SAP Lumira Server on HANA - Part 2

[poovin2749]

This blog is the continuation of my previous blog post about SAP Lumira Server on HANA. In this blog we will explore the post install configurations and role assignments for Lumira Server.

For a step by step instruction on SAP Lumira server installation, please read my previous blog about installation.

To make use of the Lumira server installed on top of HANA, we need to perform the following tasks.

• Create a dedicated HANA account for SAP Lumira and assign BI Technical user role for Lumira user.
• Configure the SQLCC connection for SAP Lumira server.
• Assign Analyst/Consumer role for users.

Prerequisites

To perform post install configurations, the user performing these tasks should have the following roles in HANA server.

• USER ADMIN – To create Lumira technical user
• ROLE ADMIN – To assign roles to other users.
• sap.hana.xs.admin.roles::SQLCCAdministrator – To configure SQLCC connection for tech user.
• sap.hana.xs.admin.roles::RuntimeConfAdministrator – To edit configurations in HANA XS admin console.
• Execute privilege on _SYS_REPO schema to grant roles through stored procedures.

Step 1

Create a user account for Lumira and assign Lumira technical user role for that user. The following set of SQL statements can do the job.

create user LUMIRA password Init123 maximum_password_lifetime 3650;

call _SYS_REPO.GRANT_ACTIVATED_ROLE(‘sap.bi.common::BI_TECH_USER’,’LUMIRA’);

These statements will create a user account with name LUMIRA with initial password of Init123 and password life time of 10 years. Lumira tech user role is assigned to the account by the stored procedure “GRANT_ACTIVATED_ROLE”. Please reset the initial password before using the Lumira account.

Step 2

Now login to HANA XS admin console and select “XS Applications” menu. The HANA XS admin console is hosted as Web application in HANA XS engine and the URL to access the console will have the following format.

http://<hostname/ip_address>:80<instance_number>/sap/hana/xs/admin

Once the XS Applications menu is selected, it will list all the packages available in the repository.

XS Applications Menu

Step 3

Select the “RepoConnection.xssqlcc” file located under the package “sap -> bi -> launchpad -> logic -> v2”.

Package Hierarchy

Step 4

Now enter the Lumira technical user name in “user” field of the “SQL Connection” section. The technical user name is case sensitive and please use BLOCK letters to avoid issues. Once the user name is entered, click “Save” button to complete connection configuration.

SQL Connection

If the SQL connection is not configured/misconfigured, the following error will be thrown by Lumira during publishing stories/datasets to Lumira server.

“Error - The dataset could not be published to SAP Lumira Server because publishing to the SAP HANA layer failed. Reason is (HDB 11009)”

The SQL connection is configured and so the post install configurations are completed. However client tool configuration and role assignments has to be done for users to make use of Lumira server.

Client Tool Configuration

Launch Lumira client tool and select “File -> Preferences -> Network” and enter the hana server BI Launchpad URL in the “SAP Lumira Server” field. The URL format is http://<hostname/ip_address>:80<instance>/sap/bi/launchpad.

Lumira Client Configuration

The client tool in configured and now we can publish Lumira objects to HANA repository.

Role Assignments

Data Analyst Role

Data Analyst role should be granted to the person who will develop Visualizations and publish it to the server. This role will include rights to publish objects to server, consume data and access launchpad.

SQL syntax to grant the Analyst role

Call _SYS_REPO.GRANT_ACTIVATED_ROLE(‘sap.bi.common::BI_DATA_ANALYST’,’USER’);

Data Consumer Role

Data Consumer role should be granted to person who will just view the Lumira visualizations published in the server. The user with this role can access launchpad and view Lumira stories published in the server.

SQL syntax to grant the Analyst role

Call _SYS_REPO.GRANT_ACTIVATED_ROLE(‘sap.bi.common::BI_DATA_CONSUMER’,’USER’);

Please avoid assigning both roles to same user. Analyst role includes consumer rights, so he does not need Consumer role and providing Analyst role to Consumer will elevate his privileges. The data level restrictions are still controlled by the “Analytical Privileges” configured in the HANA server.

Now the Lumira server is configured and ready for use. That’s it!.. We have installed and configured Lumira server on HANA. Please keep following our blogs for more information on Lumira.

[Former Member]

Is there a way to limit the roles that are available for sharing with in Lumira Server? There are a lot of default roles out created in HANA, and I don't want users to have to go through all of them.

[poovin2749]

Hi James,

All these Default roles provide specific rights to users. As far as i know, we cannot limit these roles. They get generated as part of DU activation.

Thanks,

Poovin.

[Former Member]

Hi James,

When sharing offline (e.g. based on CSV or Excel) datasets, only the roles the user (performing the sharing action) belongs to should be displayed.

When sharing online (e.g. based on HANA views) datasets, only the roles that have appropriate SQL and analytical privileges granted (against the underlying HANA view) should be displayed.

When sharing stories based on the (both online and offline) datasets, the datasets have to be shared first, and then only the roles the datasets were shared with will be displayed.

Please take a look at Chapter 2.2 "Viewing datasets created in SAP HANA" in Lumira Server User Guide:

http://help.sap.com/businessobject/product_guides/vi01/en/lumS119_user_en.pdf

Regards,

Boris

[Former Member]

Dear Poovin,

Thank you very much for the information provided. It's really helpful and structured.

If possible please let me know  how user provisioning will work. Do we need to create users from HANA studio ?

Thank you,

Shanaka.

[poovin2749]

Hi Shanaka,

Since Lumira server runs on top of HANA platform, it allows only users in HANA system to access Lumira services. Users can be provisioned by creating them in HANA Studio/SQL query using a sql client.

However the users in HANA system should be assigned roles related to Lumira/BI Launchpad/Analysis etc.. to access these services.

Thanks,

Poovin.

[Former Member]

HI Poovin,

Thank you very much for the answer.

Please let me know whether these roles will come automatically once we import lumira delivery units to HANA.

Also suppose we are planing to import these lumira services to Fiori front end in this case you have any idea on how can we set up Single sign on between Fiori launch pad and lumira on HANA.

Regards,

Shanaka.

[poovin2749]

Hi Shanaka,

Yes, these roles will get generated when you import the Lumira Delivery Unit.

Reg Lumira - Fiori integration, recent releases of Lumira has a minimalistic install of Fiori packed with it. So if you are expecting Fiori Launchpad, you can make use of that. No need of any specific configs for SSO. Both of them are hosted in the same XS Engine of HANA and SSO will work by default.

Thanks,

Poovin.

[Former Member]

I have found that Fiori SSO does not work even when Lumira SSO does work. I've also seen Lumira SSO work in the browser but not on the desktop app (I'm assuming that is something to do with my internal security).