Skip to main content
Version: Development

SAP HANA database secrets engine

SAP HANA is one of the supported plugins for the database secrets engine. This plugin generates SAP HANA user credentials dynamically based on configured roles, and also supports Static Roles.

See the database secrets engine docs for more information about setting up the database secrets engine.

SAP HANA identifiers are case-folded to uppercase and reject hyphens, so generated usernames are always uppercased with any hyphens replaced by underscores before they are sent to HANA.

Capabilities​

Plugin NameRoot Credential RotationDynamic RolesStatic RolesUsername Customization
hana-database-pluginYesYesYesYes

Setup​

  1. Enable the database secrets engine if it is not already enabled:

    $ bao secrets enable database
    Success! Enabled the database secrets engine at: database/

    By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

  2. Configure OpenBao with the proper plugin and connection information:

    $ bao write database/config/my-hana-database \
        plugin_name="hana-database-plugin" \
        allowed_roles="my-role" \
        connection_url="hdb://{{username}}:{{password}}@hana.example.com:39041" \
        username="SYSTEM" \
        password="your-system-password"
    Success! Data written to: database/config/my-hana-database

  3. Configure a role that maps a name in OpenBao to an SQL statement to execute to create the database credential:

    $ bao write database/roles/my-role \
        db_name="my-hana-database" \
        creation_statements='CREATE USER {{name}} PASSWORD "{{password}}" NO FORCE_FIRST_PASSWORD_CHANGE VALID UNTIL '"'"'{{expiration}}'"'"';
                             GRANT SELECT ON SCHEMA SYSTEM TO {{name}};' \
        default_ttl="1h" \
        max_ttl="24h"
    Success! Data written to: database/roles/my-role

    The {{name}} and {{password}} fields will be populated by the plugin with dynamically generated values. The {{expiration}} field is also supported and is formatted 2006-01-02 15:04:05 (UTC). HANA enforces the VALID UNTIL clause server-side, so the role's own creation statement is enough to deactivate the user even without an explicit revoke.

Usage​

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate credentials.

  1. Generate a new credential by reading from the /creds endpoint with the name of the role:

    $ bao read database/creds/my-role
    Key                Value
    ---                -----
    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
    lease_duration     1h
    lease_renewable    true
    password           AbCdEf1234567890QwRtYi
    username           V_TOKEN_MY_ROLE_3PFW6T8RVMC8MBKZ8ZEF_1717000000

    The username is uppercased and underscore-separated because HANA identifiers are case-folded and reject hyphens.

API​

The full list of configurable options can be seen in the SAP HANA database plugin API page.

For more information on the database secrets engine's HTTP API please see the Database secrets engine API page.