Adding a Connection to SAP HANA

1. In the application console, navigate to the Connections page.
2. At the Add Connections panel, select the icon for the connection you want to add.
3. If the SAP HANA icon is not available, click the Add More icon to download and install the SAP HANA connector from the CData site.

For required properties, see the Settings tab.

For connection properties that are not typically required, see the Advanced tab.

Connecting to SAP HANA Cloud

• Server: Set this property to the name or network address of the SAP HANA database instance.
• Port: Set this to 443.
• UseSSL: Set this to True.

Connecting to SAP HANA On-Prem

Set the following to connect to data:

• Server: Set this property to the name or network address of the SAP HANA database instance.
• Port: The port of the server hosting the SAP HANA database.

Authenticating to SAP HANA

Once you have provided the connection details, set the following database credentials to authenticate to SAP HANA:

• User: The username provided for authentication with the SAP HANA database.
• Password: The password provided for authentication with the SAP HANA database.

Okta

Set the AuthScheme to Okta. The following connection properties are used to connect to Okta:

• User: Set this to the Okta user.
• Password: Set this to Okta password for the user.
• SSOProperties (optional): Set this to the OTP code that was sent to your device. This property should be used only when MFA is required for OKTA sign on.

The following SSOProperties are needed to authenticate to Okta:

• SSOLoginUrl: Set this to the OKTA's login URL.
• MFAType (optional): Set this to the multi-factor type. This property should be used only when MFA is required for OKTA sign on. This property accepts one of the following values:
  • OKTAVerify
  • Email
  • SMS
• APIToken (optional): Set this to the API Token that the customer created from the Okta org. It should be used when authenticating a user via a trusted application or proxy that overrides OKTA client request context.

The following is an example connection string:

AuthScheme=OKTA;User=username;Password=password;Server=myserver;SSO Properties='SSOLoginUrl=https://cdata-okta.okta.com';

This section details a selection of advanced features of the SAP HANA Sync App.

SSL Configuration

Use SSL Configuration to adjust how Sync App handles TLS/SSL certificate negotiations. You can choose from various certificate formats; see the SSLServerCert property under "Connection String Options" for more information.

Firewall and Proxy

Configure the Sync App for compliance with Firewall and Proxy, including Windows proxies. You can also set up tunnel connections.

Logging

See Logging for an overview of configuration settings that can be used to refine CData logging. For basic logging, you only need to set two connection properties, but there are numerous features that support more refined logging, where you can select subsets of information to be logged using the LogModules connection property.

Customizing the SSL Configuration

By default, the Sync App attempts to negotiate SSL/TLS by checking the server's certificate against the system's trusted certificate store.

To specify another certificate, see the SSLServerCert property for the available formats to do so.

Client SSL Certificates

The SAP HANA Sync App also supports setting client certificates. Set the following to connect using a client certificate.

• SSLClientCert: The name of the certificate store for the client certificate.
• SSLClientCertType: The type of key store containing the TLS/SSL client certificate.
• SSLClientCertPassword: The password for the TLS/SSL client certificate.
• SSLClientCertSubject: The subject of the TLS/SSL client certificate.

Connecting Through a Firewall or Proxy

Set the following properties:

• To use a proxy-based firewall, set FirewallType, FirewallServer, and FirewallPort.
• To tunnel the connection, set FirewallType to TUNNEL.
• To authenticate, specify FirewallUser and FirewallPassword.
• To authenticate to a SOCKS proxy, additionally set FirewallType to SOCKS5.

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.

Authentication

SSO

SSL

SSH

Firewall

Logging

Schema

Miscellaneous

This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.

The scheme used for authentication. Accepted entries are Password.

Remarks

The scheme used for authentication. Accepted entries are Password.

The name of the server running SAP HANA database.

Remarks

Set this property to the name or network address of the SAP HANA database instance.

The port of the SAP HANA database.

Remarks

The port of the Server hosting the SAP HANA Database.

The name of the SAP HANA database.

Remarks

The name of the SAP HANA database running on the specified Server.

The SAP HANA user account used to authenticate.

Remarks

Together with Password, this field is used to authenticate against the SAP HANA server.

The password used to authenticate the user.

Remarks

The User and Password are together used to authenticate with the server.

Set IncludeSystemObjects to True to fetch Hana System schema and tables.

Remarks

Set `IncludeSystemObjects` to True to fetch Hana System schema and tables. By default, this property is set to False to avoid listing the large number of system tables in the metadata listing.

This field sets whether SSL is enabled.

Remarks

This field sets whether the Sync App will attempt to negotiate TLS/SSL connections to the server. By default, the Sync App checks the server's certificate against the system's trusted certificate store. To specify another certificate, set SSLServerCert.

This section provides a complete list of the SSO properties you can configure in the connection string for this provider.

Additional properties required to connect to the identity provider in a semicolon-separated list.

Remarks

Additional properties required to connect to the identity provider in a semicolon-separated list. The following sections provide examples using the Okta provider.

OKTA

• Domain is the Okta domain you are signing in with, for example: myorg.okta.com.
• APIToken is your Okta API token. In most cases it is unnecessary but can be provided if needed.

This section provides a complete list of the SSL properties you can configure in the connection string for this provider.

The TLS/SSL client certificate store for SSL Client Authentication (2-way SSL).

Remarks

The name of the certificate store for the client certificate.

The SSLClientCertType field specifies the type of the certificate store specified by SSLClientCert. If the store is password protected, specify the password in SSLClientCertPassword.

SSLClientCert is used in conjunction with the SSLClientCertSubject field in order to specify client certificates. If SSLClientCert has a value, and SSLClientCertSubject is set, a search for a certificate is initiated. See SSLClientCertSubject for more information.

Designations of certificate stores are platform-dependent.

The following are designations of the most common User and Machine certificate stores in Windows:

In Java, the certificate store normally is a file containing certificates and optional private keys.

When the certificate store type is PFXFile, this property must be set to the name of the file. When the type is PFXBlob, the property must be set to the binary contents of a PFX file (for example, PKCS12 certificate store).

The type of key store containing the TLS/SSL client certificate.

Remarks

This property can take one of the following values:

The password for the TLS/SSL client certificate.

Remarks

If the certificate store is of a type that requires a password, this property is used to specify that password to open the certificate store.

The subject of the TLS/SSL client certificate.

Remarks

When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property. If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks the first certificate in the certificate store.

The certificate subject is a comma separated list of distinguished name fields and values. For example, "CN=www.server.com, OU=test, C=US, [email protected]". The common fields and their meanings are shown below.

If a field value contains a comma, it must be quoted.

The certificate to be accepted from the server when connecting using TLS/SSL.

Remarks

If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine is rejected.

This property can take the following forms:

If not specified, any certificate trusted by the machine is accepted.

Use '*' to signify to accept all certificates. Note that this is not recommended due to security concerns.

This section provides a complete list of the SSH properties you can configure in the connection string for this provider.

The authentication method used when establishing an SSH Tunnel to the service.

Remarks

• None: No authentication is performed. The current User value is ignored, and the connection is logged in as anonymous.
• Password: The Sync App uses the values of User and Password to authenticate the user.
• Public_Key: The Sync App uses the values of User and SSHClientCert to authenticate the user. SSHClientCert must have a private key available for this authentication method to succeed.

A certificate to be used for authenticating the SSHUser.

Remarks

SSHClientCert must contain a valid private key in order to use public key authentication. A public key is optional, if one is not included then the Sync App generates it from the private key. The Sync App sends the public key to the server and the connection is allowed if the user has authorized the public key.

The SSHClientCertType field specifies the type of the key store specified by SSHClientCert. If the store is password protected, specify the password in SSHClientCertPassword.

Some types of key stores are containers which may include multiple keys. By default the Sync App will select the first key in the store, but you can specify a specific key using SSHClientCertSubject.

The password of the SSHClientCert key if it has one.

Remarks

This property is only used when authenticating to SFTP servers with SSHAuthMode set to PublicKey and SSHClientCert set to a private key.

The subject of the SSH client certificate.

Remarks

When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks the first certificate in the certificate store.

The certificate subject is a comma separated list of distinguished name fields and values. For instance "CN=www.server.com, OU=test, C=US, [email protected]". Common fields and their meanings are displayed below.

If a field value contains a comma it must be quoted.

The type of SSHClientCert private key.

Remarks

This property can take one of the following values:

The SSH server.

Remarks

The SSH server.

The SSH port.

Remarks

The SSH port.

The SSH user.

Remarks

The SSH user.

The SSH password.

Remarks

The SSH password.

The SSH server fingerprint.

Remarks

The SSH server fingerprint.

Whether to tunnel the SAP HANA connection over SSH. Use SSH.

Remarks

By default the Sync App will attempt to connect directly to SAP HANA. When this option is enabled, the Sync App will instead establish an SSH connection with the SSHServer and tunnel the connection to SAP HANA through it.

This section provides a complete list of the Firewall properties you can configure in the connection string for this provider.

The protocol used by a proxy-based firewall.

Remarks

This property specifies the protocol that the Sync App will use to tunnel traffic through the FirewallServer proxy.

The name or IP address of a proxy-based firewall.

Remarks

This property specifies the IP address, DNS name, or host name of a proxy allowing traversal of a firewall. The protocol is specified by FirewallType: Use FirewallServer with this property to connect through SOCKS or do tunneling.

The TCP port for a proxy-based firewall.

Remarks

This specifies the TCP port for a proxy allowing traversal of a firewall. Use FirewallServer to specify the name or IP address. Specify the protocol with FirewallType.

The user name to use to authenticate with a proxy-based firewall.

Remarks

The FirewallUser and FirewallPassword properties are used to authenticate against the proxy specified in FirewallServer and FirewallPort, following the authentication method specified in FirewallType.

A password used to authenticate to a proxy-based firewall.

Remarks

This property is passed to the proxy specified by FirewallServer and FirewallPort, following the authentication method specified by FirewallType.

This section provides a complete list of the Logging properties you can configure in the connection string for this provider.

Core modules to be included in the log file.

Remarks

Only the modules specified (separated by ';') will be included in the log file. By default all modules are included.

See the Logging page for an overview.

This section provides a complete list of the Schema properties you can configure in the connection string for this provider.

A path to the directory that contains the schema files defining tables, views, and stored procedures.

Remarks

The path to a directory which contains the schema files for the Sync App (.rsd files for tables and views, .rsb files for stored procedures). The folder location can be a relative path from the location of the executable. The Location property is only needed if you want to customize definitions (for example, change a column name, ignore a column, and so on) or extend the data model with new tables, views, or stored procedures.

If left unspecified, the default location is "%APPDATA%\\CData\\SAPHANA Data Provider\\Schema" with %APPDATA% being set to the user's configuration directory:

This property restricts the schemas reported to a subset of the available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC.

Remarks

Listing the schemas from databases can be expensive. Providing a list of schemas in the connection string improves the performance.

This property restricts the tables reported to a subset of the available tables. For example, Tables=TableA,TableB,TableC.

Remarks

Listing the tables from some databases can be expensive. Providing a list of tables in the connection string improves the performance of the Sync App.

This property can also be used as an alternative to automatically listing views if you already know which ones you want to work with and there would otherwise be too many to work with.

Specify the tables you want in a comma-separated list. Each table should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Tables=TableA,[TableB/WithSlash],WithCatalog.WithSchema.`TableC With Space`.

Note that when connecting to a data source with multiple schemas or catalogs, you will need to provide the fully qualified name of the table in this property, as in the last example here, to avoid ambiguity between tables that exist in multiple catalogs or schemas.

Restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC.

Remarks

Listing the views from some databases can be expensive. Providing a list of views in the connection string improves the performance of the Sync App.

This property can also be used as an alternative to automatically listing views if you already know which ones you want to work with and there would otherwise be too many to work with.

Specify the views you want in a comma-separated list. Each view should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Views=ViewA,[ViewB/WithSlash],WithCatalog.WithSchema.`ViewC With Space`.

Note that when connecting to a data source with multiple schemas or catalogs, you will need to provide the fully qualified name of the table in this property, as in the last example here, to avoid ambiguity between tables that exist in multiple catalogs or schemas.

The schema of the SAP Hana database.

Remarks

The schema of the SAP Hana database.

This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.

When enabled, inserts DATE, TIME, SECONDDATE, and TIMESTAMP values as empty strings that are returned as NULLs.

Remarks

When enabled, inserts DATE, TIME, SECONDDATE, and TIMESTAMP values as empty strings that are returned as NULLs.

If set to true, the provider will report the types of individual tables and views.

Remarks

If set to true, the Sync App will report the types of individual tables and views.

Limits the number of rows returned when no aggregation or GROUP BY is used in the query. This takes precedence over LIMIT clauses.

Remarks

Limits the number of rows returned when no aggregation or GROUP BY is used in the query. This takes precedence over LIMIT clauses.

These hidden properties are used only in specific use cases.

Remarks

The properties listed below are available for specific use cases. Normal driver use cases and functionality should not require these properties.

Specify multiple properties in a semicolon-separated list.

Integration and Formatting

This option passes the query to the SAP HANA server as is.

Remarks

When this is set, queries are passed through directly to SAP HANA.

A comma-separated list of session variables to set on the current connection.

Remarks

A comma-separated list of session variables to set on the current connection. For example: 'APPLICATION=myapp,var1=value1,var2=value2[,...]'

A timeout for the provider.

Remarks

If the Timeout property is set to 0, operations will not time out; instead, they will run until they complete successfully or encounter an error condition.

If Timeout expires and the operation is not yet complete, the Sync App raises an error condition.