SUPPORT

Select Your Region

Visit the Cary, NC, US corporate headquarters site

Americas

Europe

Middle East & Africa

Asia Pacific

View our worldwide contacts list for help finding your region

Americas

Europe

Middle East & Africa

Asia Pacific

Sign In

Get access to My SAS, trials, communities and more.

Sign Out

Get access to My SAS, trials, communities and more.

SAS Sites

sas.com
Support
Blogs
Communities
Developer
Curiosity
Videos

Documentation

Learn
Brand
PartnerNet
Merchandise
SUPPORT / SAMPLES & SAS NOTES
 

Support

Problem Note 62467: Valid user credentials are occasionally rejected by SAS® Metadata Server when you use direct LDAP authentication

DetailsHotfixAboutRate It

In SAS® 9.4 TS1M3 and earlier, you might experience an issue in which valid user credentials are occasionally rejected by SAS Metadata Server when you use direct LDAP authentication. This SAS Note provides details about the issue for different releases of SAS.

SAS® 9.4 TS1M3 and Earlier

In SAS 9.4 TS1M3 and earlier, SAS Metadata Server might occasionally reject connections from a valid user. When authentication fails, a message like the following appears in the metadata server log:

WARN  [00001234] :sas - New client connection (15) rejected from server port 8561 for user sasdemo.

This issue occurs under the following conditions:

  • SAS Metadata Server is configured for direct LDAP authentication.
  • The LDAP provider returns multiple distinguished names (DNs) for the user.

This problem occurs because SAS Metadata Server uses the first DN that is returned by LDAP. Because LDAP result-set ordering is not guaranteed (sorting must be supported and enabled on the LDAP server), the first result that is returned could be different each time. The DN that is returned might not authenticate successfully with the user credentials. 

SAS® 9.4TS1M4 and Later

SAS 9.4TS1M4 and later releases include a change in behavior so that direct LDAP authentication aligns with pam_ldap. When more than one DN is returned for a user, the connection is rejected. In this scenario, SAS Metadata Server returns messages like the following to the metadata server log:

WARN  [00001234] :sas - Denying access because multiple DNs were found for authenticating user
WARN  [00001234] :sas - New client connection (15) rejected from server port 8561 for user sasdemo.

Click the Hot Fix tab in this note to access the hot fix for this issue.

When you install the hot fix, a new feature is introduced that enables you to configure your environment so that the SAS Metadata Server allows more than one DN for a user. This feature enables you to specify the same behavior as in SAS 9.4 TS1M3 and earlier.

Post-Installation Instructions

After you install the hot fix, SAS Metadata Server recognizes the SAS_ALLOW_MULTIPLE_DN_ENTRIES environment variable, which you must configure for your environment. Regardless of the value that you set for this environment variable, SAS Metadata Server allows more than one DN for a user. The first DN in the LDAP result set is used for authentication. This behavior is the same behavior as in SAS 9.4 TS1M3 and earlier.

To create the SAS_ALLOW_MULTIPLE_DN_ENTRIES environment variable under UNIX, locate the level_env_usermods.sh file that is in your equivalent of SAS/Config/Lev1 and add the setting as follows on the line after CONTEXT_USERMODS_OPTIONS=:

SAS_ALLOW_MULTIPLE_DN_ENTRIES=any_value
export SAS_ALLOW_MULTIPLE_DN_ENTRIES  

To create the SAS_ALLOW_MULTIPLE_DN_ENTRIES environment variable under Windows, follow these steps:

  1. Select Start ► Control Panel and click System. Then, click Advanced system settings on the left.
  2. In the System Properties dialog box, click the Advanced tab.
  3. Click Environment Variables.
  4. In the System variables section, click New.
  5. In the Variable name field, enter SAS_ALLOW_MULTIPLE_DN_ENTRIES.
  6. In the Variable value field, enter any_value.

Important Note: The section “How to Configure Direct LDAP Authentication” in SAS® 9.4 Intelligence Platform: Security Administration Guide instructs you to add environment variables that describe your LDAP or Active Directory provider in the sasv9_usermods.cfg file that is in your equivalent of SAS/Config/Lev1/SASMeta/MetadataServer. This location is not correct for setting the SAS_ALLOW_MULTIPLE_DN_ENTRIES environment variable.

Refer to “Configuration Files for Components of SAS Application Servers” in SAS® 9.4 Intelligence Platform: System Administration Guide for more information about setting environment variables.



Operating System and Release Information

Product FamilyProductSystemProduct ReleaseSAS Release
ReportedFixed*ReportedFixed*
SAS SystemSAS Metadata ServerSolaris for x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Linux for x649.4_M49.4_M49.4 TS1M49.4 TS1M4
HP-UX IPF9.4_M49.4_M49.4 TS1M49.4 TS1M4
64-bit Enabled Solaris9.4_M49.4_M49.4 TS1M49.4 TS1M4
64-bit Enabled AIX9.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Home Premium 32 bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Enterprise x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Enterprise 32 bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8.1 Enterprise 32-bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Ultimate x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Ultimate 32 bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Professional x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Professional 32 bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Windows 7 Home Premium x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2012 Std9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2012 R2 Std9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2012 R2 Datacenter9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2012 Datacenter9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2008 for x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 2008 R29.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows Server 20089.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 109.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8.1 Pro x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8.1 Pro 32-bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8.1 Enterprise x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8 Pro x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8 Pro 32-bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8 Enterprise x649.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft Windows 8 Enterprise 32-bit9.4_M49.4_M49.4 TS1M49.4 TS1M4
Microsoft® Windows® for x649.4_M49.4_M49.4 TS1M49.4 TS1M4
* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.