Integrated Windows
Authentication is one of the commonly used authentication service if
SAS Platform runs on Windows server. In this article let's see what
happens behind the scene when your SAS platform authenticate using
IWA.
Connection Using Integrated Windows Authentication
Let's see what
happens in each step that is shown in above image.
1. User attempts to
login in SAS client application which can be SAS Management Console
Or SAS Enterprise Guide. In the process user will provide the user ID
and password. The credential is passed to Windows.
2. Windows will
check whether the user ID and password combination is right or wrong.
It will authenticate and provides a token to SAS application (SAS EG)
if the combination correct.
3. SAS application
will send the token to Metadata Server. It doesn't send user's
password to Metadata Server, only token is sent.
4. Metadata Server
needs user id for authentication. So it sends the token to Windows
and asks for the user id that belongs to the token.
5. Windows verify
whether the token is valid or not. If valid then user id of the token
is passed to Metadata Server.
6. Metadata Server
checks whether the user id is there in Metadata Repository. If the
user id is present then he/she is sasuser else public user.
7. Metadata
repository will return the repository ACT of the user. Based on the
ACT the user level of access is determined.
8. Metadata Server
will accept request from SAS client application that attempted to
connect.
What is different from host based authentication?
You might noticed
that the last 3 steps was same as host based authentication. The
process will be always the same once Metadata Server receives user ID
to authorize. The initial steps are different, it does communication
using token for authentication.
In Integrated Windows Authentication (IWA), Metadata Server does two authentication phase:
- Verification Phase
- Identification phase
In verification phase, Metadata Server send the token recieved from SAS application to Windows Authentication. Windows Authentication does the verfication and returns user ID if the token is correct. This phase occurs only in IWA based authentication. The 4 and 5th step in above diagram is the verification phase.
In identification phase, Metadata Server will send user ID to Metadata Repository and check whether the user ID is valid or not. This phase will be common in all authentication model which we call as inbound login. The 6 and 7th step in above diagram is identification phase.
Comments
Post a Comment