To debug login issues when using Integrated Windows Authentication (IWA) to log on to the referenced SAS Java clients, you need to add the following two entries to enable the IWA debug logging for these clients. 

• JavaArgs_#=-Dsun.security.krb5.debug=true
• JavaArgs_#=-Dsun.security.jgss.debug=true

To add these arguments, complete the following steps:

1. Add the arguments to the *.ini file for each client:

• For SAS^® Enterprise Miner^™ Client, add the entries to the <SASHOME>\SASEnterpriseMinerClient\x.y\em.ini file, where x.y is replaced with the version of SAS Enterprise Miner Client being used (that is, 15.3).
• For SAS^® Forecast Studio, add the entries to the <SASHOME>\SASForecastStudio\x.y\forecaststdo.ini file, where x.y is replaced with the version of SAS Forecast Studio being used (that is, 15.3). 
• For SAS^® Forecast Project Manager, add the entries to the <SASHOME>\SASForecastProjectManager\x.y\forecastadm.ini file, where x.y is replaced with the version of SAS Forecast Project Manager being used (that is, 15.3). 
• For SAS^® Time Series Studio, add the entries to the <SASHOME>\SASTimeSeriesStudio\x.y\tsxclient.ini file, where x.y is replaced with the version of SAS Time Series Studio being used (that is, 15.3). 

3. Before changing the *.ini file, make a backup of the *.ini file.   

4. Add the two entries after the last JavaArgs_# used in the file. Change the numbers in the two entries so that the JavaArgs_#s are incremented based on the last JarArgs number currently used in the file.  

For example, in the SAS Enterprise Miner Client's em.ini file, the last argument used in the entries copied from an em.ini file is JavaArgs_22. Before adding the entries, the em.ini file has the following: 

JavaArgs_22=-Dsas.app.class.path=.;"D:\opt\sasinside\SASHome\SASEnterpriseMinerClient\
15.3\build"

JavaArgs_23=

Classpath=-cp "<VJRHOME>/eclipse/plugins/sas.launcher.jar"

MainClass=com.sas.analytics.eminer.visuals.Main 

After adding the two Integrated Windows Authentication entries (in bold below) to enable Integrated Windows Authentication debugging, it looks similar to the following: 

JavaArgs_22=-Dsas.app.class.path=.;"D:\opt\sasinside\SASHome\SASEnterpriseMinerClient\
15.3\build"

JavaArgs_23=-Dsun.security.krb5.debug=true
JavaArgs_24=-Dsun.security.jgss.debug=true

Classpath=-cp "<VJRHOME>/eclipse/plugins/sas.launcher.jar"

MainClass=com.sas.analytics.eminer.visuals.Main

5. Save these changes, recreate the issue, and provide the latest debug client logging to SAS Technical Support.

• The client logs are found in the %appdata%\..\local\SAS\SASDeploymentWizard directory on the system that these clients are launched from. 

a. In a Windows Command Prompt, if you run the command to change the directory to this directory (that is, cd %appdata%\..\local\SAS\SASDeploymentWizard), it takes you to the SASDeploymentWizard directory for the user that is logged on, as shown below. In this case, the user that is logged in is the sas account. 

b. In Windows File Explorer, paste the directory as shown below. Then, press the Enter key:

You will be taken to the SASDeploymentWizard directory for the user that is logged on, as shown below:

In this scenario, the sas account (which is the SAS installer account) is logged on to the Windows system.

Note: The client logs contain the following naming convention:

• • SAS Enterprise Miner Client: em*.log
  • SAS Forecast Studio: forecaststdo*.log
  • SAS Forecast Project Manager: forecastadm*.log
  • SAS Time Series Studio: tsxclient*.log