Describing SAP HANA Authentication and Authorization

A user connecting to SAP HANA through Kerberos must have an SAP HANA database user. This database user is mapped to the external identity in a Key Distribution Center (KDC), such as Microsoft Active Directory.

For integration into Kerberos-based SSO scenarios, SAP HANA supports Kerberos version 5 based on Active Directory (Microsoft Windows Server) or Kerberos authentication servers. For HTTP access using SAP HANA extended application services, classic model, Kerberos authentication is enabled with Simple and Protected GSS-API Negotiation Mechanism (SPNEGO).

Kerberos is a network authentication protocol that provides authentication for client-server applications across an insecure network connection using secret-key cryptography.

ODBC and JDBC database clients support the Kerberos protocol. A prominent example of a client supporting this authentication method is the SAP HANA cockpit. You can also implement access from front-end applications using Kerberos delegation. Support for constrained delegation and protocol transition is limited to scenarios in which the middle-tier application connects to SAP HANA as the database layer via JDBC.

There are two variants when using the Kerberos single sign-on mechanism for clients in combination with SAP HANA:

• Direct authentication

  ODBC/JDBC clients connect from within a network to the key distribution center (KDC), get authenticated using a Kerberos ticket, which is forwarded to SAP HANA. If web browsers are used as clients, SAP HANA uses the XS implementation (typically XSA) to realize this mechanism.

• Indirect authentication via constrained delegation

  In this scenario, the client first connects to the application, which itself is connected to the KDC and verifies the client by requesting a Kerberos ticket. This ticket in turn is sent to SAP HANA for authentication. There are multiple products (SAP-owned and non-SAP) using this indirect authentication via constrained delegation (for example, Smart Data Access and Hadoop).

The SAP HANA database supports user logon to the SAP HANA database using Security Assertion Markup Language (SAML).

You can select SAML as a user authentication method when creating users in the SAP HANA cockpit.

The Lightweight Directory Access Protocol (LDAP) is an application protocol for accessing directory services. If you use an LDAP-compliant identity management server to manage users and their access to resources, you can use an LDAP server to authenticate SAP HANA users, and you can use LDAP group membership to authorize SAP HANA users.

1
CREATE USER <user> WITH IDENTITY FOR LDAP PROVIDER;

12
ALTER USER <user> DISABLE PASSWORD; 
ALTER USER <user> ENABLE LDAP; 

You can authenticate users in SAP HANA with logon or assertion tickets. These tickets are issued to users when they log on to an SAP system configured to create tickets (for example, the SAP NetWeaver Application Server).

If you want to integrate an SAP HANA system into a landscape that uses SAP logon or assertion tickets for user authentication, configure SAP HANA to accept logon or assertion tickets.

SAP HANA validates incoming logon or assertion tickets against certificates signed by a trusted Certification Authority (CA) stored in a dedicated trust store. This trust store must contain all root certificates used to validate logon and assertion tickets.

The user named in an incoming SAP logon ticket must exist as a database user. You must also configure the database user for authentication using logon or assertion tickets. You can configure the database users in the Manage users app of the SAP HANA cockpit.

For more information about using logon tickets, see the SAP NetWeaver Platform library:

User Authentication and Single Sign-On

JSON Web Token (JWT) is an open standard. SAP HANA validates tokens according to the IETF standard.

JSON Web Tokens (JWT) can be used for user authentication in single sign-on environments. The identity of users can be authenticated by JWT tokens issued by a trusted identity provider. The following clients can be used in combination with JWT:

• DB clients that access the SQL interface of the SAP HANA database directly

• Clients that connect to SAP HANA through the SAP HANA XS advanced server (XSA)

A JWT can be used to authenticate users accessing SAP HANA directly from ODBC/JDBC database clients or indirectly through SAP HANA extended application services, advanced model (SAP HANA XS, advanced).

Users log on to the SAP HANA database and can own database objects. The authorizations are assigned by roles and privileges.

Privileges define what users can see and do. Privileges can be assigned to users directly or indirectly using roles. Privileges are required to model access control. Roles can be used to structure the access control scheme and to model reusable business roles.

Roles are used to bundle and structure privileges for dedicated groups of users. Typical roles are defined for specific tasks, handle data models (create, activate, consume, and so on).

You can manage authorization for users using roles. You can nest roles so that role hierarchies can be implemented. This increases their flexibility, allowing for both precise and broad-scale authorization management for individual users.

All the privileges granted directly or indirectly to a user are combined. This means that whenever a user tries to access an object, the system performs an authorization check using the user, the user's roles, and directly allocated privileges.

You cannot explicitly deny privileges. This means that the system does not need to check all the user’s roles. Once all the requested privileges are located, the system aborts the check and grants access.

Several predefined roles exist in the database. Some of them are templates that need to be customized; others can be used as they are.

After a successful logon, the system verifies the user's authorization to perform the requested operations on the requested objects. This is determined by the privileges that the user has been granted. The user must have both the privilege to perform the operation and the privilege to access the object (for example, a table) to which the operation applies.

Privileges can be granted to database users either directly, or indirectly through roles. A role is a set of privileges. Roles are the standard mechanism of granting privileges because they allow you to implement both fine-grained and coarse-grained reusable authorization concepts that can be modeled on business roles. Several standard roles are also delivered with the SAP HANA database (for example, MODELING, MONITORING). You can use these as templates for creating your own roles.

When accessing the SAP HANA database using a client interface (such as Open Database Connectivity [ODBC], Java Database Connectivity [JDBC], and Multidimensional Expressions [MDX]), any access to data must be backed by corresponding privileges. Different schemes are implemented. On a higher level, this concept provides authorization for the data contained in the database when it is accessed using client interfaces. In the SAP HANA database system, the regular SQL authorization concept is implemented.

For each SQL statement type (for example, SELECT, UPDATE, and CALL), the executing user needs to have a corresponding privilege. Also, objects in the database (such as tables, views, or stored procedures) have an owner who can access the objects and grant privileges for them.

No user can access this particular object, other than the owner of an object and users that the owner has provided with a privilege. This authorization operates at the object level, where the smallest entities that can be privileged are, for example, a table or a view.

In addition, analytic privileges provide row-level authorization for certain database objects, such as analytic views.

The process flow for user management is as follows:

1. Define and create privileges.

2. Define and create roles.

   Use the Manage users app in the SAP HANA cockpit or run the SQL statement CREATE ROLE <Role_Name>.

3. Assign privileges to roles.

4. Create users.

   Choose the following authentication methods:

   • Define the initial password.

   • Define the external User ID (for example, Kerberos to set up SSO).

   • Define other user settings.

   Define default client is used as an implicit filter value when reading from SAP HANA data models.

5. Grant roles to users.

   Use the Manage users app in the SAP HANA cockpit or run the SQL statement GRANT <Role_Name> TO <user>.

   To revoke roles, use the SQL statement REVOKE <Role_Name> FROM <user>.

6. Optional: Create groups.
7. Optional: Assign roles to groups.
8. Optional: Assign users to groups.

The password policy has the following conditions:

• Password quality (length, complexity)

• Password exclude list (forbidden terms)

  The password quality is defined by several parameters and the password exclude list can also be maintained in the Security and User Management area in the SAP HANA cockpit.

  The password exclude list is a list of words that are not allowed as passwords or parts of passwords. SAP HANA checks this exclude list whenever a password is created or changed. You can specify if the words in the exclude list are case-sensitive and if the check applies to whole words or parts of words. The password exclude list is implemented as table _SYS_PASSWORD_BLACKLIST in the schema _SYS_SECURITY. The owner of both the schema and the table is the user SYSTEM.

  Details on both topics can be found in the following guide: SAP HANA Security Guide for SAP HANA Platform in section Configure the Database Password Policy and Password Exclude List

  During the initial system setup, the SYSTEM user grants change privileges for this table to a dedicated administrator user.

  Caution

  For security reasons, and to prevent users from viewing sensitive information such as a password, manage the privilege to select carefully.

The password policy is defined by parameters in the password policy section of the indexserver.ini system properties file.

If a parameter is set to a value outside the value range, either the minimum value or the maximum value of the value range, whichever is appropriate, is used instead.

The Authentication app in the SAP HANA cockpit allows you to view the password policy and to change its default configuration.

The prerequisites for changing parameters are as follows:

• System privilege INIFILE ADMIN

• (For exclude list) INSERT and DELETE privileges for either the _SYS_PASSWORD_BLACKLIST table or the _SYS_SECURITY schema

To view the contents of the INI file, use the M_INIFILE_CONTENTS view.

The password policy parameters can be found in the M_PASSWORD_POLICY view.