Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA 2.0 SPS 03 - What’s New?
and in this video we will take a look at a new security feature:
LDAP-based authentication and user provisioning
Hi, I am Denys van Kempen.
We have seen a couple of innovations regarding LDAP in SAP HANA 2.0.
This started with LDAP Group-based authorization in the initial SPS 00 release.
In SPS 01, we switched from openSSL to the SAP standard CommonCrypto library.
SPS 02 introduced support for nested groups and some performance and supportability improvements
And now in SPS 03, we have LDAP-based authentication and user provisioning.
So we can, not only authorize users —what are you allowed to do?—
based on their LDAP profile, but also authenticate —who are you, in the first place?
LDAP —we are going to assume everybody is at least a little bit familiar with the topic—
short for lightweight directory access protocol (you can look it up on Wikipedia), lightweight
—so, it could be used over the internet, not just local networks, and mostly used as
a central place to store things like users and groups, and authorizations, instead of
each application server and database storing their own.
It is as old or young, depending on your point of view, as the internet itself.
For most, LDAP = Microsoft Active Directory but there are some other vendors out there,
there is open-source, and there is cloud-based Directory-as-a-Service, as well.
OK- What’s New?
As of SPS 03, we can now authenticate users through LDAP.
Here, we have a user named JSmith defined remotely in a Microsoft Active Directory system.
I will switch now to the SAP HANA cockpit and open the SQL Console of the SAP HANA Database Explorer.
Connect as USER ADMIN to a tenant database.
Now normally, when using SQL, we would create our user with the
CREATE USER username password statement
For LDAP authentication, you are going to use
WITH IDENTITY FOR LDAP PROVIDER;
That’s it.
So for this user, we are not going to store a password in the SAP HANA database.
We are not going to concern ourselves with a local SAP HANA password policy.
This is all going to be delegated to our LDAP server, Active Directory.
And if we run a CONNECT as JSMITH, we are now connected.
Let’s return to the cockpit
and go to Manage Users
Select our user
JSMITH
and here we can see that he or she is authenticated through LDAP.
In the current SP 06 release of SAP HANA cockpit, LDAP is not yet a selection option for authentication.
I expect this to come in the next release, or so.
If you click Add (the plus sign)
Create User
Then for Authorization Mode, we do have the option to either select Local or LDAP.
This governs the privileges the new user would have.
What can JSmith do, what can JSmith access.
However, here we are interested in Authentication —and allthough we have a lot of options,
local passwords, Kerberos, SAML, X509 certificates and JWT for JSON, there is no LDAP radio button yet.
That’s authentication
but it gets even better.
Let me take out the security guide here, to explain the next topic: automatic user provisioning.
Say, you try to logon to a SAP HANA server as JSmith with password.
There is no local user account but —assuming everything has been setup properly—
HANA will proceed to request the LDAP SERVER to authenticate JSmith,
if that succeeds, to request the LDAP group memberships of JSmith,
once it is verified that our user is a member of at least one LDAP group mapped to a HANA role,
then the user is automatically created in HANA and granted the relevant role(s).
—and that will be with CREATE USER … WITH IDENTITY FOR LDAP PROVIDER, as we just saw,
this time behind the screens and behind the scenes.
Assuming, again, you have set this up this way.
This is not default behaviour, of course.
So, how does this work?
Let’s first drop JSmith.
OK— you need to ENABLE USER CREATION FOR LDAP
Then, but this entirely optional, you can do a
VALIDATE LDAP PROVIDER
CHECK USER CREATION FOR LDAP USER and then the user name
This checks the LDAP configuration required for automatic user creation with LDAP authentication,
including verifying the LDAP authorization for the specified user.
We need to have some role mapping in place.
There are other VALIDATE LDAP PROVIDER checks, we can perform. I will skip that for now.
Automatic user provisioning works with JDBC and ODBC clients, we cannot do a SQL Connect
as we did previously using our Node.js client SAP Database Explorer.
So, let’s switch to a SAP HANA client and use hdbsql, the SAP HANA Database interactive terminal.
This is an ODBC client, any other would be fine as well.
Just connect as jsmith
HANA will pass user name and password to the LDAP server, gets an OK back, request LDAP
groups for JSmith, finds a match with a local group, creates the user, grants the roles and connects.
No smoke and mirrors, JSMITH is connected
And if we switch to SAP HANA cockpit
Manage users
JSMITH
Assign roles
We can see that the USER_ADMIN and ROLE_ADMIN roles have been granted,
—this has been some homework on the LDAP server and this is a prerequisite.
OK, so much for LDAP-based authentication and user provisioning.
We will add a number of video tutorials to the Security and the Administration Playlist,
where we will show you how to set LDAP up.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.