SAP HANA 2.0 Security Guide

Jonathan Haun

• Publisher: SAP PRESS
• Year: 2020
• Print ISBN: 9781493218967
• eBook ISBN: 9781493218974
• Edition: 2
• Topic: Computer Science
• Subtopic: Computer Science General
• Index: Computer Science

Your complete guide to safeguarding your SAP HANA 2.0 platform awaits! Get step-by-step instructions for configuring and maintaining each security element, from the new SAP HANA cockpit to privileges and roles. Learn how to secure database objects and provision and maintain user accounts. Then, dive into managing authentications, certificates, audits, and traces. Highlights include: 1) SAP HANA cockpit
2) Privileges
3) Catalog objects
4) User accounts
5) Roles
6) Authentication
7) Certificate management
8) Encryption
9) Lifecycle management
10) Auditing
11) Security tracing

1 Managing Security with the SAP HANA Cockpit

In this chapter, we’ll introduce you to the SAP HANA cockpit and many of the workflows necessary for managing security settings and security models.

Since its inception, most of the SAP HANA security model has been developed and maintained using SAP HANA Studio, a client tool installed on an SAP HANA developer or administrator workstation. However, in November 2016, SAP announced and released SAP HANA 2.0, including a new administration tool called the SAP HANA cockpit.

The SAP HANA cockpit provides monitoring, configuration, performance optimization, security, platform lifecycle management, and other administration capabilities. Unlike SAP HANA Studio, the SAP HANA cockpit does not provide application or content development tools. These tools have been migrated to SAP Web IDE for SAP HANA, another independent, web-based development tool in the SAP HANA 2.0 portfolio.

The SAP HANA cockpit is a standalone, web-based HTML5 application server, not a desktop-based client tool. It operates in SAP HANA extended application services, advanced model (SAP HANA XSA) and also requires an SAP HANA 2.0, express edition, database or an SAP HANA 2.0 tenant database to operate. The architecture of the SAP HANA cockpit is designed to centralize and simplify the management and administration of SAP HANA throughout an IT landscape. Given its importance in the realm of SAP HANA security, the goal of this chapter is to introduce you to the various security workflows and security options that you can manage in the SAP HANA cockpit. However, this chapter is not intended as a comprehensive guide to using the SAP HANA cockpit.

Other Web-Based Administration Tools

As of SAP HANA 2.0 SPS 04, some aspect of the security model can still be managed with the SAP HANA Web-Based Development Workbench. This tool is hosted in the legacy SAP HANA extended application services, classic model (SAP HANA XS) engine (XS engine).

References to the SAP HANA cockpit will be prominent throughout this book, so you’ll require a basic understanding of it and its security-related interfaces. In this chapter, we’ll provide an overview of the SAP HANA cockpit, introducing its architecture, basic navigation steps, and specific security management interfaces. We’ll also introduce the SAP HANA database explorer and the SQL console, in which security-related SQL commands are executed, and we’ll outline the key user interfaces you’ll use to administer security-related items, including the graphical interfaces for user and role administration. We’ll also discuss other interfaces used to manage data encryption, authentication, and database security.

1.1 What Is the SAP HANA Cockpit?

In this section, we’ll provide an overview of the architecture of the SAP HANA cockpit, show you how to access it the first time, review the SAP HANA cockpit manager, and walk you through the steps required for registering SAP HANA databases within the SAP HANA cockpit.

1.1.1 SAP HANA Cockpit Architecture

Architecturally, the SAP HANA cockpit is an SAP HANA XSA multi-target application (MTA) that requires an SAP HANA database to operate. SAP provides several deployment options, as shown in Figure 1.1.

As shown in Figure 1.1, you can deploy the SAP HANA cockpit on a supported standalone server using SAP HANA, express edition. The SAP HANA cockpit can also be installed alongside your existing SAP HANA instance or within an existing instance by using separate tenant databases sharing the same instance. In all cases, the software must be deployed to a supported Linux operating system (OS). Be sure you size your hardware properly based on the deployment option you choose.

Both a standalone installation and an installation as a separate instance require the use of SAP HANA, express edition. Fortunately, the installation media for the SAP HANA cockpit includes every required component and deploys the enti...

Table of contents

• Dear Reader
• Notes on Usage
• Table of Contents
•   Preface
•   Introduction
• 1   Managing Security with the SAP HANA Cockpit
• 2   Introduction to SAP HANA Privileges
• 3   Catalog Objects
• 4   User Accounts
• 5   Database Roles
• 6   Repository Roles
• 7   System Privileges
• 8   Object Privileges
• 9   Package Privileges
• 10   Analytic Privileges
• 11   Application Privileges
• 12   Authentication
• 13   Certificate Management and Encryption
• 14   Security Lifecycle Management
• 15   Auditing
• 16   Security Tracing and Troubleshooting
• 17   Security Recommendations
• 18   SAP HANA XSA Security
• The Author
• Index
• Service Pages
• Legal Notes