Scheduled SAS Enterprise Guide projects that connect to a SAS Viya server through the Windows Task Scheduler should succeed as long as the scheduler’s user ID contains a valid refresh token. By default, a SAS Viya refresh token is valid for 14 days; though, you can change this duration using the SAS Viya oauth2.client.refreshTokenValidity configuration property.

When the refresh token expires, scheduled jobs fail because SAS Enterprise Guide can no longer authenticate to SAS Viya.

To obtain a new refresh token, the Windows Task Scheduler user must complete the following steps:

1. Log on to SAS Enterprise Guide.
2. Connect to the SAS Viya server.
3. Close SAS Enterprise Guide.
   
   Note: Users must complete these steps on the same Windows machine that runs the scheduled tasks and must be completed as the same user who runs the scheduled tasks.

Once renewed, the refresh token remains valid for the number of days that oauth2.client.refreshTokenValidity defined. Scheduled jobs run successfully during that period. However, this process is manual and requires periodic user intervention.

Automated Token Renewal via Hot Fix

A hot fix is available that enables non‑interactive, automated refresh‑token renewal. With this enhancement, the scheduler user’s refresh token can be updated automatically without requiring a manual login.

This method is intended for users who want to authenticate once and avoid repeated logins. To use this method, you must define a custom EG OAuth client (with a client_secret) and configure SAS Enterprise Guide to use the client. The instructions below describe how to create this client and how connect SAS Enterprise Guide to SAS Viya using the client.

Create a Custom EG OAuth Client

You must define a custom OAuth client that includes a client_secret, which allows SAS Enterprise Guide to silently refresh tokens without user interaction.

1. Complete the instructions in the Register a Custom Application Manually section (steps 1 and 2) of the SAS Viya Platform documentation.

Note: Use an account that is a member of the SASAdministrators group.

These steps produce a BEARER_TOKEN that you will use to register the custom client.

2. Define a custom SAS Enterprise Guide client (with client_secret).

Here is an example cURL command:

curl -k -X POST "${INGRESS_URL}/SASLogon/oauth/clients" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $BEARER_TOKEN" \
     -d '{
         "client_id": "<your-client_id>",
         "scope": ["openid", "*", "uaa.user"],
         "client_secret": "<your-client_secret>",
         "autoapprove": "true",
         "redirect_uri": ["urn:ietf:wg:oauth:2.0:oob"],
         "authorities": ["uaa.none"],
         "authorized_grant_types": [
             "authorization_code",
             "refresh_token",
             "urn:ietf:params:oauth:grant-type:jwt-bearer"
         ]
     }'

This command registers a new OAuth client that SAS Enterprise Guide uses for automated refresh-token renewal.

Configure SAS Enterprise Guide to Use the Custom Client

Note: You must complete the steps in this section on the Windows machine that runs the scheduled tasks. 

3. Connect SAS Enterprise Guide to SAS Viya using the custom client.

1. 1. Launch SAS Enterprise Guide
   2. If you already have an active SAS Viya connection, sign out: click the Servers pane ► right‑click your server ► Sign Out.
   3. From the menu, select Tools ► Connections. 
   4. In the Servers pane, select your SAS Viya server and choose Modify or select Add to define a new connection.
   5. Select Advanced.
      
      
      
   6. Enter the client ID and client secret that you created in step 2.
      
      
      
   7. Restart SAS Enterprise Guide.
   8. In the Servers pane, right-click your SAS Viya server ► Sign In.
   9. A browser tab is displayed with SASLogon. Enter your credentials.
   10. SASLogon displays an Authorization code. Copy and paste the code into the Authenticate with SAS Viya dialog box in SAS Enterprise Guide.
       
       At this point, SAS Enterprise Guide stored the following:
       • the refresh token
       • the client ID
       • the client secret

These steps enable automated refresh-token renewal.

Automatic Token Renewal Behavior

SAS Enterprise Guide evaluates the remaining lifetime of the refresh token each time that a scheduled job runs. The Viya_UpdateTokenIfExpiresWithinSeconds configuration setting controls when SAS Enterprise Guide should automatically obtain a new refresh token.

• Default Behavior: If you do not specify a value, SAS Enterprise Guide uses a built‑in default of 604,800 seconds (seven days).
• Purpose: This value represents the number of seconds that remain on the current refresh token before SAS Enterprise Guide decides that it should obtain a new one.

If you want to override the default behavior, you must add the Viya_UpdateTokenIfExpiresWithinSeconds configuration option to the seguide.exe.config file located in the SAS Enterprise Guide installation directory. The default path is C:\Program Files\SASHome\SASEnterpriseGuide\8.

Here is an example configuration snippet. (This example steps the value to one day—that is, 86,400 seconds.)

<Environment>
  <Variables>
    <add name="EGTMP" value="c:\aatemp\egtemp" />
    <add name="TEMP" value="c:\aatemp\temp" />
    <add name="TMP" value="c:\aatemp\tmp" />
  </Variables>
</Environment>
-->
<!-- Example application settings -->
<appSettings>
  <add key="Viya_UpdateTokenIfExpiresWithinSeconds" value="86400" />
</appSettings>
</configuration>

When a scheduled job runs and the remaining token lifetime is within this threshold, SAS Enterprise Guide automatically retrieves a new refresh token. This refresh token is valid for the full duration that oauth2.client.refreshTokenValidity defines.

If you want SAS Enterprise Guide to obtain a new refresh token every time that a scheduled job runs, set Viya_UpdateTokenIfExpiresWithinSeconds to a value equal to or greater than the refresh‑token validity period.

Note: Setting Viya_UpdateTokenIfExpiresWithinSeconds to 0 disables automatic refresh‑token renewal.