5 years ago by Alina Koldin
Starting with version 9.1, Tableau Server supports SAML single sign-on (SSO) for SAP HANA.
Note: This article describes how to configure SAP HANA for SSO using SAML. The bulk of this information is specific to SAP HANA, and Tableau can only offer limited support on this process, and cannot guarantee the accuracy of this documentation. SAP and the SAP HANA documentation are the definitive resource for how to set this up. You can verify that HANA has been configured correctly without Tableau - see "Validate your configuration" below. If this validation fails, then the HANA configuration is not correctly set up and will not work with Tableau.
Note: The HANA driver cannot encrypt SAML assertions, so we recommend that you enable encryption of SAML connections. For more information, see Customize SAP HANA Connections to Enable SAML Encryption. The publisher can also now enable SSL when creating the datasource.
To use SAML SSO with SAP HANA, you need to complete steps 1 and 2 in this article. Step 1 is configuring Tableau Server. Step 2 is configuring SAP HANA and can be validated independently of Tableau.
Using OpenSSL. For example: openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
This generates a certificate signing request and a private key in PEM format. Tableau Server expects the certificate in PEM format and the key in DER format. Use OpenSSL to convert the key to DER. For example:
4 Get the certificate signed by a trusted root authority. This can be a certificate authority such as Verisign, Thawte, Comodo, or GoDaddy, or your company's root certificate. The root certificate must be installed on HANA if it is not already present.
5 Install the key pair in Tableau Server. For more information about how to configure Tableau Server, see Configuring SAP HANA SSO in the Tableau Server help.
You need to install the new certificate in the HANA trusted certificate store. The instructions for installing the certificate depend on what SSL library you are using. Confirm the library you are using and the location of the trust store, and then follow either the SapCrypto/CommonCrypto instructions or the OpenSSL instructions. You only need to do one. SapCrypto/CommonCrypto may be easier to configure, especially for self-signed certificates.
To see what SSL library you are using, open HANA Studio and navigate to the configuration files in one of the following locations (note: These are listed in order of preference, with indexserver.ini overriding global.ini):
The library will be openssl, sapcrypto, or commoncrypto (commoncrypto is the successor to sapcrypto and the two are equivalent for the purposes of this documentation).
To find the location of the trust store, open HANA Studio and navigate to (listed in order of preference):
Note: Follow either the SAP/CommonCrypto or the OpenSSL instructions. You do not need to do both.
Copy the new certificate(s) to a temporary location in the HANA file system.
To install the certificate(s), do one of the following:
The following external resources may help you configure SAP HANA for SSO with Tableau Server:
You can manually validate your configuration by signing an assertion with your certificate and testing it in HANA Studio.
<?xml version="1.0" encoding="UTF-8" ?>
<saml2:Assertion ID="Assertion12345789" IssueInstant="2015-07-16T04:47:49.858Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer></saml2:Issuer>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue />
</Reference>
</SignedInfo>
<SignatureValue />
<KeyInfo>
<X509Data />
</KeyInfo>
</Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">myuserid</saml2:NameID>
</saml2:Subject>
<saml2:Conditions NotBefore="2010-01-01T00:00:00Z" NotOnOrAfter="2050-01-01T00:00:00Z"/>
</saml2:Assertion>
If logging on using either of these methods fail, then there is something wrong with the SAP HANA configuration. Consult your HANA documentation or contact SAP for further assistance
Error messages from the Hana driver can be vague. Hana doesn't give specifics on the cause of authentication failure as a security measure.
If you have problems with authentication, you must debug it on the database side.
Enable authentication trace logging at the debug level in SAP HANA. Enable this at the database level for all users and check the index server logs for authentication messages.
You can find details about enabling trace for SAP HANA here:
Note for newer version of Hana Studio you may have to select the "Show All Components" checkbox on the "Edit Database Trace Configuration" dialog.
Go to indexserver -> authentication and change "System Trace Level" to debug.
Common issues to look for:
Tableau Server was not able to generate a SAML assertion. We have found that generally is due to issues with the key provided. Ensure the key is not password protected and is DER encoded with a .der extension
If logging on using either of these methods fail, then there is something wrong with the SAP HANA configuration. Consult your HANA documentation or contact SAP for further assistance
We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.