Hi, I'm Philip from the HANA Academy. In
this series of videos were looking at
R Integration for SAP HANA. In this
video we're going to look at
authentication. Now previously we've just
been having HANA access the R server
using the IP address and the port number
as a remote source and just going
straight in and running code on the RSERVE
and getting results back. However,
in a productive environment or anything
that's on the open Internet, probably
makes sense that you put some kind of
authentication in place. We only want
authenticated users to be able to access
this R server. How do we configure that?
How do we set up the R server to work
with authentication and how do we set up
the configuration on the HANA side to
provide the necessary credentials for
the authentication? Well that's what
we're going to see. Go to the code
snippets. You'll find that for this video
we've got a couple of new code snippets.
I'm going to assume that you've already
seen the previous video showing how to
install R. Now we did that on Google
Cloud Platform but it could work
anywhere and you've also seen the
previous videos about how it gets
started with HANA SPS 02. Where we
created a remote source. If you remember
in that point we did a create
remote source to RSERVE. The adapter
RSERVE and we just configured the
server's IP address and port. So that's
something we're going to come and change.
So the first thing we can do is actually
go ahead and modify our R environment.
So that we set it up to require
authentication. Let's do that. If we go to
R 13 authentication installing R on
GCP. Then you'll find that there's some
code snippets here to help you do that.
We're basically going to do a couple of
things. We’re going to create a file
which has got a list of usernames and
passwords. That file will create it
actually for the R user so just that
user can't see it. So make sure that R
users already created and then we're
going to configure R server to say
that authentication is required. That
we're going to use encrypted
authentication. So we're not going to
send a user ID and password in clear
text. It’s going to be encrypted and
we're also to specify well where are
the list of authenticated users and so
we'll specify that password file. That's
really all we have to do. So it's just a
small modification to what we already
did in a previous video when we set up
R on GCP in this example. So let's just
get to the console. So this is where I've
got R installed. The first thing I'm
going to do is I'm going to create that
password file. My R user is already
created. So I'm going to create a new
password file in the home folder of that
R user. We’ll call it password file. You
could call it whatever you want and now
within there I'm gonna paste in a value
for a user and password. Now of course
you can put anything you want. You
shouldn't use what I've used here in
real-world scenario but you can put any
user name and a corresponding password
or even have a list of them there if you
want. So I'm going to save that file. The
next thing we need to do is reference
that file actually from the R server
configuration. So that's where we're
going to edit the RSERVE config file.
So let's go again and use VI on that one.
Now you see we already edited this to
say remote enable way back when we did
the first installation. Now we're gonna
add a few lines based on what we've seen.
So we're going to use the three
additional lines here and actually go
and paste them in. So what we can see
here. Auth required means authentication
is required. Pretty self-explanatory.
Plain text disabled means that we're not
going to work with plain text user IDs
and passwords. They need to be encrypted.
Which is really what you want to have.
You don't want to be sending that
information in plain text. Easy for
anyone to sniff otherwise and we also
need to specify where are the user
password combinations that are going to
be valid for this R server and so we
use the PWD file, password file, and then
reference the name of the file. Which
happens to be the name of the file we
just created. So I'm going to save that
as well. So now we've done that we're
basically set up and ready to go.
Probably
the easiest way to actually make sure
everything's refreshed because we do
have an R server up and running. We set
that up with crontab automatically.
Might be just to restart the server. So
I'm gonna do that. I'm gonna do a quick
shutdown. We have the restart and do that
now and then a couple of seconds we're
gonna get that R server up and running
and it will be now using the new set of
parameters. Now whilst that's happening
what we can do is go off to our HANA
landscape and we can think about what
changes we're going to need to make here.
As we recall from the previous
videos we did create a remote source as
part of our getting started. A remote
source called RSERVE with the server
IP address and port number. So what we're
going to do this time and it's in the
R 13 authentication create remote source.
We're going to do something very similar
but we're going to modify what's in the
remote source statement and specifically
we're going to specify that we want
crypted authentication and give those
credentials. So let's go ahead and copy
this code and we open up a SQL window.
Now you'll need to run this as an
authorized user. Authorized to create
remote sources. In our case we've been
doing that as the system user. So I'll
open up a SQL window. Paste in the
script. Now just in case you've already
created a remote source you can easily
get rid of it with a drop remote source.
That's just there for info. What we're
gonna do is create a new remote source
called RserveWithAuth. Of course any
name you want using the same adapter
which is the RSERVE. Well
that needs to be what you use when
you're using authentication and when
you're using R but in the
configuration we're going to need to put
in our IP address. So let's put that. In my
case it's a local on my network. So I can
just put that in. So that's my IP address.
We're using port 30020 but of course
you could be using whatever port you
want but we've added after a ;
authentication mode equals crypted and
that's required if you want to use
encrypted authentication. If you want
plain text you can also specify an
option that's in the reference guide
but I'd recommend we work with crypted
user IDs and passwords and then as part
of the current remote source statement
we can also add with credential type and
then password. In single quotes, using and
then we can specify the username and the
password here in quotes. So user equals,
and then this corresponds to what we
just put in that user ID and password
file. So myRserveUserName and
myRservePassword. Of course you would
fill in your own values. Don't use these
in the real world. So that's all you
really have to do. The encryption will
be taking place automatically. You just
specify run this, create this remote
source and then everything should be
working correctly. So let's go ahead and
create the remote source. So
it's now RserveWithAuth but we also
need to specify which users are
authorized to use this. So I'm actually
gonna update my R user that we created
in a previous video and say they're now
authorized to use this RserveWithAuth
landscape. So we've now authorized that
remote source for that user. If we go back
to this user.
Maybe we'll just reconnect. Get a new
session as that user. The user never
actually specifies themself here where
they're gonna get R. They just know if
they use a stored procedure with R
script in it then that's going to be
made available. So it's the remote
sources really where the definitions
happen. So if I want to go ahead and just
run that. We already created the
procedure before. Let's just go ahead and
run our clustering function again that
we did in previous videos. We go ahead
and run it and it works. But this time we
are now using the new remote source
which is RserveWithAuth and it was
using authentication to do that. So
that's how we can work with
authentication. It’s kind of interesting.
You might think you need to have a
specific Linux users on your RSERVE
machine that you authenticate with but
actually no. It’s just up to you. You can
create a password file with user
password combinations and then that's
what you can use to get from HANA to
RSERVE and make sure you're doing
authentication. That allows you to keep
any folks that shouldn't be getting
into that RSERVE out because they're
obviously not going to have those
credentials and of course we're not
sending anything in clear-text. We’re
using authentication mode equals crypted.
So everything gets encrypted as it's
transferred over. So that's how we can
extend R Integration from HANA and
actually make sure that we're providing
authentication and doing that securely
in an encrypted way. You can find more
HANA video tutorials on our YouTube
channel. If you'd like to be informed as
soon as new video tutorials are
published please subscribe to the
channel. You can also connect with us on
LinkedIn, follow us on Twitter and we
have pages on Facebook and Google+.
Code snippets and demo data for all of
our tutorials are published to GitHub.
Thanks for watching.