Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Administration and in this video
I will discuss LDAP user authentication and automatic user provisioning.
This video has been recorded on release SAP HANA 2.0 SPS 03, released in April 2018.
For earlier or later releases, please check the playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
In a previous video of this series, we have created an LDAP provider in the SAP HANA catalog
for our tenant database T01
—in our case, we are using Microsoft Active Directory.
If you have missed this step somehow, please watch this video first, so we are all on the same page.
LDAP user authentication eliminates the need to manage user passwords and password policies
in the SAP HANA database.
So, particularly in case you have a lot of SAP HANA databases or in case you need to
add users very often, this may come in handy.
Lower TCO, etc.
As before, when we discussed LDAP group authorization,
and before we dive in and get hands-on
Lets first take a look at the process for user authentication and automatic user provisioning.
Again, the illustration is from the SAP HANA Security Guide, section LDAP User Authentication.
I should mention that automatic user provisioning is not enabled by default, of course.
You will need to enable it for the LDAP provider in question and you will need to have done
your homework as well on the LDAP server-side.
There has to be a group mapping in place.
When this has been setup —and that’s what we have done in the previous video—
the process will be pretty much the same as for Group Authorization, except this time, if
the database user does not exist, it will be created on the SAP HANA server and receive
the roles mapped to the LDAP group or groups.
So, all that has changed is that, optionally, we can automate the creation of the database user.
OK -Let’s first try out LDAP user authentication.
For this, we need to create a user which already exists in the LDAP directory.
Let’s take brief look at our Microsoft Active Directory.
Here, let’s pick JSMITH; the one and only.
He is a member of two LDAP groups: HANARoleAdmin and HANAUserAdmin.
So, let’s map these LDAP groups to local SAP HANA roles.
I am using the SQL Console here of the SAP HANA Database Explorer.
You will need to do this in SQL.
Two options.
You can create the role, grant the required or desired privileges to the role and then
map the role to the LDAP group, or create the role and map it to the LDAP group directly
and afterwards grant the role privileges.
What’s the difference?
There isn’t any.
It is the same thing.
You can query the ROLE_LDAP_GROUPS view to see the mapping.
It is maybe obvious, but let me state it anyway, the fact the LDAP group is called HANAUserAdmin
does not mean that it has any such privilege.
It is just a name.
It is because we granted the USER ADMIN system privilege to the user_admin_role and then
mapped the user_admin_role to the LDAP group CN (common name)=HANAUserAdmin, etc.,
that we get the desired effect.
Should I have granted the BACKUP ADMIN system privilege to the user_admin_role with the
same mapping, HANAUserAdmin would now be a backup admin and not a user admin.
So, you may want to think a bit about what names you want to use.
Also, we could, of course, have granted both the ROLE ADMIN and the USER ADMIN system privileges
to a single SAP HANA catalog role.
The whole role and privileges architecture of SAP HANA works exactly the same way.
OK — Next, we need to create a user locally WITH IDENTITY FOR LDAP PROVIDER
We are telling HANA here not to bother with passwords and password policies for jsmith.
There are a couple of checks that, as a system administrator, you could execute, to validate
the lookup URL of the LDAP provider,
to validate and check a particular user (does it exist?), to validate and authenticate a particular user.
With a bad password we get an error.
With the right password, the validation is successful.
Let’s create the user locally
And make a connection.
We can query the M_CONNECTIONS view to get some more information but as you can see,
we are now connected a jsmith validated by Active Directory.
OK - To enable automatic user provisioning, all we need to do is update the configuration
of our LDAP provider.
ENABLE USER CREATION FOR LDAP
Then we can do a VALIDATE LDAP PROVIDER
This time with CHECK USER CREATION FOR LDAP USER name of user
This is optional, of course, but you may want to check that everything is setup properly.
Let’s first delete the local HANA user jsmith so we start with a clean slate.
One thing to note, LDAP authentication can be implemented only for users accessing SAP
HANA directly via JDBC/ODBC database clients.
What else is there, you might ask?
Well, here I am connected with the SAP HANA Database Explorer SQL Console, which is a
Node.js client and does not use O- or JDBC.
So, for the initial connection this will not work.
Let’s switch to an ODBC client.
Here, I will be using hdbsql.
I have already created a user key store for user jsmith, so I do not have to enter the
password here on the command line.
Again, this is not required.
Just for convenience.
hdbsql -U jsmith
OK.
We are connected.
We can check M_CONNECTIONS
So our account is created.
If we want, we could now do a SQL connect.
This works fine.
Let’s switch to the SAP HANA cockpit
Manage Users,
Here we have JSMITH
Authentication is LDAP
When we create a new user, we can select LDAP for authorization
we have seen this in the previous video
but note there is no radio button yet for authentication.
This is the situation at the time of the recording.
June 2018.
My guess is that this will come in the next cockpit release or so, later this year.
Well, that’t it.
So much for LDAP user authentication and automatic user provisioning
It is documented in the SAP HANA Security Guide (the concepts)
and the SAP HANA Administration Guide (the activities).
Thanks for watching.
You can find more video tutorials on our YouTube channel and if you would like to be informed
about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.