Installation Instructions for Hot Fix F1E007

z/OS 64-bit


Hot fix F1E007 addresses the issue(s) in Base SAS 9.4_M6 as documented in the Issue(s) Addressed section of the hot fix download page:

https://tshf.sas.com/techsup/download/hotfix/HF2/D9T.html#F1E007


F1E007 is a "container" hot fix that contains the following "member" hot fixes which will update the software components as needed.

D9T018  updates  Base SAS 9.4_M6
D9T068  updates  Base SAS 9.4_M6
F1D003  updates  Base SAS User Interface 9.4_M6

See What is a container hot fix? in the Hot Fix FAQ for more information about container hot fixes.


Before applying this hot fix, follow the instructions in SAS Note 35968 to generate a SAS Deployment Registry report, then verify that the appropriate product releases are installed on your system. The release number information in the Registry report should match the 'member' release number information provided above for the software components installed on each machine in your deployment.

The hot fix downloaded, F1E007z6.zip, includes the updates required for all components listed above on all applicable operating systems. To apply this hot fix on multiple machines, you can either save F1E007z6.zip on each machine or save it in a network location that is accessible to all machines.

Do NOT extract the contents of F1E007z6.zip. The hot fix installation process will extract the contents as needed.


IMPORTANT NOTES

  1. Files delivered in this hot fix will be backed up during the installation process. However, it is good general practice to back up your system before applying updates to software.

  2. You must have Administrator Privileges on your CLIENT or SERVER machine.

  3. All currently active SAS sessions, daemons, spawners and servers must be terminated before applying this hot fix.

  4. This hot fix should be installed using the same userid who performed the initial software installation.

  5. CONFIGURATION: No automatic configuration scripting is included for this hot fix. If you have previously configured software installed, the SAS Deployment Manager may present a screen where you will see "Apply SAS Hot Fixes" and "Configure SAS Hot Fixes" options. On this screen, you must ensure that the "Configure SAS Hot Fix" option is *not* selected. If this option is automatically selected, please de-select it prior to proceeding with the SAS Deployment Manager Screens. Failure to do so could have unintended consequences when applying this hot fix.


INSTALLATION

Hot Fix F1E007 must be installed on each machine where the updated components of the product, listed above, are installed. During the installation process you may see references to all operating systems for which updates are provided in the hot fix. The installation process will determine the operating system and which component(s) of Base SAS 9.4_M6 require updating on the machine. See SAS Note 44810 for more details.

The hot fix will be applied using the SAS Deployment Manager. By default, the SAS Deployment Manager will search in the <SASHOME>/InstallMisc/HotFixes/New directory for hot fixes to be applied, but will also prompt for a location if you have downloaded hot fixes to a different directory.

After downloading F1E007z6.zip, follow the instructions for applying hot fixes in the SAS Deployment Wizard and SAS Deployment Manager 9.4: User's Guide.

Please review the CONFIGURATION Important Note above concerning proper selection of the "Configure SAS Hot Fix" option in the SAS Deployment Manager.


The hot fix installation process generates the log file

<!SASHOME>/InstallMisc/InstallLogs/IT_date-and-time-stamp.log
for example, IT_2011-10-31-13.18.21.log. Each attempt to apply a hot fix results in the creation of a new log file giving detailed information regarding the installation process.

Postexec log files are created after the installation is completed and identifies the files that were added, backed up, changed and removed. These log files include the 'member' hot fix id in the name of the file and are also written to the <!SASHOME>/InstallMisc/InstallLogs directory. There is one postexec log for each 'member' hot fix applied (member hot fixes are listed at the top of these instructions).


The content of this hot fix is listed in the hot fix manifest.


POST-INSTALLATION INSTRUCTIONS

Supported Systems and requirements
This hotfix and instructions apply to Linux only.

MIT Kerberos 1.11.6 or later is required. If the operating system does not provide a supported version, the source code can be downloaded from https://web.mit.edu/kerberos/dist/index.html.
This will require building the source code and installing the new libraries. Build and install instructions can be found under the "Documentation" link on the release page for the chosen version.
Heimdal and Quest are currently not supported.

Prerequisites
Prior to enabling Kerberos Constrained Delegation, SAS servers and spawners must first be configured for Kerberos (Integrated Windows Authentication). Instructions can be found in the SASŪ 9.4 Intelligence Platform: Security Administration Guide, Third Edition.:
https://go.documentation.sas.com/api/docsets/bisecag/9.4/content/bisecag.pdf

To fully enforce constrained delegation, additional configuration steps are required in Active Directory. This must be completed by a Domain Administrator with the "Active Directory Users and Computers" tool. Each Kerberos protected resource (e.g., Microsoft SQL Server) that a SAS Workspace Server can connect to must be defined against the account being configured for constrained delegation. If the SAS Object Spawner is running under the "Local System" account, then the services are defined under the Computer Object for the SAS Object Spawner Server. If the SAS Object Spawner is running under a Domain Account, then the services are defined under this account. In the Delegation tab of the account properties in "Active Directory Users and Computers", select "Trust this computer for delegation to specified services only" and "Use any authentication protocol", then add each service the SAS Workspace Server can connect to.

Post Installation Instructions
Installation of this hotfix does not enable constrained delegation support in SAS by default. After installing the hot fix, complete the steps here to enable constrained delegation support in SAS.
  1. The SAS_CONSTRAINED_DELEG_ENABLED environment variable must be set to "1" in <SASCONFIG>/Lev#/level_env_usermods.sh. If SAS Workload Orchestrator is installed, then also set SAS_CONSTRAINED_DELEG_ENABLED in <SASCONFIG>/Lev#/Grid/sgmg_usermods.sh on all grid worker nodes. 
    SAS_CONSTRAINED_DELEG_ENABLED=1
export SAS_CONSTRAINED_DELEG_ENABLED

  2. Setting the Service Principal Name (SPN) Environment Variable
    1. If using the default SPN and a SPN based keytab, then no additional steps are required. The default SPN for SAS Server-tier services is SAS/<FQDN of host>. FQDN is the fully qualified domain name of the host. The default SPN for SAS Workload Orchestrator is HTTP/<FQDN of host>.

    2. If using a non-default SPN and a SPN based keytab is used, then the SAS_SERVICE_PRINCIPAL environment variable must be set to the desired SPN. For SAS Servers, this should be set in <SASCONFIG>/Lev#/level_env_usermods.sh. If SAS Workload Orchestrator is installed, then the environment variable must also be set in <SASCONFIG>/Lev#/Grid/sgmg_usermods.sh. For example, 
      SAS_SERVICE_PRINCIPAL=MYSAS/my_sas_server.com
export SAS_SERVICE_PRINCIPAL
    3. If using User Principal Name (UPN) based keytab files, the SAS_SERVICE_PRINCIPAL environment variable must be set to the user/service account that matches the UPN. For SAS Servers, this should be set in <SASCONFIG>/Lev#/level_env_usermods.sh. If SAS Workload Orchestrator is installed, then the environment variable must also be set in <SASCONFIG>/Lev#/Grid/sgmg_usermods.sh on all grid worker nodes. For example, 
      SAS_SERVICE_PRINCIPAL=sas-services@REALM.COM
export SAS_SERVICE_PRINCIPAL

  3. Restart the SAS spawners and servers. 
    <SASCONFIG>/Lev#/sas.servers restart


This completes the installation of hot fix F1E007 on z/OS 64-bit.


Copyright 2019 SAS Institute Inc. All Rights Reserved.