Versions that precede 7.15 for both SAS Enterprise Guide and SAS Add-In for Microsoft Office store user credentials for SAS^® Metadata Server on disk by using sas002 encoding. This encoding is considered secure based on file system permissions, because the password is stored in the application data area for the user. Only an administrator or the user can access that location. Also, the passwords have sas002 encoding and are not in plaintext.

After receiving requests to encrypt the passwords that are stored in the ConfigurationVxx.xml file (found in the %appdata%\SAS\MetadataServerProfiles directory), SAS released new encryption functionality. That functionality is provided in SAS Enterprise Guide 7.15 Hot Fix 6 and SAS Add-In for Microsoft Office 7.15 Hot Fix 4. The next major releases of SAS Enterprise Guide and SAS Add-In for Microsoft Office also provide this functionality.

Behavior that can occur when both applications are not updated

When an older release of either SAS Enterprise Guide or SAS Add-In for Microsoft Office is installed on the same machine where a recently updated version of the other application is used, a user needs to reenter credentials when navigating between the different applications. The passwords that are stored in the ConfigurationVxx.xml file are being changed from the sas002 encoding to the new encrypted string and vice versa. In effect, the user receives additional credentials prompts.

Workaround

To prevent the additional credentials prompts, both applications should be updated to at least SAS Enterprise Guide 7.15 Hot Fix 6 and SAS Add-In for Microsoft Office 7.15 Hot Fix 4. After those updates are applied, the ConfigurationVxx.xml file contains only the new encrypted passwords.

Operating System and Release Information

A fix for this issue for SAS Enterprise Guide 7.15 is available at:

A fix for this issue for SAS Add-in for Microsoft Office 7.15 is available at:

A fix for this issue for SAS Visual Analytics Add-In for Office 7.15 is available at: