SAP HANA Client Software, Different Ways to Set the Connectivity Data

[stefan_seemann]

An SAP ABAP system needs connectivity data to logon to its database. In case of SAP HANA there are three ways to set up the connectivity data:

1. Local hdbuserstore container,
2. Global hdbuserstore container and
3. ABAP Securestore (rsdb_ssfs_connect)

This post describes the different possibilities.

Local hdbuserstore container

The local hdbuserstore container is available since the beginning of SAP HANA. It is used in all versions of software provisioning manager and also in the Database Migration Option (DMO) of Software Update Manager (SUM).

It is the default when you are doing an installation or migration towards SAP HANA. It means one hdbuserstore is created for each host you are doing an installation of an ABAP instance.

It is placed in the home directory of the user or in the home area of the Microsoft Windows registry.

The hdbuserstore is placed in the home directory of the user in the subfolder .hdb/`hostname` That means even if user cooadm has a shared home directory, every host will have its own hdbuserstore.

On Microsoft Windows, the hdbuserstore is stored in the Windows Registry.

The hdbuserstore is used by the SAP kernel tools without further options and by the SAP HANA client tools like hdbsql using the option -U <ENTRY>

The connect method of R3trans can be traced by checking the logfile trans.log.

The disadvantage of this method is that there is one hdbuserstore-container on each SAP application server. That means if you want to change the connectivity data, you have to logon to every server of the system.

Global hdbuserstore container

Since SAP HANA Client Software Revision 93, there is a chance to put the hdbuserstore container into a central place.

The name for this is HDB_USE_IDENT and it is only available on Unix/Linux. It is an environment variable whose value replaces the hostname as foldername. The hdbuserstore is still in the subfolder ./hdb of the user's home directory. HDB_USE_IDENT is the successor of the method which is using a file called installation.ini to set a folder name by using a virtual hostname.

By using this method, a global identifier can be used to have only one hdbuserstore in a shared home directory of user <sid>adm.

In case you want to use this feature right from the installation of the system, you have to use at least the software provisoning manager 1.0 SP7 PL7

When you start the installation, you have to add the following parameter to the command line:

/sapdb/DVDs/IM_LINUX_X86_64/sapinst HDB_USE_IDENT=SYSTEM_COO

The value of parameter HDB_USE_IDENT can include every character, numbers '-' or '_'

By using this option a special profile parameter will be set in profile DEFAULT.PFL:

DEFAULT.PFL
...

dbs/hdb/hdb_use_ident=SYSTEM_COO

...

The profil is parsed by the database-specific login scripts .dbenv*sh:

.dbenv*.csh
...
# set HDB_USE_IDENT for alternative userstore folder

if(-f /usr/sap/"$SAPSYSTEMNAME"/SYS/profile/DEFAULT.PFL) then

  set hdb_use_ident = `awk -F= '/^dbs\/hdb\/hdb_use_ident/ {print $2; exit 0}' /usr/sap/"$SAPSYSTEMNAME"/SYS/profile/DEFAULT.PFL`

  if ( $hdb_use_ident != "") then

    setenv HDB_USE_IDENT $hdb_use_ident

  endif

endif

.dbenv*.sh
...

# set HDB_USE_IDENT for alternative userstore folder

if [ -f /usr/sap/"$SAPSYSTEMNAME"/SYS/profile/DEFAULT.PFL ]; then

  hdb_use_ident=`awk -F"= " '/^dbs\/hdb\/hdb_use_ident/ {print $2; exit 0}' /usr/sap/"$SAPSYSTEMNAME"/SYS/profile/DEFAULT.PFL`

  if [ $hdb_use_ident != "" ]; then

    export HDB_USE_IDENT=$hdb_use_ident

  fi

fi

Login scripts with these entries are placed on the software provisioning manager's DVD in folder COMMON/INSTALL/HDB. They are put into the home directory of user <sid>adm during the installation.

ABAP SSFS Securestore

The ABAP Securestore in general is a database-independent functionality to save data. It is placed within the SAP system. For more information, check SAP Note 1639578. With SAP Kernel version 7.42 PL 101, this functionality is also available for SAP HANA.

This feature is also supported by the software provisioning manager 1.0 SP7 PL7. To enable the feature, you have to call sapinst with the following parameter:

/sapdb/DVDs/IM_LINUX_X86_64/sapinst HDB_ABAP_SSFS=YES

Right now, there is a 7.42 Kernel DVD available, but it doesn't contain the necessary patch level for the SAP Kernel. Due to this, you will run into an error during the step testDatabaseConnection:

At this point, you can logon as user <sid>adm, transfer to the exe directory and extract the newer SAP kernel.

After the extraction of the new kernel, you can simply press Retry and the installation will continue. In case you are doing a migration or a system copy, you can even add the Kernel archives during the dialog phase to have them extracted automatically.

For more information about how to migrate an existing system to ABAP SSFS, check SAP Note 2154997.

Keep in mind that only tools of the SAP kernel are able to read from the ABAP SSFS securestore. That means that SAP HANA client tools like hdbsql cannot use the ABAP SSFS. So in case you want to use them, you might want to choose one application server where you still maintain one hdbuserstore container.

The following picture provides an overview about how the connectivity data of the different container is accessed.

In case the ABAP SSFS is used, the database-specific library dbhdbslib reads the connectivity data from the ABAP secure store and sends the data to the SAP HANA client. The SAP HANA client will then not read the connectivity data from the hdbuserstore container.