Client Authentication Using an Authinfo File

• Introduction
• Create an Authinfo File
  • Linux
• Authinfo File Format
  • About the Authinfo File Format
  • Single User ID and Password
  • Different Credentials for Different Hosts
  • Different Credentials for Different Servers or Spawners on the Same Host
  • Same Credentials with Few Exceptions
  • Encode Passwords
• Authinfo File Location Precedence
• See Also

Introduction

Some SAS servers and spawners require client authentication in the form of a user ID and password. Often these credentials are embedded in a SAS program. When password information is not available, an attempt is made to find an authinfo file. An authinfo file contains credentials that can include one or more user IDs, passwords, host names, and port numbers to authenticate to multiple servers and spawners. It is an alternative to including passwords in programs.

You can use an authinfo file to sign on to SAS servers and spawners without having to specify credentials elsewhere.

SAS allows the authinfo file to be located somewhere other than in the default location. The path to the authinfo file can be specified by one of the following language elements:

• AUTHINFO= option in the CAS statement
• AUTHINFO = system option
• NETRC environment variable

The order of precedence can differ for SAS products and is documented with each product.

Create an Authinfo File

Linux

In your home directory, create a file named .authinfo. For example, in command-line mode:

touch ~/.authinfo

The file must have Read and Write permissions only for the owner. Use chmod to change the permissions:

chmod 600 ~/.authinfo

When you list the file, the permissions should look like the following:

-rw------- 

Authinfo File Format

About the Authinfo File Format

The format of an authinfo file is based on the .netrc file specification that is used for FTP login. In addition to the .netrc file standards, the authinfo specification allows for putting commands in the file, as well as using quoted strings for passwords. The quoted strings allow for spaces within passwords and user IDs.

You must explicitly specify a user ID and password in the authinfo file. You can also explicitly specify a host and a port number. However, if a host is explicitly specified, the credentials are used only for connections to that host. If a port is explicitly specified, the credentials are used only for connections to that port. If DEFAULT is specified in the place of a host and a port, the credentials are used for any host and port combination.

You can create a single authinfo file that includes the credentials to connect to any number of servers or spawners in your environment.

Single User ID and Password

If you have a single user ID and password that you use to authenticate to all servers and spawners, you need only a single entry in your authinfo file:

default user your-userid password your-password

Different Credentials for Different Hosts

If you have different user IDs and passwords for different hosts, but all servers on any one host have the same user ID and password, specify each user ID and password for each host in the authinfo file:

host hostname1 user your-userid1 password your-password1
host hostname2 user your-userid2 password your-password2

Different Credentials for Different Servers or Spawners on the Same Host

If you need to specify different user IDs and passwords for different servers or spawners on the same host, add a port specification in the authinfo file:

host hostname port port1 user your-userid1 password your-password1
host hostname port port2 user your-userid2 password your-password2 

Same Credentials with Few Exceptions

If you use the same user ID and password for most servers and spawners with a few exceptions, specify the exceptions first (with host and port or just host) and the default common user ID and password last in the file:

host hostname port port1 user your-userid1 password your-password1
host hostname user your-userid2 password your-password2
default user your-userid password your-password

Encode Passwords

You can also use PROC PWENCODE to encode the password. For example,

proc pwencode in='your-password' method=sas004;  
run;

where sas004 is the encoding method.

Copy the resulting encoded password into the authinfo file so that it looks similar to the following:

default user your-userid password {SAS004}11EF1B08B31C406FEF5D3B00A0354302DE1F1F5D84181C93 

For more information, see PWENCODE Procedure in Base SAS Procedures Guide.

Authinfo File Location Precedence

If a SAS product uses an authinfo file, it does so based on the following precedence:

1. Product-specific options.
2. The AUTHINFO= SAS system option.
3. The AUTHINFO environment variable.
4. The NETRC environment variable.
5. The default location of the authinfo file.

See Also

For more information, see the following resources:

• NETRC — Linux Man Page
• AUTHINFO= System Option in SAS System Options: Reference
• CAS Statement in SAS Cloud Analytic Services: User’s Guide
• USER=user-ID in SAS Cloud Analytic Services: User’s Guide