# SAP HANA SAP HANA Authentication

Source: https://userguide.qualytics.io/source-datastore/datastore/jdbc/sap-hana/authentication/

The Qualytics SAP HANA connector authenticates with **basic** credentials: a HANA database username and password supplied directly to the connection. There is no IAM role, Kerberos, or SAML option in the connection form. The same flow is used for **HANA Cloud** and for on-premises HANA.

## Basic Authentication

The connection user is a HANA database user created inside the tenant database you want to monitor. Qualytics passes the credentials to the SAP HANA JDBC driver, which opens a TLS-encrypted session against the HANA endpoint.

| Field | Description |
| --- | --- |
| **Username** | HANA database user (e.g., `QUALYTICS_READER`). Treat as case-insensitive; HANA stores unquoted names in upper case. |
| **Password** | The HANA user's password. Stored encrypted in Qualytics and never echoed back in the UI or API responses. |

Grant the user the minimum privileges listed in [SAP HANA Permissions](https://userguide.qualytics.io/source-datastore/datastore/jdbc/sap-hana/permissions/). Avoid sharing administrative HANA users (such as `SYSTEM`) with Qualytics; create a dedicated read-only user instead.

## TLS and Certificate Validation

The HANA JDBC driver is invoked with `encrypt=true` and `validateCertificate=true`. The driver:

1. Opens a TLS handshake against the HANA endpoint.
2. Validates the server certificate.
3. Aborts the connection if validation fails.

This is the same behavior SAP recommends for production deployments and the only mode supported by HANA Cloud.

> **Note: Choosing a non-default encryption mode**
>
> The **Encryption** dropdown on the Add Source form lets you pick **Encrypt and verify certificate** (default, required for HANA Cloud), **Encrypt, skip certificate verification**, or **No encryption**. The API mirrors these as `verify`, `skip_verify`, and `none` under `connection.parameters.encryption` (see [API](https://userguide.qualytics.io/source-datastore/datastore/jdbc/sap-hana/how-tos/api/)). Use the non-default options only when your security policy explicitly allows them, for example with on-premises systems that present a self-signed certificate or operate on an isolated network.

## Host, Port, and Tenant Database

The connector builds the JDBC URL from the **Host**, **Port**, and **Database** fields you provide:

```text
jdbc:sap://<host>:<port>/?encrypt=true&validateCertificate=true[&databaseName=<tenant>]&currentschema=<schema>
```

| Field | HANA Cloud | On-Premises |
| --- | --- | --- |
| **Host** | The Cloud endpoint URL provided by SAP (e.g., `xxxxxxxx.hna1.prod-us10.hanacloud.ondemand.com`). The tenant is encoded inside this hostname. | The hostname or IP of the HANA system (e.g., `hana-prod.acme.internal`). |
| **Port** | `443` (TLS-only). | The SQL port of the target tenant. For a single-container or system database, this is `3<instance>15` (e.g., `39015`). For a tenant database in a multi-container deployment, use the tenant's SQL port (commonly `30041`, `30043`, etc.). |
| **Database** | Leave blank. The tenant is encoded in the hostname. | Optional. Set to the tenant database name when connecting to a multi-tenant container that does not encode the tenant in the port. |

> **Tip: Default port**
>
> The connection form defaults to `443` (suitable for HANA Cloud). For on-premises HANA, override the port to the value used by your tenant. Pointing at the wrong port returns `Cannot connect to jdbc:sap://...: connection refused` or a TLS error if the port belongs to a non-SQL service.

## Schema Selection

The **Schema** field is required. HANA does not have a catalog-above-schema hierarchy, so the schema is the unit of discovery. The connection user must hold `SELECT` on the chosen schema (or on the underlying objects) for tables to appear in the **Container** dropdown after the datastore is created.

The **New Connection** flow supports picking more than one schema in a single operation. When you do, Qualytics creates a separate source datastore per schema, reusing the same connection.

## Updating credentials

When the HANA password changes, update the connection via **Settings → Connections** or the API so that the next scheduled job picks up the new credentials. Qualytics does not refresh HANA credentials automatically; failed jobs after a password change indicate the connection still holds the old password.

> **Tip: Credentials from a secrets manager**
>
> Any field on this page can take its value from HashiCorp Vault or another secrets manager instead of being typed in: enable **Secrets Management** on the connection and write `${key}` in the field. See the [HashiCorp Vault](https://userguide.qualytics.io/source-datastore/datastore/connection/hashicorp-vault/deep-dive/introduction/) pages for setup and troubleshooting.

*Last updated: November 3, 2026.*