Connect To SAS-Server via IOM_PROXY

[maxkoe]

Is your feature request related to a problem? Please describe. In our environment we provide a SAS 9.4 Plattform installation (installed on Linux) that can be connected to by users (using Windows machines) via the SAS-Clients over IOM PROXY. (In SAS EG with the proxy setting in the connection dialog, SAS DI Studio is started with setting the SAS_IOM_PROXYLIST variable)

The Connection-Port of the Proxy (8383 on a mid-tier-server) is the only port that is open, the ports of the workspace servers on the compute tier are blocked by the firewall.

Describe the solution you'd like Additional connection parameters for the IOM-Connection protocol that allow connection via an IOM proxy, similar to the option one has in the connection wizard of SAS EG. This probably includes connecting through the SAS Metadata Server instead of directly connecting to Workspace Servers.

Describe alternatives you've considered Connection via SSH is similarly not possible, as the SSH port is only open on special administrator machines. (All these ports are closed due to security enforcement)

Additional context

[tomweber-sas]

Hey, I believe you just need to have the environment variable set, in your python environment (it would pick it up from the environment it was started in, or you can set it in python), to be able to connect. I've seen this at a number of other sites, though I don't have an environment here, myself, to try it out with. Here's the doc on it. Have you tried this, and if so, are you getting an error? https://go.documentation.sas.com/doc/en/bicdc/9.4/bisecag/p0tbh3vv7cetrbn1jw6fhxb8hp9r.htm#p0cbi351cf5d36n17w2mzbb88b0b Thanks, Tom

[maxkoe]

Hello and thank you for your response,

with your remark I was actually successful (I was not adventurous enough in my trials before).

Here is what I did to get it to work:

# Create sascfg_personal.py
from saspy import autocfg
autocfg.main()

Then I changed the resulting contents to the following

SAS_config_names=["linremote"]

SAS_config_options = {
    "lock_down": True, #Our Server is actually run in Lockdown
    "verbose"  : True
    }

cpW  =  "C:\\Program Files\\SAS\\SASDeploymentManager\\9.4\\products\\deploywiz__94514__prt__xx__sp0__1\\deploywiz\\sas.svc.connection.jar"
cpW += ";C:\\Program Files\\SAS\\SASDeploymentManager\\9.4\\products\\deploywiz__94514__prt__xx__sp0__1\\deploywiz\\sas.security.sspi.jar"
cpW += ";C:\\Program Files\\SAS\\SASDeploymentManager\\9.4\\products\\deploywiz__94514__prt__xx__sp0__1\\deploywiz\\log4j.jar"
cpW += ";C:\\Program Files\\SAS\\SASDeploymentManager\\9.4\\products\\deploywiz__94514__prt__xx__sp0__1\\deploywiz\\sas.core.jar"
cpW += ";c:\\workspace\\python_runtime\\envs\\btest\\lib\\site-packages\\saspy\\java\\saspyiom.jar"

linremote = {
    "java"      : "java",
    "iomhost"   : "XXXX",                                   # Compute-Tier Host
    "iomport"   : YYYYY,                                    # Port of the WorkspaceServer
    "sspi"      : True,                                     # We have IWA / SSO enabled
    'appserver' : 'S40TestAnalyse_ANA - Workspace Server',  # Name of the Workspace Server in Metadata
    "encoding"  : "utf-8",
    "classpath" : cpW
}

import os
os.environ["PATH"] += ";C:\\Program Files\\SAS\\SASFoundation\\9.4\\core\\sasext"
os.environ["SAS_IOM_PROXYLIST"] = "https://ZZZZZ:8343" # The Proxy-Server (SAS Mid-Tier Server) -- This line is new

Afterwards the default call worked:

import saspy
sas = saspy.SASsession(cfgname='linremote')
sas

resulted in SAS Connection established. Subprocess id is 14348 and I could load datasets that are definitly only on that Remote server.

Now onto making this more accessible for our users ...

[tomweber-sas]

Hey, that's great. Glad that's all that was needed. BTW, looking at your config, you no longer need the 'classpath' at all. I was finally allowed to put those jars in the repo, so that whole classpath is internally generated by saspy. So, you should delete that from the config. Here's mention of that in the doc: https://sassoftware.github.io/saspy/install.html#attn-as-of-saspy-version-3-3-3-the-classpath-is-no-longer-required Also, good job on just adding in the environment variable in the config. That's an easy way to have it always set, I have that mentioned in number 7 in this section: https://sassoftware.github.io/saspy/troubleshooting.html#iom-specific-errors Let me know if there's anything else you need! Thanks, Tom

[maxkoe]

Hello and thanks for these tips!

Right now I am evaluating how best to provide users with a config that's best for them. As of now they are not even aware of intricacies like which machine (let alone port) their workspace server (or multiple servers) is running on.

Right now the best Idea, that I can come up with, is to create a StoredProcess that returns a json with the valid config(s) and to provide a tiny python module with a function for fetching the info and creating the appropriate config locally.