Problem Note 65638: Kerberos authentication fails for connections from SAS® 9.4 clients to CAS deployed on a Microsoft Windows platform
When you use a SAS® Cloud Analytic Services (CAS) statement to connect from a SAS 9.4 client to CAS, which is deployed on Windows, the connection fails with a Kerberos authentication error, as shown here:
Connection failed. Server returned: Kerberos authentication failed: Access denied.
Unable to connect to Cloud Analytic Services: your-host.your-domain.com on port 5570. Verify connection parameters and retry.
The following syntax is an example of the code that can introduce this error:
options set=casclientdebug=1;
options set=cas_auth_method=kerberos;
options cashost="your-host.your-domain.com" casport=5570;
cas mysess sessopts=(caslib=casuser metrics=True);
When this problem happens and you look at the cas_date_host.log file in %ProgramData%\SAS\Viya\var\log\cas\default\, you also find the error shown here:
Error in SSPI function AcceptSecurityContext. Error -2146893056 (Not enough memory is available to complete this request ).
Access denied.
Note: This problem does not occur when you create a CAS session using SAS® Studio 5.x.
A fix for this issue is planned for a future software release.
Workaround
To work around the problem, create a Windows System environment variable CASPACKAGELIST on the Windows server for SAS® Viya®.
- On the Windows server, define the Windows environment variable CASPACKAGELIST and set the value to Kerberos exactly as shown in the image below:

- Stop and restart the CAS service for the change to take effect.
- From your SAS 9.4 client, submit a CAS statement to create a session. Verify that the session is connected successfully to CAS.
An example of a successfully submitted CAS statement connection is shown here:
options set=casclientdebug=1;
options set=cas_auth_method=kerberos;
options cashost="your-host.your-domain.com" casport=5570;
cas mysess sessopts=(caslib=casuser metrics=True);
Note: The session MYSESS connected successfully to Cloud Analytic Services your-host.your-domain.com using port 5570.
The UUID is cffab52f-e9a4-457e-adb8-2e707b38c7c1. The user is user name and the active caslib is CASUSER(user name).
Operating System and Release Information
| SAS System | SAS Viya | Microsoft® Windows® for x64 | 3.4 | 3.5 | Viya | Viya |
*
For software releases that are not yet generally available, the Fixed
Release is the software release in which the problem is planned to be
fixed.
| Type: | Problem Note |
| Priority: | medium |
| Date Modified: | 2021-10-19 13:16:41 |
| Date Created: | 2020-03-02 13:29:17 |