Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Administration and in this video
we will discuss LDAP group authorizations.
This video has been recorded on release SAP HANA 2.0 SPS 03, released in April 2018.
For earlier or later releases, please check the Administration playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
In the previous video of this series, we have created an LDAP provider in the SAP HANA catalog
for our tenant database T01, which is a prerequisite for LDAP group authorization.
If you have missed this step somehow, please watch this video first, so we are all on the same page.
Before we dive in and get hands-on, lets first take a look at the LDAP group authorization process.
This illustration is from the SAP HANA Security Guide.
The section is called LDAP Group Authorization for Existing Users.
It is also possible to use the LDAP server for user authentication and then we can even
automatically provision users, create new users, based on LDAP groups,
but this we will cover in a separate video.
This is how this works.
First we connect from our client to the SAP HANA database.
HANA will authenticate our connection: who are we?
Do we have an account in this database?
If so, and if we provided the right password, HANA will proceed and request the LDAP server
for the group memberships of this user account.
LDAP will try to identify the user in the LDAP directory and, if a match is found, return
the user’s group information back to HANA.
If this is the first connection, HANA will grant the roles mapped to the LDAP groups
and proceed to allow access to the requested resources —SELECT something—
based on the granted roles.
Couple of caveats, or implementation considerations, I should say.
You can look them up here in the Security Guide.
The user must be configured for LDAP authorization and this is exclusive.
The alternative is local, that is, the HANA database itself.
So, you cannot mix-and-match local and LDAP groups.
It would become a mess.
It is either, or.
For this reason, because it is related, currently, LDAP group authorization is not support for
cross-database queries between tenant databases and also not supported for XS Advanced users,
including users that are created in HANA when HANA is used as identity provider.
Then, there is also the concept of role reuse duration.
We are not going to query the LDAP server each and every time you logon about your group memberships.
That would not be very efficient.
Instead, role assignments are stored and kept for a period of time.
Default is 240 minutes (4 hours), and we configure this here in the indexserver.ini configuration file
for the concerned tenant database, section: authorization
parameter: ldap_authorization_role_reuse_duration
Here we can set it to 60 minutes, for example.
You can set it to 0 to disable role reuse
So, we check each and every time and even to -1 to disable re-evaluation all together
in which case initially granted roles are never revoked.
OK.
Let’s set this up.
First, we are going to create a couple of roles in the SAP HANA database.
Remember, that we need to map LDAP roles to SAP HANA local roles.
We cannot grant SAP HANA-specific system privileges, schema privileges, analytical privileges,
and so on, to roles defined on a Microsoft Active Directory LDAP server somewhere, of course
This we have to do locally, on the SAP HANA server.
As an example, I am creating a COCKPIT_ACCESS_ROLE,
an ENCRYPTION_ADMIN_ROLE and a BACKUP_ADMIN_ROLE
to name a few.
These we will be using.
We can check the ROLES and the GRANTED_PRIVILEGES system views to verify our work.
Very good
And then run an ALTER ROLE … ADD LDAP GROUP statement on each of the roles to map the
LDAP role definition to the HANA role.
So we can do an LDAP lookup.
The syntax is LDAP-specific, we already looked at this in the previous video.
If you are familiar with LDAP, this will look familiar as well.
If you are completely new to LDAP, best to contact the LDAP administrator for some advice.
Then we have the ROLE_LDAP_GROUPS view that shows the mapping.
OK —Next, let’s create two users: JohnD and JaneD.
We will be using a silly password and NO FORCE_FIRST_PASSWORD_CHANGE.
This is the exact opposite of a best practice, of course.
Don’t try this at home.
Just to save ourselves some time, entering passwords.
But then, and this is important, we are specifying AUTHORIZATION LDAP.
This is the keyword.
We can check that our users have been created successfully in the USERS system view.
AUTHORIZATION_MODE is LDAP with the LAST_SUCCESSFUL_CONNECT column still empty
and if we take a look at GRANTED_ROLES, only the PUBLIC role has been granted at this stage.
Let’s switch to our Microsoft Active Directory system again.
We can see that JaneD has been granted the HANABackupAdmin role
and JohnD, HANAEncryptionAdmin.
OK - Let’s use the SAP HANA cockpit to verify that this all works.
I have copied two entries and will now enter the credentials for the resource.
Ladies first.
JaneD.
Enter the password.
Now, open the resource
Let’s open the Backup Alert
Open Backup
Very well, the catalog opens, this is looking good.
Let’s create a backup.
Backup in progress.
OK - this is clearly working.
And just to double check, here we have GRANTED ROLES and, lo and behold, JaneD now has the
COCKPIT_ACCESS_ROLE and the BACKUP_ADMIN_ROLE granted
because these roles have been mapped to the LDAP Groups.
For completeness sake, let’s repeat the exercise with JohnD.
Enter credentials.
Open resource.
Open Backup Alert.
OK.
Go to Backup.
Nope
Error: Unable to initialize the application.
Reason: insufficient privileges.
Close.
That’s right.
JohnD is not our Backup Admin.
He is our Encryption admin
Security
Backup Encryption
Switch On Backup Encryption.
Yes
Wait a sec
a nd Backup Encryption is switched on.
No errors.
Sufficient privileges.
Because is JohnD is our EncryptionAdmin.
Let’s triple check on the GRANTED_ROLES.
Indeed.
JohnD now also has the required roles granted to perform his job.
As a reminder, here we have the flow again for LDAP Group Authorization.
JohnD connects, HANA authenticates, request his groups from the LDAP server.
That’s EncryptionAdmin and CockpitAccess.
These LDAP groups have a mapping in the Catalog.
So, HANA will grant the roles to JohnD.
Note that we are just doing a name check here.
If you grant the system privilege BACKUP ADMIN to a role with name ENCRYPTION_ADMIN, then
it is the actual system privilege granted to the role that matters, of course.
Finally, if we look up JohnD in the cockpit,
Manage Users,
Under the Authorization Mode we see LDAP.
And if we edit the user, we can switch here to Local and LDAP.
As mentioned, it is either/or, not a combination.
But, you do not have to create the user using SQL for LDAP.
A UI, both for cockpit and studio is available as well.
Here we have the roles, they need to map to an LDAP role
But if we try to add a privilege,
Add
Let’s pick AUDIT ADMIN
OK. Save.
Error, local authorization not allowed.
Cannot grant a user authorized by LDAP.
It is either LDAP or local but not a combination.
OK.
So much for LDAP Group Authorization.
It is documented in the SAP HANA Security Guide (the concepts)
and the SAP HANA Administration Guide (the activities).
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.