Integrating SailPoint with SAP HANA
Integration
This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.
SailPoint's SAP HANA Database connector offers a complete access management solution for your SAP HANA Database users and roles. This connector directly interacts to the database layer for SAP HANA.
Note
To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.
Supported Features
The SAP HANA connector supports the following features:
Account Management
- Manages SAP HANA database users as Accounts
- Aggregation, Refresh Accounts
- Create, Update, Delete
- Enable, Disable, Unlock, Change Password
- Add/Remove Entitlements
- Manages System Privileges and Application privileges of user
Account - Group Management
Note
Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.
-
Load and *Provision SAP HANA
- Accounts
- Repository roles
- Catalog Roles
- System privileges (loaded during account aggregation)
- Application privileges (loaded during account aggregation)
- Custom User Parameters. For more information, refer to Custom User Parameters.
-
*Access Certifications (certification of entitlements connected to accounts)
- *Password management
For more information on group aggregation, refer to Group Aggregation Configuration.
For more information on features, refer to Source Features.
Privilege Classification
SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.
| Privilege Level | Description |
|---|---|
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |
Note
To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.
For more information, refer to Managing Privilege Classification.
Password Management
If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:
- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.
For more information on configuring password management, refer to Password Management Overview.
Prerequisites
- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.
- Create a service account on the SAP HANA source with required permissions.
- The SAP HANA JDBC driver must be set up for proper functioning of the SAP HANA source.
Note
In order to connect to the SAP HANA Cloud database, JDBC driver version 2.4.67 or greater is required. For more information, refer to the SAP Help Portal.
Supported Managed Systems
The SailPoint SAP HANA connector supports the following SAP systems:
- SAP HANA Cloud Database Version 4.0x
- SAP HANA 2.0 SPS8
- SAP HANA 2.0 SPS6
- SAP HANA 2.0 SPS5
- SAP HANA 2.0 SPS4
- SAP HANA 2.0 SPS3
- SAP HANA 1.0 SPS12
- SAP HANA 1.0 SPS11
Required Permissions
The following are the required permissions for the specific operations mentioned below:
Note
- USER ADMIN privileges are required for Enable/Disable/Lock/Unlock Account/Delete Account/change password.
- For SAP HANA Cloud database, the USER ADMIN system privilege is not available and instead the OPERATOR system privilege on the user group in which the user is to be created is required for Enable/Disable/Lock/Unlock Account/Delete Account/change password. For more information, refer to the SAP Help Portal.
Test Connection
CATALOG role: PUBLIC
Account Aggregation
System Privileges
- CATALOG READ
- ROLE ADMIN
- USER ADMIN
Group Aggregation
- CATALOG READ
- ROLE ADMIN
Removing the Role Assigned to the User
Revoking the role can be achieved by the same user who has granted it.
For information on enabling users to revoke catalog roles assigned by other users, refer to Revoke Catalog Roles.
Creating a User by Assigning the Respective Privileges and Roles
Minimum required permissions for existing SAP HANA connector:
| CATALOG role and Application privilege | Repository roles | System Privileges |
|---|---|---|
| System privileges - CATALOG READ - ROLE ADMIN |
System Privileges - CATALOG READ - ROLE ADMIN - USER ADMIN Object Privileges EXECUTE Privilege on the following objects: - _SYS_REPO.GRANT_ACTIVATED_ROLE- _SYS_REPO.REVOKE_ACTIVATED_ROLE- _SYS_REPO.GRANT_APPLICATION_PRIVILEGE- _SYS_REPO.REVOKE_APPLICATION_PRIVILEGE |
The service account must have the system privilege assigned to it with the Grantable to other user and groups flag enabled. |
Minimum required permissions for SAP HANA Cloud database connector:
| CATALOG role and Application privilege | Repository roles | System Privileges |
|---|---|---|
| System privileges - CATALOG READ - ROLE ADMIN |
System Privileges - CATALOG READ - ROLE ADMIN Object Privileges ALTER and REFERENCES object permissions are required on SAML provider object in order to provision user with the respective SAML provider for SAP HANA Cloud database. Note: To grant a role created with the role group assigned, the object privilege OPERATOR on the role group is required. |
The service account must have the system privilege assigned to it with the Grantable to other user and groups flag enabled. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.