Question Re: HANA New User Creation - program/procedure/Script in Technology Q&A

HANA New User Creation - program/procedure/Script

hemanth_kumar21 — Thu, 09 Apr 2015 12:35:28 GMT

Hi Experts,

In SAP-ABAP-BASIS, The Tcode SU01 is to create a new user. The SU01 will call the program SAPMSUU0. We will get the program details through SE93. We can check the logic by going through the program.

In HANA we can create the new user like below (other way: CREATE USER.....):

I would like to know the program/procedure/Script which is running behind to create a USER? How to get the details?

Re: HANA New User Creation - program/procedure/Script

lbreddemann — Thu, 09 Apr 2015 12:39:57 GMT

SAP HANA doesn't have to run specific report or script in order to create a user.

In fact the user creation is a single SQL command (CREATE USER... ) and the SAP HANA Studio simply provides an UI to that.

Additional commands may be used to manage privileges, but the core functionality really is just a single command.

Anyhow, you can always activate the JDBC trace for your connection to see the exact commands that get send by SAP HANA Studio.

- Lars

Re: HANA New User Creation - program/procedure/Script

hemanth_kumar21 — Thu, 09 Apr 2015 13:11:01 GMT

Thanks a lot Lars for your Quick response.

As you said, User creation is a Single SQL command. I agree with your point.

Suppose if I am copying a user, it has to get the reference user details like roles, privileges....so many things.. So, There will be a single procedure which will do the total functionality by using individual scripts.

Anyway thanks for giving the JDBC trace Idea.

(I am going through your document for JDBC trace )

Re: HANA New User Creation - program/procedure/Script

lbreddemann — Thu, 09 Apr 2015 14:09:15 GMT

Well, there is no actual proper "copy user" functionality that would cover the role assignment.

If you look around a bit here on SCN you'll find plenty of approaches to deal with mass user creation, template users and "user copy".

Just use the search functionality.

Re: HANA New User Creation - program/procedure/Script

hemanth_kumar21 — Fri, 10 Apr 2015 09:37:43 GMT

Hi Lars,

As you said, I got so many links which covers "user copy" with role assignments in SCN except Kerberos and X509.

I want to create a user with Kerberos and X509 options(As the reference user having these checks). I am not able to get any syntax or example for the same.

CREATE USER - SAP HANA SQL and System Views Reference - SAP Library

Can you please suggest?

Re: HANA New User Creation - program/procedure/Script

lbreddemann — Fri, 10 Apr 2015 09:46:52 GMT

Ok, now this is a different question...

What exactly don't you understand from the documentation?

The WITH IDENTITY clause allows to specify addtional identity mechanisms, KERBEROS and X509 being two of them.

Now you would specify:

CREATE/ALTER USER...

WITH IDENTITY 'MY_KERBEROS_USERID' FOR KERBEROS

and likewise for X509.

Pinging : looks like there is a needs for better integration of the SQL Reference with the Security Guide and for SQL command examples.

- Lars

Re: HANA New User Creation - program/procedure/Script

Former Member — Fri, 10 Apr 2015 09:57:45 GMT

Hi Lars,

thanks for the heads-up, I'll discuss this with the documentation team.

Andrea

Re: HANA New User Creation - program/procedure/Script

hemanth_kumar21 — Fri, 10 Apr 2015 10:08:08 GMT

Hi Lars,

Thanks a lot.

Now I am able to create user with KERBEROS option.

Up to now I am trying with the below syntax


CREATE USER test_1 password Badpassword123  valid until '01.01.2016 'WITH IDENTITY 'MY_KERBEROS_USERID'  FOR KERBEROS ;

Could not execute 'CREATE USER test_1 password Badpassword123 valid until '01.01.2016 'WITH IDENTITY ...'

SAP DBTech JDBC: [257]: sql syntax error: incorrect syntax near "WITH": line 1 col 74 (at pos 74)

Now I have deleted the valid until '01.01.2016' and able to create user successfully.

I am almost done with my requirement

Trying with X509... Seems to be syntax error.


CREATE USER test_2 password Badpassword123  WITH IDENTITY 'MY_KERBEROS_USERID'  FOR KERBEROS 
'test' ISSUER for x509 ;