search

sassoftware / R-swat

The SAS Scripting Wrapper for Analytics Transfer (SWAT) package is the R client to SAS Cloud Analytic Services (CAS). It allows users to execute CAS actions and process the results all from R.
Other
50 stars 22 forks source link

Connecting to CAS using swat in R results to SSL error #48

Open tlkoh0727 opened 1 year ago

tlkoh0727 commented 1 year ago

Hi,

Trying to connect to CAS from R studio. But encountering SSL errors.

We installed the trustedcerts.pem from the viya server to the Trusted Root Certification Authority of the desktop. Also added System environment variable CAS_CLIENT_SSL_CA_LIST.

Below are the code and log:

library(swat) Sys.setenv(CAS_CLIENT_SSL_CA_LIST="C:/Users/41274/R and Python Enablement/trustedcerts.pem") conn_binary <- CAS('mpviyaorccs01.mbtc.mgc.local', 5570, username="", password="XXXXXXXX") [1] "ERROR: The TCP/IP negClientSSL support routine failed with error 32760 (An unexpected error has occurred. Error number is 32760.), Port 5570, Host 10.131.4.22" [1] "ERROR: Failed to connect to host 'mpviyaorccs01.mbtc.mgc.local', port 5570." Error in ans@ref : no applicable method for @ applied to an object of class "NULL" Sys.time() [1] "2023-06-22 16:43:25 CST" conn_binary <- CAS('mpviyaorccs01.mbtc.mgc.local', 5570, protocol='https', "", password="XXXXXXXX") Error in curl::curl_fetch_memory(url, handle = handle) : schannel: failed to receive handshake, SSL/TLS connection failed Sys.time() [1] "2023-06-22 16:43:29 CST" conn_rest <- CAS('mpviyaorccs01.mbtc.mgc.local', 8777, protocol='https', "", password="XXXXXXXX") Error in doTryCatch(return(expr), name, parentenv, handler) : https://mpviyaorccs01.mbtc.mgc.local:8777/cas/sessions : HTTP/1.1 401 Unauthorized Sys.time() [1] "2023-06-22 16:43:35 CST"

Appreciate any advise. Thanks

bkemper24 commented 1 year ago

I'm not yet sure what the problem is with your first attempt, still investigating.

For your second attempt, it appears you are specifying the binary port (5570), but attempting to use the http protocol. This will not work. You need to specify the http port (8777) if you are using protocol="https" ( this looks like what you did try in your third attempt )

For your third attempt, it looks like you did correct the port number for https. In this attempt, you are not getting an SSL error. The "401 Unauthorized" is actually complaining about the value you have specified for password. Since you are not specifying a username, are you trying to use an OAuth token here ? Is the token valid? or perhaps it has expired ?

Looks like you are running on Windows - is that correct ? What version of R and what version of swat are you using ?

tlkoh0727 commented 1 year ago

Hi @bkemper24

Please find below for my response:

I'm not yet sure what the problem is with your first attempt, still investigating.

For your second attempt, it appears you are specifying the binary port (5570), but attempting to use the http protocol. This will not work. You need to specify the http port (8777) if you are using protocol="https" ( this looks like what you did try in your third attempt )

tlkoh0727: For this one we also used https protocol

For your third attempt, it looks like you did correct the port number for https. In this attempt, you are not getting an SSL error. The "401 Unauthorized" is actually complaining about the value you have specified for password. Since you are not specifying a username, are you trying to use an OAuth token here ? Is the token valid? or perhaps it has expired ?

tlkoh0727: For this third attempt, we also used username and password here. we just masked it so it wont appear here.

Looks like you are running on Windows - is that correct ? What version of R and what version of swat are you using ?

tlkoh0727: Correct this is Windows while we are connecting on a CAS server in Linux. Let me get back on the exact version of R on Monday once we are back in office. But based on what I remember it is R 4.3.0. Swat version is 1.6.0

To add, is it correct that we used the trustedcerts.pem? It is the one located in the SAS Viya server /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/

bkemper24 commented 1 year ago

For your third scenario, if you are specifying a username and password then the 401 response indicates that the cas server was not able to validate the username and password you provided. You might find more information about why the server could not validate the username and password in the cas server log .

I know you can use the .pem file for the CAS_CLIENT_SSL_CA_LIST environment variable. I'm not sure about using it for the Windows Trusted Root Certification Authorities.