SAP Hana security & authorization

April 26th, 2016

 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|2
SAP HANA, Business Suite or BW powered by
HANA & S/4 HANA
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|4
Traditional Security Architecture

Client

Application

Authentication Identity Encryption

Store
Authorization Audit Logging
Application Server

DB
 Hana Security Architecture

Client SAP HANA Client

Client Studio
Application (admin & dev)
Server
Application
Application
Authentication Identity Encryption XS Engine
Store
Authorization Audit Logging
Authentication Identity Encryption
Application Server Store
Authorization Audit Logging
SAP HANA
DB

Traditional HANA
 Integrative Authorization Scenarios

Client Client Client Client

Application Server Application Server

(e.g. ECC or BW) (e.g. ECC or BW)

SAP HANA Source SAP HANA SAP HANA

replication

Traditional Data mart (3-tier or 2-tier) Native 2-tier application

• DB migration to HANA • Reporting ERP or BW data in
HANA
 No changes to security • Direct user access to HANA
model
 Modified security model
• HANA act as DB &
Application Server
• Direct user access to HANA
 Integrated security model
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|8
SAP HANA Security Functions (overview)

Application

XS Engine

Authentication Identity Encryption

Store

Authorization Audit Logging

SAP HANA
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|10
Authorization Entities

Goal
• Create user
User • Person accessing the system

• Manage users
• Collection of privileges
• Assign security Role • Granted to user or another role

Privilege • Restrict operations on objects

Object • E.g. a table, a view, …

• Particular object: stored procedure
Authorization Entities

Stored procedure
• SQL statement

• Standard behaviour:
 invoker authorizations checked
• Definer behaviour:
 creator authorizations checked

• Best practice: control who can create stored procedure

in definer behaviour
 Entities relations

owns
Object

granted
to
Role

Attention
• Action “grant” is also considered
Privilege Role Role
as an object !

 “grant” is owned by his creator

Best practice : Role Privilege

Repository vs Catalog (2 ways of working)
Repository Catalog

Object definition Object

(e.g. table def.) (e.g. table)

• Store for design-time • Run-time

• Owner: _SYS_REPO
• When activated, owner of
run-time object = _SYS_REPO

_SYS_REPO
Repository vs Catalog (2 ways of working)
Repository Catalog

Object definition Object

(e.g. table def.) (e.g. table)

• +/- DB definition
Design time
• +/- DB content
• Packages & subpackages Run-time object

• Package privilege • Not transportable

• Rep. object type: • Creator = user

 data models (views)
 analytical privileges • Creator deleted -> all linked objects
 repository roles deleted

• Transportable (DEV, QA, PRD)

• Owner = technical user _SYS_REPO

• When activated, owner of run-time object = _SYS_REPO
 Entities relations

owns
Object

granted
to
Role

Attention
• Action “grant” is also considered
Privilege Role Role
as an object !

 “grant” is owned by his creator

Best practice : Role Privilege

Authorization Entities: user
User type
• DB users User
 real user
 deletable
 all “owned” objects deleted
 all privileged “they granted” deleted Role
• Internal DB users
 not real user
 not deleted Privilege
 for most: no logon possible
 for admin tasks
 E.g. technical user _SYS_REPO
Object
Authorization Entities: user
Single user maintenance
• Create 1 user directly in HANA User
 attention: no first name, last name, department, function, … !
 only user id & email address

Role

Privilege

Object
Authorization Entities: user
Single user maintenance
• Replication from ABAP user to HANA user User
• Maintenance of DBMS (database management system) users in SU01
 create / delete a DBMS user
 delete the assigned DBMS user when ABAP user is deleted
Role

Privilege

Object
 Authorization Entities: user
Single user maintenance
User

Result in HANA:
Role

Privilege

Object
Authorization Entities: user
User mass maintenance
• Via: ABAP program RSUSR_DBMS_USERS User
 mass mapping of ABAP users to DBMS users.
 if DBMS user does not exist -> will be created in the DB system.
 assign or unassign DBMS Roles to/from DBMS users.
Role

Privilege

Object
Authorization Entities: user
User mass maintenance
• Other solutions: User
 via tools (IDM, …)
 via own automation (SQL script)

Role

Privilege

Object
Authorization Entities: role
Repository roles
• Transportable (DEV, QA, PRD)
No need to have privilege to grant
•
it to the role
• Grantor can grant/revoke all roles
if he can execute the “Grant
Activated Role” stored procedure
 Use “with grant option” for
_SYS_REPO
 SOD possible btw creation,
ownership & granting
Best practice
Catalog roles
User
• Not transportable
• Need to have privilege to
grant it to the role Role
• Only grantor can revoke
role
Privilege
 Privileges are transitive
(removed from grantor ->
removed from role)
Object
 If grantor is deleted ->
privileges are revoked
Not recommended
 Authorization Entities: role(assignment)
Repository Catalog
User
Role
(origin:
catalog)
Role

Privilege

Object

Best practice :
Not recommended:
 Authorization Entities: role(assignment)
Repository Catalog
User
Role
Role (origin:
activate repository)
Role
owner = _SYS_REPO
own
Privilege
_SYS_REPO

Object
stored
procedure
(via “Granted
Best practice : Roles”)
Not recommended:
Authorization Entities: role(assignment)

User

Role

Privilege

Object

stored
procedure
execution
 Authorization Entities: privilege (overview)

User
Client

• Application privilege Role

Application
XS Engine
Privilege
• package
• table • Object privilege
• Package Object
privilege

• view • Analytic privilege

SAP HANA

• System privilege
Authorization Entities: privilege (overview)

System Privilege • Admin tasks

User

Application • HANA applications Role

Privilege (XS engine)

• Access & use of packages

Privilege
Privilege Package Privilege
in repositories

Object
Object Privilege • SQL statements on DB objects

Analytic Privilege • Provide row-level

authorizations
Authorization Entities: privilege (system priv.)

System Privilege User

• System-wide privilege System Privilege

• Cannot be created or changed Role

Appl. Priv.
• Authorize user for admin tasks:
 Users & roles mngt
 Catalog & repository mngt
 Auditing
Pack. Priv. Privilege
 System mngt
 Data import/export
Obj. Priv.
Object

Analyt. Priv.
Authorization Entities: privilege (system priv.)

System Privilege User

Role

Privilege

Object
Authorization Entities: privilege (application priv.)

Application Privilege
Syst. Priv.
User
• Grant access to HANA based
applications
 e.g. to access the Web IDE
interface application
Application Role
Privilege
(sap.hana.xs.ide)

• Used by HANA application developers

Pack. Priv. Privilege

Obj. Priv.
Object

Analyt. Priv.
Authorization Entities: privilege (application priv.)

Application Privilege
Authorization Entities: privilege (package priv.)

Package Privilege
Syst. Priv.
User
• Only for developers & modelers

• Access & use of packages in the

repository
Role
Appl. Priv.

• Hierarchical access to packages &

Package
corresponding sub-packages
Privilege Privilege
• Packages contains objects such as:
 object privileges
Obj. Priv.
 Hana views Object
 …

Analyt. Priv.
Authorization Entities: privilege (package priv.)

Package Privilege
Authorization Entities: privilege (object priv.)

Object Privilege
Syst. Priv.
User
• Are linked to an object

• Restrict access on DB objects

(e.g. table, view)
Role
Appl. Priv.

• Actions:
 select
 update / create
Pack. Priv. Privilege
 delete
 …
Object Privilege
Object

Analyt. Priv.
Authorization Entities: privilege (object priv.)

Object Privilege
Authorization Entities: privilege (analytic priv.)

Analytic Privilege
Syst. Priv.
User
• Control access to data with row-level
authorization
Role
Appl. Priv.

Pack. Priv. Privilege

Obj. Priv.
Object

Analytic Privilege

• Dynamic analytic privilege can be

created
Authorization Entities: privilege (analytic priv.)
Table “User_Region” :
User_Name Region Position

Dynamic analytic privilege User1 America Manager

User2 Asia Employee

User3 Europe Manager

SQL dynamic analytic privilege:
Authorization Entities: privilege (analytic priv.)

Dynamic analytic privilege Assign the dynamic procedure to the analytic privilege:
 Authorization Entities: privilege (analytic priv.)

• Dynamic analytic privilege

Syst. Priv.
User
 ease of maintenance
 filter obtained from a stored
procedure with a complex logic Role
Appl. Priv.
 e.g. check user’s region from a table

Pack. Priv. Privilege

user 1 restrictions
user 1
Obj. Priv.
user 2 restrictions Object
user 2 View
user 3 restrictions Analytic Privilege
dynamic
privilege
user 3
Authorization Entities: privilege (summary)

User
Access a table/ view Access a specific column
via object privilege via a created view
Role

Privilege
Access a row via
analytic privilege
Object

 1 displayed view = object priv (access to the table/view) + analytic priv (filters for that table)
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|42
Security Administration

SAP HANA Studio XS Web Interface

2 possibilities:

Client
SAP HANA
Studio
Admin

Application Admin
XS Engine

SAP HANA
 Security Administration (role: repository vs catalog)
Repository Catalog

Role creation:
Design-time Run-time

SAP HANA
Best practice : Security Administration
Not recommended:
XS Web Interface SAP HANA Studio
 Security Administration (user: repository vs catalog)
Repository Catalog

User creation:
Design-time Run-time

SAP HANA
Best practice : Security Administration
Not recommended:
XS Web Interface SAP HANA Studio
 Security Administration (role assignment: repository vs catalog)
Repository Catalog

Role assignment:
Design-time Run-time

SAP HANA
Best practice : Security Administration
Not recommended:
XS Web Interface SAP HANA Studio
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|47
Tools to replicate authorizations

When is it needed ?
• When there is a direct connection to SAP HANA

For BW authorizations:
• SAP HANA Model Generation
 part of BW
 replicate ABAP authorizations (BW Analysis Authorizations) in HANA Analytic Privileges
o generate analytic priv.
o update analytic priv.
Tools to replicate authorizations

For ECC authorizations:

• SAP HANA Live Authorization Assistant
 SAP HANA Studio add-on
 Replicate ABAP PFCG
authorizations in HANA Privileges
o generate analytic priv.
o update analytic priv.

Attention !
 SAP HANA privileges are less granular than authorizations in application layer
 therefore: all BW/ECC authorizations are not supported in HANA
Tools to replicate authorizations

Impact to GRC
• In GRC user provisioning flow
 if no replication, use Business Roles in GRC
Replication scenario: No replication scenario:

GRC GRC
assigned
Composite Role Business Role
BW
 Single roles  BW Composite roles
 HANA roles
corresponding
HANA roles
assigned
assigned assigned

HANA
HANA BW
• HANA rule Set in GRC
 limited to IT maintenance & development*
 What we will cover

1. SAP HANA, Powered by HANA & S/4 HANA

2. Security Architecture & Authorization Scenarios

3. SAP HANA Security Functions (overview)

4. Authorization Concept

5. Security Administration

6. Tools to replicate authorizations

7. Tips & Tricks

|51
Tips & tricks

Tips & tricks:

• Create roles in Design-time (repository roles).
• Ensure you are in the repository when working with the HANA Studio or the XS Web Interface
for role creation.
• Transfer ownership of all what you have created in the repository to _SYS_REPO to avoid issues
if your user is deleted.
• Transport roles from DEV to QA & PRD & activate them on each system to have _SYS_REPO as
the owner of the run-time roles.
• Assign roles via “Granted Roles” (executing stored procedure (via user _SYS_REPO)).
• Control who can create stored procedure in define behaviour to mitigate the risk of abuse.

• Create a similar design to the 2 layer model to keep it clear.

• Even if there is no limit on # of privileges assigned ( >< ECC 312 max profiles), be logical in
grouping the views.
• SAP template roles are too wide. Create custom roles instead.
• Restrict access to only the needed packages for modellers.
Tips & tricks

Tips & tricks:

• System privileges cannot be created/changed. Use stored procedures for a more granular
approach.
• Ensure the new custom XS HANA applications created by developers are secured to avoid
exposing the DB.

• If the user has not the full access to a view, the user will see partial data (only authorized
data). >< with BI were the user has no results in that case.
• If a filter is applied to 1 view in an analytical privilege, it will apply to all views in the analytical
privilege.
• Dynamic analytic privileges can be used to have an ease of maintenance but be aware that
it will reduce transparency in authorizations !

• Use a tool to replicate BW & ECC authorizations to HANA authorizations.

• Note that HANA rule set in GRC is limited to IT maintenance & development.
Tips & tricks

Don’t forget the important Security Notes:

• 2197397: SAP HANA Extended Application Services (XS) has a Buffer Overflow vulnerability.
• 2197428: Potential remote code execution in HANA.
• 2197459: Potential log injection vulnerability in SAP HANA audit log.
• …
Thanks for listening! Any questions?

Christophe Decamps
Consultant
Governance, Risk & Compliance

+32 473 720 125

christophe.decamps@expertum.net

www.expertum.net
Inspire by Experience.