM" VALUE="/Testlib/test1">
 <INPUT type="HIDDEN" name="_username" value="user123">
 <INPUT type="HIDDEN" name="_password" value="{sas001}bX1wYXNz">
 </FORM>
 </HTML>

If you pass "_username" and "_password" when executing some stored processes, then it is a good idea to tighten security on other Stored Processes for which you want to require a user name and password be entered via the authentication window. For example, for these other stored processes set "ReadMetadata" permissions to "Deny" for the PUBLIC group. Then, only users that are a member of another group (that has "ReadMetadata" permissions for the stored process) will be permitted to execute the stored processes.

Method 3:

If you want to specify a user ID to authenticate for all stored processes executed by the SASStoredProcess servlet, you can add "_username=" and "_password=" request values to the params.config file for the Stored Process Web Application. The password should be encoded as described above. The default _username setting must be commented out. For example:

   #  COMMENT OUT Authenticated user name
   #_username=$servlet.user.name

   #  set _username and _password to avoid authentication prompt
   _username=sasdemo
   _password={sas001}bX1wYXNz

For information about the params.config file consult the SAS Stored Process Web Application Configuration section of the documentation for SAS 9.1.3 Integration Technologies Developer's Guide.

Operating System and Release Information

Product Family	Product	System	SAS Release
Product Family	Product	System	Reported	Fixed*
SAS System	SAS Integration Technologies	Microsoft Windows XP Professional	9.1 TS1M3
		Microsoft Windows NT Workstation	9.1 TS1M3
		Microsoft Windows Server 2003 Standard Edition	9.1 TS1M3
		Microsoft® Windows® for 64-Bit Itanium-based Systems	9.1 TS1M3
		Microsoft Windows Server 2003 Enterprise Edition	9.1 TS1M3
		Microsoft Windows 2000 Datacenter Server	9.1 TS1M3
		Microsoft Windows 2000 Professional	9.1 TS1M3
		Microsoft Windows Server 2003 Datacenter Edition	9.1 TS1M3
		Microsoft Windows 2000 Server	9.1 TS1M3
		Microsoft Windows 2000 Advanced Server	9.1 TS1M3
		64-bit Enabled Solaris	9.1 TS1M3
		64-bit Enabled HP-UX	9.1 TS1M3
		z/OS	9.1 TS1M3
		HP-UX IPF	9.1 TS1M3
		OpenVMS Alpha	9.1 TS1M3
		64-bit Enabled AIX	9.1 TS1M3
		Tru64 UNIX	9.1 TS1M3

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

Type:	Usage Note
Priority:
Topic:	System Administration ==> Servers ==> Integration Technologies

Date Modified:	2006-11-29 11:47:19
Date Created:	2005-02-09 09:42:35

Support

Usage Note 14545: Avoiding the user authentication window when submitting requests to the SAS® Stored Process Server

Method 1:

Method 2:

Method 3:

Operating System and Release Information