SAP HANA Security: Complete Tutorial
Mason Garcia
⚡ Smart Summary
SAP HANA Security protects business data from unauthorized access through authentication, authorization, user and role administration, auditing and encryption, and it applies these controls consistently across every tenant database container running on the system.
What is SAP HANA Security?
SAP HANA Security protects business-critical data from unauthorized access and keeps the system aligned with the compliance standards the company adopts.
SAP HANA supports a multitenant database, in which several databases run on a single system. Each one is a tenant database container, and every security feature below applies per container.
SAP HANA provides the following security-related features:
- User and Role Management
- Authorization
- Authentication
- Encryption of data in the Persistence Layer
- Encryption of data in the Network Layer
SAP HANA User and Role
SAP HANA user and role management configuration depends on the architecture, as described below.
3-Tier Architecture
SAP HANA can be used as a relational database in a 3-Tier Architecture.
In this architecture, the security features (authorization, authentication, encryption, and auditing) are installed on the application server layers.
The SAP application (ERP, BW, etc.) connects to the database only with the help of a technical user or database administrator (Basis person), as shown below. The end user cannot access the database or the database server directly.
2-Tier Architecture
SAP HANA Extended Application Services (SAP HANA XS) is based on a 2-Tier Architecture, in which the application server, web server and development environment are embedded in a single system, as shown below.
SAP HANA Authentication
A database user identifies who is accessing the SAP HANA database, and that identity is verified by “authentication.” SAP HANA supports many authentication methods, and Single Sign-On (SSO) integrates several of them.
SAP HANA supports the following authentication methods:
- Kerberos: It can be used in the following cases –
- Directly from a JDBC and ODBC client (SAP HANA Studio).
- When HTTP is used to access SAP HANA XS.
- User Name / Password: When the user enters their database user name and password, the SAP HANA database authenticates the user.
- Security Assertion Markup Language (SAML)
SAML can authenticate an SAP HANA user accessing the database directly through ODBC/JDBC. It maps an external identity to an internal database user, so the user logs in with the external user ID.
- SAP Logon and Assertion Tickets
The user can be authenticated by logon or assertion tickets, which are configured and issued for that purpose.
- X.509 Client Certificates
When SAP HANA XS is accessed by HTTP, client certificates signed by a trusted certification authority (CA) authenticate the user.
SAP HANA Authorization
SAP HANA Authorization is required when a user uses a client interface (JDBC, ODBC, or HTTP) to access the SAP HANA database.
Depending on the authorization provided to the user, that user can perform database operations on a database object. This authorization is called a “privilege.”
Privileges can be granted to the user directly or indirectly through roles. All privileges assigned to a user are combined as a single unit.
When a user tries to access any SAP HANA database object, the system checks authorization through user roles and directly granted privileges.
When the requested privileges are found, the system skips further checks and grants access.
SAP HANA offers the following privilege types:
| Privileges Types | Description |
|---|---|
| System Privileges | Controls normal system activity. System privileges are mainly used for –
|
| Object Privileges | Object privileges are SQL privileges used to grant authorization to read and modify database objects. To access a database object, a user needs object privileges on that object or on the schema in which the object exists. Object privileges can be granted on catalog objects (table, view, etc.) or non-catalog objects (development objects). Object privileges are as below –
|
| Analytic Privileges | Analytic privileges allow read access to the data of an SAP HANA information model (attribute view, analytic view, calculation view). This privilege is evaluated during query processing. Analytic privileges grant different users access to different parts of the data in the same information view, based on the user role. They are used in the SAP HANA database to provide row-level control over the data individual users can see in the same view. |
| Package Privileges | Package privileges authorize actions on individual packages in the SAP HANA repository. The repository and XS classic are deprecated as of SAP HANA 2.0 SPS 02, so new work uses HDI-based roles. |
| Application Privileges | Application privileges are required in SAP HANA Extended Application Services (SAP HANA XS) to access an application. Application privileges are granted and revoked through the procedures GRANT_APPLICATION_PRIVILEGE and REVOKE_APPLICATION_PRIVILEGE in the _SYS_REPO schema. |
| Privileges on User | This is an SQL privilege that a user can grant on their own user. ATTACH DEBUGGER is the only privilege that can be granted to a user in this way. |
SAP HANA User Administration and Role Management
Accessing the SAP HANA database requires a user. Depending on the security policy, there are two user types in SAP HANA.
1. Technical User (DBA User) – a user who works directly with the SAP HANA database with the necessary privileges. Normally, these users are not deleted from the database.
These users are created for administrative tasks such as creating an object and granting privileges on a database object or on the application.
The SAP HANA database system provides the following users by default as standard users:
- SYSTEM
- SYS
- _SYS_REPO
2. Database or Real User – each person who wants to work on the SAP HANA database needs a database user. A database user represents a real person who works on SAP HANA.
There are two types of database user, as compared below.
| User Type | Description | Role assigned |
|---|---|---|
| Standard User | This user can create objects in an own schema and read data in system views. A standard user is created with the “CREATE USER” statement. | The PUBLIC role is assigned for reading system views. |
| Restricted User | A restricted user has no full SQL access through an SQL console and is created with the “CREATE RESTRICTED USER” statement. If privileges are required to use an application, they are provided through a role.
|
The RESTRICTED_USER_ODBC_ACCESS or RESTRICTED_USER_JDBC_ACCESS role is required for full ODBC/JDBC functionality. |
An SAP HANA user administrator has access to the following activities:
- Create or delete a user.
- Define and create a role.
- Grant a role to the user.
- Reset a user password.
- Re-activate or de-activate a user as required.
1. Create User in SAP HANA
Only a database user with the ROLE ADMIN privilege can create users and roles in SAP HANA.
Step 1) To create a new user in SAP HANA Studio, go to the Security tab as shown below and follow these steps:
- Go to the Security node.
- Select Users (right-click) -> New User.
Step 2) A user creation screen appears, as shown below.
- Enter the user name.
- Enter a password for the user.
- These are the authentication mechanisms; by default, user name and password authentication is used.
Clicking the Deploy button shown below creates the user.
2. Define and Create Role
A role is a collection of privileges that can be granted to other users or roles. It includes privileges for database objects and applications, depending on the nature of the job.
It is the standard mechanism for granting privileges, although privileges can also be granted directly. Many standard roles (for example MODELLING and MONITORING) ship with the SAP HANA database.
A standard role can be used as a template for creating a custom role.
A role can contain the following privileges:
- System privileges for administrative and development tasks (CATALOG READ, AUDIT ADMIN, etc.)
- Object privileges for database objects (SELECT, INSERT, DELETE, etc.)
- Analytic privileges for an SAP HANA information view
- Package privileges on repository packages (REPO.READ, REPO.EDIT_NATIVE_OBJECTS, etc.)
- Application privileges for SAP HANA XS applications
- Privileges on the user (for debugging a procedure)
Role Creation
Step 1) Use the Security node as shown below.
- Go to the Security node in the SAP HANA system.
- Select the Role node (right-click) and select New Role.
Step 2) A role creation screen is displayed, as shown below.
- Give the role a name under the New Role block.
- Select the Granted Roles tab, and click the “+” icon to add a standard or existing role.
- Select the desired role (for example MODELLING or MONITORING).
Step 3) Confirm the assignment as shown below.
- The selected role is added in the Granted Roles tab.
- Privileges can be assigned directly by selecting System Privileges, Object Privileges, Analytic Privileges, Package Privileges, etc.
- Click the Deploy icon to create the role.
Tick the option “Grantable to other users and roles” if this role should be assignable to other users and roles.
3. Grant Role to User
Step 1) Assign the role “MODELLING_VIEW” to another user, “ABHI_TEST”, using the dialog below.
- Go to the User sub-node under the Security node and double-click it. The User window opens.
- Click the Granted Roles “+” icon.
- A pop-up appears. Search for the role name that will be assigned to the user.
Step 2) The role “MODELLING_VIEW” is now added under Role, as shown below.
Step 3) Deploy the change and check the message below.
- Click the Deploy button.
- The message “User ‘ABHI_TEST’ changed” is displayed.
4. Resetting User Password
To reset a user password, go to the User sub-node under the Security node and double-click it. The User window opens.
Step 1) Enter the new credentials as shown below.
- Enter the new password.
- Enter the confirm password.
Step 2) Save the new password as shown below.
- Click the Deploy button.
- The message “User ‘ABHI_TEST’ changed” is displayed.
5. Re-Activate or De-activate User
Go to the User sub-node under the Security node and double-click it. The User window opens.
The toolbar contains a De-Activate User icon, shown below. Click it.
A confirmation pop-up appears, as shown below. Click the Yes button.
The message “User ‘ABHI_TEST’ deactivated” is displayed. The De-Activate icon changes to “Activate user”, so the user can be activated again from the same icon.
SAP HANA License Management
A license key is required to use the SAP HANA database. A license key can be installed and deleted using SAP HANA Studio, the SAP HANA HDBSQL command line tool, and the HANA SQL query editor.
The SAP HANA database supports two types of license key:
- Permanent License Key: Permanent license keys are valid until their expiration date. A new key must be requested and applied before that date. If the key expires, a temporary license key is installed automatically for 28 days.
- Temporary License Key: This is installed automatically with a new SAP HANA database installation. It is valid for 90 days, after which a permanent key can be requested from SAP.
Authorization for License Management
The “LICENSE ADMIN” privilege is required for license management. SAP HANA Cloud is subscription-managed, so no key is installed manually.
SAP HANA Auditing
SAP HANA auditing features allow you to monitor and record actions performed in the SAP HANA system. Auditing must be activated for the system before an audit policy can be created.
Authorization for SAP HANA Auditing
The “AUDIT ADMIN” system privilege is required for SAP HANA auditing.
