Technology Blogs by SAP
Learn how to extend and personalize SAP applications. Follow the SAP technology blog for insights into SAP BTP, ABAP, SAP Analytics Cloud, SAP HANA, and more.
Showing results for 
Search instead for 
Did you mean: 
0 Kudos
You installed XSA with MDC and you assigned your application in a organization / space to a logical database. This assignment can be done in XSA Admin in Service Broker Config (l#/serviceBrokerConfig)

Now the identity propagation fails.

The reason is that there is not automatic trust between UAA and HANA MDC. The trust creation will come with HANA 2 SP01 during MDC creation. The installation creates a trust to system DB only.

You can create this trust with the attached bash script yourself. You need to following parameters to do this.

  • system user (of logical database)

  • system password (of logical database)

  • xsa admin user (is optional but if you provide this name this user is enable to logon with SAML / JWT)

  • jdbcURL This URL can be taken from uaa.log. In case you can create trust to a logical database you need the database name

Step 1

Download the files from to your XSA machine.

Step 2

Prepare execute. Configure settings in xsuaa_settings.cfg. Example for HANA with SID : XSA on instance 00 with logical database ABC
XSA_UAA_ENDPOINT="https://`hostname -f`:30032/uaa-security"
# documentation about jdbc url, see
# this is the jdbc url for a multiple instance database with connect to tenant DB ABC
JDBC_HANA_ENDPOINT="jdbc:sap://`hostname -f`:30013/?databaseName=ABC"

Save this to file xsuaa_settings.cfg

Step 3

Execute the shell script Best you execute it on the XSA instance under the <sid>adm user of your XSA installation, however you can also call if from another machines. For xs login you need xs command tool.
 ./ xsuaa_settings.cfg

The script creates the trust and executes the test. Typical successful output is:


In case you can here an error you can check in uaa.log the error reason or in HANA trace you will find the reason.
0 Kudos
Am I correct, that I have to modify the SQL Port accordingly to the Tennants sql port, on which Iam working? Thanks in advance
0 Kudos
Hi Dominik,

if you are on MDC then you always use 30013 but set DB tenant by query, e.g. ABC as tenant db name

”jdbc:sap://`hostname -f`:30013/?databaseName=ABC
0 Kudos
I've modified the .cfg file.

Create oauth token....
...retrieved token
Create Trust via REST call

Response failed with HTTP errror: 000

uaa.log doesn't have errors

Any idea ?