# Integrating SailPoint with SAP HANA

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

SailPoint's SAP HANA Database connector offers a complete access management solution for your SAP HANA Database users and roles. This connector directly interacts to the database layer for SAP HANA.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SAP HANA connector supports the following features:

### Account Management

- Manages SAP HANA database users as Accounts
- Aggregation, Refresh Accounts
- Create, Update, Delete
- Enable, Disable, Unlock, Change Password
- Add/Remove Entitlements
- Manages System Privileges and Application privileges of user

### Account - Group Management

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Load and \*Provision SAP HANA

  - Accounts
  - Repository roles
  - Catalog Roles
  - System privileges (loaded during account aggregation)
  - Application privileges (loaded during account aggregation)
  - Custom User Parameters. For more information, refer to [Custom User Parameters](<https://documentation.sailpoint.com/connectors/sap/hana/va/help/schema.html#custom-user-parameters>).
- \*Access Certifications (certification of entitlements connected to accounts)
- \*Password management

For more information on group aggregation, refer to [Group Aggregation Configuration](<https://documentation.sailpoint.com/connectors/sap/hana/va/help/schema.html#group-aggregation-configuration>).

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Create a service account on the SAP HANA source with required permissions.
- The SAP HANA JDBC driver must be set up for proper functioning of the SAP HANA source.

> [!NOTE]
>
> In order to connect to the SAP HANA Cloud database, JDBC driver version 2.4.67 or greater is required. For more information, refer to the [SAP Help Portal](<https://help.sap.com/docs/hana-cloud/sap-hana-cloud-getting-started-guide/connect-to-sap-hana-database-in-sap-hana-cloud-via-jdbc>).

## Supported Managed Systems

The SailPoint SAP HANA connector supports the following SAP systems:

- SAP HANA Cloud Database Version 4.0x
- SAP HANA 2.0 SPS8
- SAP HANA 2.0 SPS6
- SAP HANA 2.0 SPS5
- SAP HANA 2.0 SPS4
- SAP HANA 2.0 SPS3
- SAP HANA 1.0 SPS12
- SAP HANA 1.0 SPS11

## Required Permissions

The following are the required permissions for the specific operations mentioned below:

> [!NOTE]
>
> - USER ADMIN privileges are required for Enable/Disable/Lock/Unlock Account/Delete Account/change password.
> - For **SAP HANA Cloud** database, the USER ADMIN system privilege is not available and instead the OPERATOR system privilege on the user group in which the user is to be created is required for Enable/Disable/Lock/Unlock Account/Delete Account/change password. For more information, refer to the [SAP Help Portal](<https://help.sap.com/docs/hana-cloud-database/sap-hana-cloud-sap-hana-database-administration-guide/user-management-with-sap-hana-database-administrator-dbadmin>).

### Test Connection

CATALOG role: PUBLIC

### Account Aggregation

System Privileges

- CATALOG READ
- ROLE ADMIN
- USER ADMIN

### Group Aggregation

- CATALOG READ
- ROLE ADMIN

### Removing the Role Assigned to the User

Revoking the role can be achieved by the same user who has granted it.

For information on enabling users to revoke catalog roles assigned by other users, refer to [Revoke Catalog Roles](<https://documentation.sailpoint.com/connectors/sap/hana/va/help/connecting.html#revoke-catalog-roles>).

### Creating a User by Assigning the Respective Privileges and Roles

**Minimum required permissions for existing SAP HANA connector**:

| CATALOG role and Application privilege | Repository roles | System Privileges |
| --- | --- | --- |
| System privileges<br>\- CATALOG READ<br>\- ROLE ADMIN | System Privileges<br>\- CATALOG READ<br>\- ROLE ADMIN<br>\- USER ADMIN<br><br>Object Privileges<br>EXECUTE Privilege on the following objects:<br>\- `_SYS_REPO.GRANT_ACTIVATED_ROLE`<br>\- `_SYS_REPO.REVOKE_ACTIVATED_ROLE`<br>\- `_SYS_REPO.GRANT_APPLICATION_PRIVILEGE`<br>\- `_SYS_REPO.REVOKE_APPLICATION_PRIVILEGE` | The service account must have the system privilege assigned to it with the **Grantable to other user and groups** flag enabled. |

**Minimum required permissions for SAP HANA Cloud database connector**:

| CATALOG role and Application privilege | Repository roles | System Privileges |
| --- | --- | --- |
| System privileges<br>\- CATALOG READ<br>\- ROLE ADMIN | System Privileges<br>\- CATALOG READ<br>\- ROLE ADMIN<br><br>Object Privileges<br>ALTER and REFERENCES object permissions are required on SAML provider object in order to provision user with the respective SAML provider for SAP HANA Cloud database.<br><br>**Note**: To grant a role created with the role group assigned, the object privilege OPERATOR on the role group is required. | The service account must have the system privilege assigned to it with the **Grantable to other user and groups** flag enabled. |