Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Administration and in this video
we will take a look at how to create an LDAP provider in the SAP HANA database.
Hi, I am Denys van Kempen.
You can use your favorite LDAP provider to authenticate and/or authorize SAP HANA database
users, and even enable the automatic creation of users in HANA.
For this to work, we first need to create an LDAP provider in the SAP HANA database.
LDAP authorization and authentication is relatively new —it was introduced in SAP HANA 2.0 — and
there is no UI, no click-and-pick user interface yet to configure an LDAP server connection,
so we need to get our SQL Console out for the configuration.
I will be using the SQL Console of the SAP HANA Database Explorer but using SAP HANA
studio is fine as well, of course, and connect to the tenant database for which you want
to enable LDAP.
Here we have the SQL.
CREATE LDAP PROVIDER followed by the name you want to give it
CREDENTIAL TYPE ‘PASSWORD’
USING and then, in quotes, the DN (the distinguished name) and password for the technical user
that is set up in the LDAP server for this SAP HANA tenant database.
If you are familiar with LDAP, the syntax will be familiar as well.
If not, there are some examples in the SAP HANA SQL Reference for the CREATE LDAP PROVIDER
statement.
Password, by the way, is currently the only supported credential type.
Then we get the USER LOOKUP URL, again with typical LDAP syntax.
ldap (or ldaps for secure LDAP) ://hostname.domain :port —when using any other port than the default 389,
the attributes scope and filter
and this together constructs the URL that the LDAP server needs to locate a unique user account
which corresponds to an SAP HANA database user.
Similarly, you could also specify a NESTED GROUP LOOKUP URL, same idea,
for obtaining LDAP group membership information for a user.
ATTRIBUTE DN, the distinguished name of the LDAP user entry and ATTRIBUTE MEMBER_OF
in case the NESTED GROUP LOOKUP URL is not specified and this specifies the LDAP attribute
that provides a list of groups that a user is a member of.
I will not go into any detail for this on the LDAP side,
but here we have a view of how the same properties look like on an LDAP server.
We are using Microsoft Active Directory and AD Explorer.
DEFAULT ON indicates that this provider should be used as the default.
only applies if you have created multiple providers
and finally, we also need to state ENABLE PROVIDER
Default is DISABLE here, in case you want to create the provider without directly activating i t.
You can change all of these parameters with an ALTER LDAP PROVIDER.
For example, to disable the provider
but also, we have the option to ENABLE USER CREATION FOR LDAP.
This is new as of SPS 03, and we'll look into automatic user provisioning in another video in this series.
Once you have created the provider, you can run the VALIDATE LDAP PROVIDER statement.
This validates the LDAP provider configuration and optionally,
you can also specify CHECK USER to validate authentication and authorization.
There are some more examples in the SAP HANA SQL and System Views Reference.
Here you will also find the LDAP_PROVIDERS and the LDAP_PROVIDER_URLS documented.
Two system views that query the SAP HANA catalog.
The first returns the properties of each created LDAP provider.
Which one is the default?
Whether SSL is used, probably a good idea.
I am using stars here to hide the password but this will in clear text and unless you
are using the LDAPS protocol for secure LDAP, it would be wise to use SSL so data will be
encrypted when exchanged between the SAP HANA and the LDAP server.
You will need to set this up.
You will need to create a certificate store in the SAP HANA server and include the certificate
of the CA, the certificate authority, for the certificate of the LDAP server, for example
and the second view LDAP_PROVIDER_URLS, just specifies the URL.
OK, so much for LDAP-based authentication and user provisioning.
If you need more information, check the SAP HANA Administration Guide,
the LDAP Provider Details section documents extensively how to set this up with
—we already looked at that— the SQL Reference for the different statements and system views.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.