Basic authentication and anonymous access does not work as expected in the SAS® Stored Process Web Application


Basic authentication and anonymous access (guest) are documented for the SAS Stored Process Web Application at Authentication in the SAS Stored Process Web Application

In SAS® 9.4M8 (TS1M8) and SAS® 9.4M9 (TS1M9), this feature does not work properly and redirects to SAS Logon Manager.

This problem occurs due to an issue with configuration; SAS Logon Manager does not receive the correct credentials.

Workaround

To work around this issue, complete the following steps:

  1. Back-up and modify <SASConfig>\Lev1\Web\WebAppServer\SASServer1_1\sas_webapps\sas.storedprocess.war\WEB-INF\spring-config\infrastructure-config.xml.

  2. For basic authentication, add the following to <sas-sso:http>:
    <sas-sso:http-basic pattern=".*$" request-matcher="regex" />

  3. For anonymous access or guest authentication, add the following to <sas-sso:http>:
    <sas-sso:allow-guest path="/guest"/>  

The configuration for both items looks similar to the following:

<sas-sso:http stateless="true">
  <sas-sso:accept-direct-credentials path="/*" />     
  <sas-sso:allow-guest path="/guest"/>      
  <sas-sso:http-basic pattern=".*$" request-matcher="regex" />
</sas-sso:http> 

Note: You might need to reapply these changes after applying a hot fix or after rebuilding and redeploying the SAS Stored Process Web Application.