In SAS Viya, the following error might occur for selected users when they run a job using the Run As feature in Jobs and Flows:

Failed to obtain a valid credential. Contact your system administrator to check the status of the credential in the domain. path: /scheduler/jobs

As a result, the following conditions might occur:

• The same job runs successfully when Run As is cleared.
• The configured service account works for one user but fails for other users.
• The error occurs immediately before the job begins to execute.
• The same configuration works in another environment.
• The service account is visible in SAS Viya.
• The service account is a member of the required service-account group.
• The affected users are members of a custom group that is intended to authorize use of the account.
• The credential domain and OAuth configuration exist.
• Reloading the identities cache does not resolve the condition.

This issue occurs in SAS^® Viya^® LTS 2026.03. The diagnostic approach outlined in this SAS KB article might be useful for other SAS Viya releases that provide the Jobs and Flows Run As functionality, but you must review the applicable product documentation for the deployed release.

Cause

The exact cause of this issue can vary. As a result, you must determine the cause from the identities, group-membership, credential, domain, authorization, and scheduling configuration.

A working service account does not, by itself, confirm that every user is authorized to retrieve and use the credential. Compare a user who can successfully use Run As with a user who receives the error.

You can identify the source case from the following configuration areas for investigation:

• identities and group membership
• the service account
• the custom group that authorizes access
• the credential domain
• the stored credential
• authorization rules
• the scheduler
• job execution
• job flow execution

See SAS KB0036450 for information about troubleshooting the SAS Viya identities service and group membership.

Workaround

Method 1: Compare a Working User With an Affected User

Compare with a user who can successfully select the service account and run the job as the comparison.

Verify the following for both the working and affected users:

• Confirm that both users are visible in SAS Viya.
• Confirm the exact user identifier that SAS Viya receives from the identity provider.
• Confirm that both users are members of the intended custom group.
• Confirm that the group membership is visible through SAS Viya.
• Compare the effective group membership of the working user with the affected user.
• Identify any difference in identity-provider attributes, nested groups, or authorization assignments.
• Reload the SAS Viya identities cache after correcting identity or group membership.
• Retest Run As with the affected user.

Method 2: Verify the Service Account and Credential Domain

Verify the following configuration:

• Confirm that the service account is visible in SAS Viya.
• Confirm that the service account is included in the required service-account group for scheduling.
• Confirm that the credential domain exists.
• Confirm that the domain name matches the domain identified in the error.
• Confirm that the credential is stored for the intended service account.
• Confirm that the credential is valid.
• Confirm that the authorization rules allow the intended users or custom group to use the credential.
• Compare these settings with a working environment, if one is available.

Note: Do not include service-account passwords, secrets, tokens, or other credential values in a SAS Technical Support case.

Method 3: Determine Whether the Failure is Specific to Run As

Complete the following steps:

1. Run the same job as the affected user without selecting Run As.
2. Record whether the job starts successfully.
3. Run the same job with Run As.
4. Record the exact time that the error occurs.
5. Confirm whether the failure occurs before the job begins to execute.
6. Test the same service account with a known working user.
7. Record the results of each test.

If the job runs without Run As but fails before execution when Run As is selected, focus the investigation on credential retrieval, group membership, domain configuration, and authorization rather than on the SAS program executed by the job.

Method 4: Collect Diagnostic Information

Collect logs from the failure time for the services involved in the following:

• identities
• credentials
• authorization
• scheduling
• job execution
• job flow execution

Also, collect the current SAS Viya diagnostic information by using the latest SAS Technical Support get-k8s-info utility.

See SAS KB0038941, "SAS^® Viya^® for Kubernetes Diagnostic Documentation" for additional information.

Provide the following information with the logs:

• the exact SAS Viya version
• the exact error text
• failure time and time zone
• affected user identifier
• working user identifier
• service-account name
• credential-domain name
• results with and without Run As
• whether identities cache reload was completed
• whether the same configuration works in another environment

Additional Resources

Review the following SAS KB articles:

• SAS KB0036450, "Troubleshooting identities and the identities service in SAS Viya"
• SAS KB0038941, "SAS Viya for Kubernetes Diagnostic Documentation"