SAP HANA – Data Replication Overview

SAP HANA Replication allows migration of data from source systems to SAP HANA database. Simple way to move data from existing SAP system to HANA is by using various data replication techniques.

System replication can be set up on the console via command line or by using HANA studio. The primary ECC or transaction systems can stay online during this process. We have three types of data replication methods in HANA system −

  • SAP LT Replication method
  • ETL tool SAP Business Object Data Service (BODS) method
  • Direct Extractor connection method (DXC)

SAP LT Replication Method

SAP Landscape Transformation Replication is a trigger based data replication method in HANA system. It is a perfect solution for replicating real time data or schedule based replication from SAP and non-SAP sources. It has SAP LT Replication server, which takes care of all trigger requests. Replication server can be installed as standalone server or can run on any SAP system with SAP NW 7.02 or above.

There is a Trusted RFC connection between HANA DB and ECC transaction system, which enables trigger based data replication in HANA system environment.

SAP LT Replication Method

Advantages of SLT Replication

  • SLT Replication method allows data replication from multiple source systems to one HANA system and also from one source system to multiple HANA systems.
  • SAP LT uses trigger based approach. It has no measureable performance impact in source system.
  • It also provides data transformation and filtering capability before loading to HANA database.
  • It allows real-time data replication, replicating only relevant data into HANA from SAP and non-SAP source systems.
  • It is fully integrated with HANA System and HANA studio.

Creating a Trusted RFC Connection in ECC system

On your source SAP system AA1 you want to setup a trusted RFC towards target system BB1. When it is done, it would mean that when you are logged onto AA1 and your user has enough authorization in BB1, you can use the RFC connection and logon to BB1 without having to re-enter user and password.

Using RFC trusted/trusting relationship between two SAP systems, RFC from a trusted system to a trusting system, password is no required for logging on to the trusting system.

Open SAP ECC system using SAP logon. Enter transaction number sm59 → this is transaction number to create a new Trusted RFC connection → Click on 3rd icon to open a new connection wizard → click on Create and new window will open.

SAP ECC System

RFC Destination ECCHANA (enter name of RFC destination) Connection Type − 3 (for ABAP system)

Go to Technical Setting

Enter Target host − ECC system name, IP and enter System number.

Technical Setting1

Go to Logon & Security tab, Enter Language, Client, ECC system user name and password.

Technical Setting2

Click on the Save option at the top.


Click on Test Connection and it will successfully test the connection.

RFC Connection Test

To Configure RFC connection

Run transaction − ltr (to configure RFC connection) → New browser will open → enter ECC system user name and password and logon.

Configure RFC Connection

Click on New → New Window will open → Enter configuration name → Click Next → Enter RFC Destination (connection name created earlier), Use search option, choose name and click next.

Create Configuration

In Specify Target system, Enter HANA system admin user name & password, host name, Instance number and click next. Enter No of Data transfer jobs like 007(it cannot be 000) → Next → Create Configuration.

Now go to HANA Studio to use this connection −

Go to HANA Studio → Click on Data Provisioning → choose HANA system

Hana System

Select source system (name of trusted RFC connection) and target schema name where you want to load tables from ECC system. Select tables you want to move to HANA database → ADD → Finish.

Source System

Selected tables will move to chosen schema under HANA database.

SAP HANA – Auditing

SAP HANA audit policy tells the actions to be audited and also the condition under which the action must be performed to be relevant for auditing. Audit Policy defines what activities have been performed in HANA system and who has performed those activities at what time.

SAP HANA database auditing feature allows monitoring action performed in HANA system. SAP HANA audit policy must be activated on HANA system to use it. When an action is performed, the policy triggers an audit event to write to audit trail. You can also delete audit entries in Audit trail.

In a distributed environment, where you have multiple database, Audit policy can be enabled on each individual system. For the system database, audit policy is defined in nameserver.ini file and for tenant database, it is defined in global.ini file.

Activating an Audit Policy

To define Audit policy in HANA system, you should have system privilege − Audit Admin.

Go to Security option in HANA system → Auditing


Under Global Settings → set Auditing status as enabled.

You can also choose Audit trail targets. The following audit trail targets are possible −

  • Syslog (default) − Logging system of Linux Operating System.
  • Database Table − Internal database table, user who has Audit admin or Audit operator system privilege he can only run select operation on this table.
  • CSV text − This type of audit trail is only used for test purpose in a non-production environment.

Audit Trail Target

You can also create a new Audit policy in the Audit Policies area → choose Create New Policy. Enter Policy name and actions to be audited.

Save the new policy using the Deploy button. A new policy is enabled automatically, when an action condition is met, an audit entry is created in Audit trail table. You can disable a policy by changing status to disable or you can also delete the policy.

SAP HANA – License Management

SAP HANA License management and keys are required to use HANA database. You can install or delete HANA License keys using HANA studio.

Types of License keys

SAP HANA system supports two types of License keys −

  • Temporary License Key − Temporary License keys are automatically installed when you install the HANA database. These keys are valid only for 90 days and you should request permanent license keys from SAP market place before expiry of this 90 days period after installation.
  • Permanent License Key − Permanent License keys are valid only till the predefine expiration date. License keys specify amount of memory licensed to target HANA installation. They can installed from SAP Market place under Keys and Requests tab. When a permanent License key is expired, a temporary license key is issued, which is valid for only 28 days. During this period, you have to install a permanent License key again.

There are two types of permanent License keys for HANA system −

  • Unenforced − If unenforced license key is installed and consumption of HANA system exceeds the license amount of memory, operation of SAP HANA is not affected in this case.
  • Enforced − If Enforced license key is installed and consumption of HANA system exceeds the license amount of memory, HANA system gets locked. If this situation occurs, HANA system has to be restarted or a new license key should be requested and installed.

There is different License scenarios that can be used in HANA system depending on the landscape of the system (Standalone, HANA Cloud, BW on HANA, etc.) and not all of these models are based on memory of HANA system installation.

How to Check License Properties of HANA

Right Click on HANA system → Properties → License

Check License Properties

It tells about License type, Start Date and Expiration Date, Memory Allocation and the information (Hardware Key, System Id) that is required to request a new license through SAP Market Place.

Install License key → Browse → Enter Path, is used to install a new License key and delete option is used to delete any old expiration key.

All Licenses tab under License tells about Product name, description, Hardware key, First installation time, etc.

SAP HANA – Authorization Methods

Authorization is checked when a user tries to connect to HANA database and perform some database operations. When a user connects to HANA database using client tools via JDBC/ODBC or Via HTTP to perform some operations on database objects, corresponding action is determined by the access that is granted to the user.

Privileges granted to a user are determined by Object privileges assigned on user profile or role that has been granted to user. Authorization is a combination of both accesses. When a user tries to perform some operation on HANA database, system performs an authorization check. When all required privileges are found, system stops this check and grants the requested access.

There are different types of privileges, which are used in SAP HANA as mentioned under User role and Management −

System Privileges

They are applicable to system and database authorization for users and control system activities. They are used for administrative tasks such as creating Schemas, data backups, creating users and roles and so on. System privileges are also used to perform Repository operations.

Object Privileges

They are applicable to database operations and apply to database objects like tables, Schemas, etc. They are used to manage database objects such as tables and views. Different actions like Select, Execute, Alter, Drop, Delete can be defined based on database objects.

They are also used to control remote data objects, which are connected through SMART data access to SAP HANA.

Analytic Privileges

They are applicable to data inside all the packages that are created in HANA repository. They are used to control modeling views that are created inside packages like Attribute View, Analytic View, and Calculation View. They apply row and column level security to attributes that are defined in modeling views in HANA packages.

Package Privileges

They are applicable to allow access to and ability to use packages that are created in repository of HANA database. Package contains different Modeling views like Attribute, Analytic and Calculation views and also Analytic Privileges defined in HANA repository database.

Application Privileges

They are applicable to HANA XS application that access HANA database via HTTP request. They are used to control access on applications created with HANA XS engine.

Application Privileges can be applied to users/roles directly using HANA studio but it is preferred that they should be applied to roles created in repository at design time.

Repository Authorization in SAP HANA Database

_SYS_REPO is the user owns all the objects in HANA repository. This user should be authorized externally for the objects on which repository objects are modeled in HANA system. _SYS_REPO is owner of all objects so it can only be used to grant access on these objects, no other user can login as _SYS_REPO user.


SAP HANA – Authentications

All SAP HANA users that have access on HANA database are verified with different Authentications method. SAP HANA system supports various types of authentication method and all these login methods are configured at time of profile creation.

Below is the list of authentication methods supported by SAP HANA −

  • User name/Password
  • Kerberos
  • SAML 2.0
  • SAP Logon tickets
  • X.509


User Name/Password

This method requires a HANA user to enter user name and password to login to database. This user profile is created under User management in HANA Studio → Security Tab.

Password should be as per password policy i.e. Password length, complexity, lower and upper case letters, etc.

You can change the password policy as per your organization’s security standards. Please note that password policy cannot be deactivated.

Username password


All users who connect to HANA database system using an external authentication method should also have a database user. It is required to map external login to internal database user.

This method enables users to authenticate HANA system directly using JDBC/ODBC drivers through network or by using front end applications in SAP Business Objects.

It also allows HTTP access in HANA Extended Service using HANA XS engine. It uses SPENGO mechanism for Kerberos authentication.



SAML stands for Security Assertion Markup Language and can be used to authenticate users accessing HANA system directly from ODBC/JDBC clients. It can also be used to authenticate users in HANA system coming via HTTP through HANA XS engine.

SAML is used only for authentication purpose and not for authorization.


SAP Logon and Assertion Tickets

SAP Logon/assertion tickets can be used to authenticate users in HANA system. These tickets are issued to users when they login into SAP system, which is configured to issue such tickets like SAP Portal, etc. User specified in SAP logon tickets should be created in HANA system, as it does not provide support for mapping users.

SAP Logon and Assertion Tickets

X.509 Client Certificates

X.509 certificates can also be used to login to HANA system via HTTP access request from HANA XS engine. Users are authenticated by certificated that are signed from trusted Certificate Authority, which is stored in HANA XS system.

User in trusted certificate should exist in HANA system as there is no support for user mapping.

Client Certificates

Single Sign On in HANA system

Single sign on can be configured in HANA system, which allows users to login to HANA system from an initial authentication on the client. User logins at client applications using different authentication methods and SSO allows user to access HANA system directly.

SSO can be configured on below configuration methods −

  • SAML
  • Kerberos
  • X.509 client certificates for HTTP access from HANA XS engine
  • SAP Logon/Assertion tickets

SAP HANA – Security Overview

Security means protecting company’s critical data from unauthorized access and use, and to ensure that Compliance and standards are met as per the company policy. SAP HANA enables customer to implement different security policies and procedures and to meet compliance requirements of the company.

SAP HANA supports multiple databases in a single HANA system and this is known as multitenant database containers. HANA system can also contain more than one multitenant database containers. A multiple container system always has exactly one system database and any number of multitenant database containers. AN SAP HANA system that is installed in this environment is identified by a single system ID (SID). Database containers in HANA system are identified by a SID and database name. SAP HANA client, known as HANA studio, connects to specific databases.

SAP HANA provides all security related features such as Authentication, Authorization, Encryption and Auditing, and some add on features, which are not supported in other multitenant databases.

Security Overview

Below given is a list of security related features, provided by SAP HANA −

  • User and Role Management
  • Authentication and SSO
  • Authorization
  • Encryption of data communication in Network
  • Encryption of data in Persistence Layer

Additional Features in multitenant HANA database −

  • Database Isolation − It involves preventing cross tenant attacks through operating system mechanism
  • Configuration Change blacklist − It involves preventing certain system properties from being changed by tenant database administrators
  • Restricted Features − It involves disabling certain database features that provides direct access to file system, the network or other resources.

SAP HANA User and Role Management

SAP HANA user and role management configuration depends on the architecture of your HANA system.

  • If SAP HANA is integrated with BI platform tools and acts as reporting database, then the end-user and role are managed in application server.
  • If the end-user directly connects to the SAP HANA database, then user and role in database layer of HANA system is required for both end users and administrators.

Every user wants to work with HANA database must have a database user with necessary privileges. User accessing HANA system can either be a technical user or an end user depending on the access requirement. After successful logon to system, user’s authorization to perform the required operation is verified. Executing that operation depends on privileges that user has been granted. These privileges can be granted using roles in HANA Security. HANA Studio is one of powerful tool to manage user and roles for HANA database system.

User Types

User types vary according to security policies and different privileges assigned on user profile. User type can be a technical database user or end user needs access on HANA system for reporting purpose or for data manipulation.

Standard Users

Standard users are users who can create objects in their own Schemas and have read access in system Information models. Read access is provided by PUBLIC role which is assigned to every standard users.

Standard Users

Restricted Users

Restricted users are those users who access HANA system with some applications and they do not have SQL privileges on HANA system. When these users are created, they do not have any access initially.

If we compare restricted users with Standard users −

  • Restricted users cannot create objects in HANA database or their own Schemas.
  • They do not have access to view any data in database as they don’t have generic Public role added to profile like standard users.
  • They can connect to HANA database only using HTTP/HTTPS.

SAP HANA – Excel Integration

Microsoft Excel is considered the most common BI reporting and analysis tool by many organizations. Business Managers and Analysts can connect it to HANA database to draw Pivot tables and charts for analysis.

Connecting MS Excel to HANA

Open Excel and go to Data tab → from other sources → click on Data connection wizard → Other/ Advanced and click on Next → Data link properties will open.

Connecting MS Excel to HANA Data Link Properties

Choose SAP HANA MDX Provider from this list to connect to any MDX data source → Enter HANA system details (server name, instance, user name and password) → click on Test Connection → Connection succeeded → OK.

It will give you the list of all packages in drop down list that are available in HANA system. You can choose an Information view → click Next → Select Pivot table/others → OK.

Select Pivot Table

All attributes from Information view will be added to MS Excel. You can choose different attributes and measures to report as shown and you can choose different charts like pie charts and bar charts from design option at the top.

SAP HANA – Excel Integration

Microsoft Excel is considered the most common BI reporting and analysis tool by many organizations. Business Managers and Analysts can connect it to HANA database to draw Pivot tables and charts for analysis.

Connecting MS Excel to HANA

Open Excel and go to Data tab → from other sources → click on Data connection wizard → Other/ Advanced and click on Next → Data link properties will open.

Connecting MS Excel to HANA Data Link Properties

Choose SAP HANA MDX Provider from this list to connect to any MDX data source → Enter HANA system details (server name, instance, user name and password) → click on Test Connection → Connection succeeded → OK.

It will give you the list of all packages in drop down list that are available in HANA system. You can choose an Information view → click Next → Select Pivot table/others → OK.

Select Pivot Table

All attributes from Information view will be added to MS Excel. You can choose different attributes and measures to report as shown and you can choose different charts like pie charts and bar charts from design option at the top.

SAP HANA – Crystal Reports

Crystal Reports for Enterprise

In Crystal Reports for Enterprise, you can access SAP HANA data by using an existing relational connection created using the information design tool.

You can also connect to SAP HANA using an OLAP connection created using information design tool or CMC.

Design Studio

Design Studio can access SAP HANA data by using an existing OLAP connection created in Information design tool or CMC same like Office Analysis.


Dashboards can connect to SAP HANA only through a relational Universe. Customers using Dashboards on top of SAP HANA should strongly consider building their new dashboards with Design Studio.

Web Intelligence

Web Intelligence can connect to SAP HANA only through a Relational Universe.

SAP Lumira

Lumira can connect directly to SAP HANA Analytic and Calculation views. It can also connect to SAP HANA through SAP BI Platform using a relational Universe.

Office Analysis, edition for OLAP

In Office Analysis edition for OLAP, you can connect to SAP HANA using an OLAP connection defined in the Central Management Console or in Information design tool.


You can create an information space based on an SAP HANA view using JDBC drivers.

Creating an OLAP Connection in CMC

We can create an OLAP Connection for all the BI tools, which we want to use on top of HANA views like OLAP for analysis, Crystal Report for enterprise, Design Studio. Relational connection through IDT is used to connect Web Intelligence and Dashboards to HANA database.

These connection can be created using IDT as well CMC and both of the connections are saved in BO Repository.

Login to CMC with the user name and password.

From the dropdown list of connections, choose an OLAP connection. It will also show already created connections in CMC. To create a new connection, go to green icon and click on this.

Central Management Console1

Enter the name of an OLAP connection and description. Multiple persons, to connect to HANA views, in different BI Platform tools, can use this connection.

Provider − SAP HANA

Server − Enter HANA Server name

Instance − Instance number

Central Management Console2

It also gives an option to connect to a single Cube (You can also choose to connect to single Analytic or Calculation view) or to the full HANA system.

Click on Connect and choose modeling view by entering user name and password.

Authentication Types − Three types of Authentication are possible while creating an OLAP connection in CMC.

  • Predefined − It will not ask user name and password again while using this connection.
  • Prompt − Every time it will ask user name and password
  • SSO − User specific
  • Enter user − user name and password for HANA system and save and new connection will be added to existing list of connections.

Now open BI Launchpad to open all BI platform tools for reporting like Office Analysis for OLAP and it will ask to choose a connection. By default, it will show you the Information View if you have specified it while creating this connection otherwise click on Next and go to folders → Choose Views (Analytic or Calculation Views).

SAP Lumira connectivity with HANA system

Open SAP Lumira from Start Program, Click on file menu → New → Add new dataset → Connect to SAP HANA → Next

SAP Lumira Connectivity

Difference between connect to SAP HANA and download from SAP HANA is that it will download data from Hana system to BO repository and refreshing of data will not occur with changes in HANA system. Enter HANA server name and Instance number. Enter user name and password → click on Connect.

Connect to SAP Hana

It will show all views. You can search with the view name → Choose View → Next. It will show all measures and dimensions. You can choose from these attributes if you want → click on create option.

There are four tabs inside SAP Lumira −

  • Prepare − You can see the data and do any custom calculation.
  • Visualize − You can add Graphs and Charts. Click on X axis and Y axis + sign to add attributes.
  • Compose − This option can be used to create sequence of Visualization (story) → click on Board to add numbers of boards → create → it will show all the visualizations on left side. Drag first Visualization then add page then add second visualization.
  • Share − If it is built on SAP HANA, we can only publish to SAP Lumira server. Otherwise you can also publish story from SAP Lumira to SAP Community Network SCN or BI Platform.

Save the file to use it later → Go to File-Save → choose Local → Save

Creating a Relational Connection in IDT to use with HANA views in WebI and Dashboard

Open Information Design Tool → by going to BI Platform Client tools. Click on New → Project Enter Project Name → Finish.

Information Design Tool

Right-click on Project name → Go to New → Choose Relational Connection → Enter Connection/resource name → Next → choose SAP from list to connect to HANA system → SAP HANA → Select JDBC/ODBC drivers → click on Next → Enter HANA system details → Click on Next and Finish.

Relational Connection

You can also test this connection by clicking on Test Connection option.


Test Connection → Successful. Next step is to publish this connection to Repository to make it available for use.

Right Click on connection name → click on Publish connection to Repository → Enter BO Repository name and password → Click on Connect → Next →Finish → Yes.

Publish Connection

It will create a new relational connection with .cns extension.

.cns − connection type represents secured Repository connection that should be used to create Data foundation.

.cnx − represents local unsecured connection. If you use this connection while creating and publishing a Universe, it will not allow you to publish that to repository.

Choose .cns connection type → Right Click on this → click on New Data foundation → Enter Name of Data foundation → Next → Single source/multi source → click on Next → Finish.

New Data Foundation

It will show all the tables in HANA database with Schema name in the middle pane.

Import all tables from HANA database to master pane to create a Universe. Join Dim and Fact tables with primary keys in Dim tables to create a Schema.


Double Click on the Joins and detect Cardinality → Detect → OK → Save All at the top. Now we have to create a new Business layer on the data foundation that will be consumed by BI Application tools.

Right Click on .dfx and choose new Business Layer → Enter Name → Finish →. It will show all the objects automatically, under master pane →. Change Dimension to Measures (Type-Measure change Projection as required) → Save All.

New Business Layer

Right-click on .bfx file → click on Publish → To Repository → click on Next → Finish → Universe Published Successfully.

Now open WebI Report from BI Launchpad or Webi rich client from BI Platform client tools → New → select Universe → TEST_SAP_HANA → OK.

WebI Report

All Objects will be added to Query Panel. You can choose attributes and measures from left pane and add them to Result Objects. The Run query will run the SQL query and the output will be generated in the form of Report in WebI as shown below.


Bi 4.0 Connectivity to Hana Views

Web Intelligence and Crystal Reports are most common BI tools that are used for reporting. WebI uses a semantic layer called Universe to connect to data source and these Universes are used for reporting in tool. These Universes are designed with the help of Universe design tool UDT or with Information Design tool IDT. IDT supports multisource enabled data source. However, UDT only supports Single source.

Main tools that are used for designing interactive dashboards- Design Studio and Dashboard Designer. Design Studio is future tool for designing dashboard, which consumes HANA views via BI consumer Service BICS connection. Dashboard design (xcelsius) uses IDT to consume schemas in HANA database with a Relational or OLAP connection.

SAP Lumira has an inbuilt feature of directly connecting or loading data from HANA database. HANA views can be directly consumed in Lumira for visualization and creating stories.

Office Analysis uses an OLAP connection to connect to HANA Information views. This OLAP connection can be created in CMC or IDT.

Reporting Tools

In the picture given above, it shows all BI tools with solid lines, which can be directly connected and integrated with SAP HANA using an OLAP connection. It also depicts tools, which need a relational connection using IDT to connect to HANA are shown with dotted lines.

Relational vs OLAP Connection

The idea is basically if you need to access data from a table or a conventional database then your connection should be a relational connection but if your source is an application and data is stored in cube (multidimensional like Info cubes, Information models) then you would use an OLAP connection.

  • A Relational connection can only be created in IDT/UDT.
  • An OLAP can be created in both IDT and CMC.

Another thing to note is that a relational connection always produces a SQL statement to be fired from report while an OLAP connection normally creates a MDX statement

Information Design Tool

In Information design tool (IDT), you can create a relational connection to an SAP HANA view or table using JDBC or ODBC drivers and build a Universe using this connection to provide access to client tools like Dashboards and Web Intelligence as shown in above picture.

You can create a direct connection to SAP HANA using JDBC or ODBC drivers.