Connection to SAP HANA

This guide connects an SAP HANA database (SAP HANA Cloud, SAP HANA on-premise or SAP Datasphere) to the DQC Platform: the connection details, a read-only technical user, resource limits and network access.

For an overview of all ways to bring SAP data into DQC, including SAP RFC, OData and third-party tools, see Connecting to SAP systems.

Connection details

The connection is always TLS-encrypted, so TLS must be enabled on the HANA SQL port. Host, port, database and schema cannot be changed after the connector has been created; create a new connector instead.

Enter the connection values in the integration form shown above

To look up the SQL port, run this in the tenant database:

SELECT SERVICE_NAME, SQL_PORT FROM SYS.M_SERVICES WHERE SQL_PORT <> 0;

To find the ABAP schema, run this as an administrator (the catalog only shows objects on which the querying user has privileges):

SELECT SCHEMA_NAME FROM SYS.TABLES WHERE TABLE_NAME = 'MARA';

SAP Datasphere: create a database user for the space (Space Management, Database Access) with read access enabled, and use the host, port 443, user and password shown there. Enter the space schema as Schema; DQC can read the views that are exposed for consumption. Add the DQC IP address to the IP allowlist of your Datasphere tenant. The steps below are for SAP HANA Cloud and on-premise databases.

Create the technical user

Connect to the tenant database with SAP HANA Database Explorer, SAP HANA Studio or hdbsql as a user with the system privileges USER ADMIN and ROLE ADMIN (the optional sections below also need WORKLOAD ADMIN and AUDIT ADMIN) and run:

-- Technical user for DQC. Hand the password over through your secret process.
CREATE USER DQC_SERVICE_USER PASSWORD "<strong-password>" NO FORCE_FIRST_PASSWORD_CHANGE;

-- Technical users should not expire with the password lifetime policy
ALTER USER DQC_SERVICE_USER DISABLE PASSWORD LIFETIME;

-- Role that holds all read privileges for DQC
CREATE ROLE Z_DQC_READ_ONLY;
GRANT Z_DQC_READ_ONLY TO DQC_SERVICE_USER;

Grant access to tables

Only the owner of the ABAP schema (the database user with the same name, for example SAPHANADB) or a user that holds SELECT ... WITH GRANT OPTION can grant access to ABAP tables. Administrators such as SYSTEM usually have no privileges on the ABAP schema. Run the GRANT SELECT statements as the ABAP schema owner, following your SAP Basis process for that user.

Option A: individual tables (simple). Grant SELECT on each table that DQC should check. Replace SAPHANADB with your ABAP schema.

GRANT SELECT ON SAPHANADB.MARA TO Z_DQC_READ_ONLY;  -- General material data
GRANT SELECT ON SAPHANADB.MARC TO Z_DQC_READ_ONLY;  -- Plant data for material
GRANT SELECT ON SAPHANADB.MAKT TO Z_DQC_READ_ONLY;  -- Material descriptions
GRANT SELECT ON SAPHANADB.KNA1 TO Z_DQC_READ_ONLY;  -- Customer master, general data
GRANT SELECT ON SAPHANADB.LFA1 TO Z_DQC_READ_ONLY;  -- Supplier master, general data

Option B: filtered views (recommended when DQC may only see part of the data). Client-dependent ABAP tables store the rows of all clients, and organizational restrictions depend on the data model. This example joins the general customer data in KNA1 to the company code data in KNB1 and limits DQC to one client and one company code. To enforce the restriction, grant DQC access only to the view, not to the tables.

-- Run as the ABAP schema owner, so that the view owner may pass SELECT on to the DQC role
GRANT SELECT ON SAPHANADB.KNA1 TO <view_owner> WITH GRANT OPTION;
GRANT SELECT ON SAPHANADB.KNB1 TO <view_owner> WITH GRANT OPTION;

-- Run as <view_owner>
CREATE SCHEMA Z_DQC_VIEWS;

-- Customers of company code 1000 in client 100, not flagged for deletion
CREATE VIEW Z_DQC_VIEWS.V_CUSTOMER_1000 AS
SELECT a.MANDT, a.KUNNR, a.NAME1, a.NAME2, a.ORT01, a.PSTLZ, a.LAND1, b.BUKRS
FROM SAPHANADB.KNA1 AS a
JOIN SAPHANADB.KNB1 AS b
  ON b.MANDT = a.MANDT AND b.KUNNR = a.KUNNR
WHERE a.MANDT = '100'
  AND b.BUKRS = '1000'
  AND (a.LOEVM IS NULL OR a.LOEVM = '')
  AND (b.LOEVM IS NULL OR b.LOEVM = '');

COMMENT ON VIEW Z_DQC_VIEWS.V_CUSTOMER_1000 IS
  'DQC: customers of company code 1000, client 100, not flagged for deletion';

GRANT SELECT ON Z_DQC_VIEWS.V_CUSTOMER_1000 TO Z_DQC_READ_ONLY;

One connector lists the objects of one schema. If DQC should read both tables in the ABAP schema and views in Z_DQC_VIEWS, create one connector per schema.

Limit resource usage (recommended)

A workload class limits the memory, threads and runtime of DQC's statements, so a data quality check has a bounded impact on other workloads. Creating workload classes and mappings requires the system privilege WORKLOAD ADMIN.

CREATE WORKLOAD CLASS "DQC_LIMITED" SET
  'PRIORITY' = '3',                 -- 0 = lowest, 9 = highest, default 5
  'STATEMENT MEMORY LIMIT' = '16',  -- GB per statement
  'STATEMENT THREAD LIMIT' = '4',   -- threads per statement
  'STATEMENT TIMEOUT' = '900';      -- seconds

CREATE WORKLOAD MAPPING "DQC_LIMITED_MAPPING" WORKLOAD CLASS "DQC_LIMITED"
  SET 'USER NAME' = 'DQC_SERVICE_USER';

A workload class limits either each statement or all statements of the class together, not both for the same resource. To cap all DQC statements together, use 'TOTAL STATEMENT MEMORY LIMIT' and 'TOTAL STATEMENT THREAD LIMIT' instead of the two statement limits.

DQC runs its checks as SQL queries inside HANA: per check run it counts the rows in scope, evaluates the rules and reads samples of failing rows. Set the timeout and memory limit high enough for a full scan of your largest checked table. A statement that hits a limit is cancelled and the check run fails.

Audit logging (optional)

If auditing is enabled in your database, these policies record DQC's logons and its reads of the listed objects. Creating audit policies requires the system privilege AUDIT ADMIN. List every table and view DQC reads in the ON clause of DQC_READ.

CREATE AUDIT POLICY "DQC_CONNECT" AUDITING ALL CONNECT
  FOR DQC_SERVICE_USER LEVEL INFO;
ALTER AUDIT POLICY "DQC_CONNECT" ENABLE;

CREATE AUDIT POLICY "DQC_READ" AUDITING SUCCESSFUL SELECT
  ON SAPHANADB.MARA, SAPHANADB.MARC, SAPHANADB.MAKT, SAPHANADB.KNA1, SAPHANADB.LFA1
  FOR DQC_SERVICE_USER LEVEL INFO;
ALTER AUDIT POLICY "DQC_READ" ENABLE;

Network access

• SaaS and SaaS+: the DQC Platform connects from this static IP address. Allow it to reach the HANA SQL port; for SAP HANA Cloud, add it to the instance's allowed connections.

3.123.94.228

• No inbound access possible: run the DQC Proxy in your network. It opens an outbound connection to DQC and forwards traffic only to the HANA host and port on its allowlist.

• Private cloud or on-premise deployment of DQC: see Private cloud & on-premises deployments.

Troubleshooting

Notes

• Use a dedicated technical user with read-only privileges for production systems

• DQC only reads; it never writes to the HANA database

• Learn more: Connecting to SAP systems, Connection to SAP RFC, Supported data sources