Loading

SAP HANA OAuth Authentication via Microsoft Entra ID & Tableau

Julkaisupäivä: Jul 31, 2026
Kuvaus

SAP HANA OAuth Authentication via Microsoft Entra ID & Tableau

Authentication Flow Overview

The OAuth authentication sequence follows a 3-step validation chain:

  1. 1. Token Request: Tableau Client (Desktop/Server) requests an OAuth token from Microsoft Entra ID (Identity Provider).
  2. 2. Token Issuance: Microsoft Entra ID validates user identity and returns a v2.0 JSON Web Token (JWT).
  3. 3. JWT Authentication: Tableau passes the JWT to SAP HANA Database, which validates it against Entra's public keys stored in a Personal Security Environment (PSE).

Core Prerequisite: SAP HANA requires valid v2.0 issuer tokens (https://login.microsoftonline.com/{TENANT_ID}/v2.0) to match user mapping rules.

Table of Contents

1.0 Microsoft Entra ID Configuration

1.1 App Registration & Redirect URIs

  1. In Azure Portal, navigate to Microsoft Entra ID > App registrations > New registration.
  2. Set Name (e.g., hana-oauth-entra) and select Accounts in this organizational directory only.
  3. Register the following Redirect URIs under the Web platform:
    • http://localhost:56666/Callback
    • http://localhost:56667/Callback
    • http://localhost:56668/Callback
    • https://<YOUR_TABLEAU_SERVER_OR_CLOUD_URL>/auth/add_oauth_token

1.2 Expose an API & Token Version

To prevent Entra ID from returning tokens scoped strictly to Microsoft Graph (aud=https://graph.microsoft.com), you must expose a custom API scope:

  1. Go to Expose an API > Application ID URI > Set to api://{CLIENT_ID}.
  2. Add a scope named session:role:consumer (Admin and User consent allowed).
  3. Go to Manifest and update the access token version key:
    "requestedAccessTokenVersion": 2

CRITICAL: SAP HANA expects v2.0 issuer tokens (https://login.microsoftonline.com/{TENANT_ID}/v2.0). Leaving this configured at v1.0 (sts.windows.net) will cause immediate HANA authentication failure.

1.3 Optional Claims & API Permissions

  1. Under Token configuration > Add optional claim: Add email and preferred_username for Access Tokens.
  2. Under API permissions, grant delegated Microsoft Graph permissions: openid, email, profile, offline_access.
  3. Click Grant admin consent for [Organization].

2.0 SAP HANA Setup (JWT & PSE Configuration)

SAP HANA uses a Personal Security Environment (PSE) holding Microsoft's public keys to validate incoming JWTs.

2.1 Retrieve Entra JWKS Public Keys

Microsoft signs tokens using RSA keys that must be imported into SAP HANA:

  1. Query Microsoft's discovery endpoint:
    https://login.microsoftonline.com/{TENANT_ID}/discovery/v2.0/keys
  2. Convert the RSA n and e parameters for active signing keys (where "use": "sig") into PEM public key format.

2.2 Execute HANA SQL Configuration

Run the following SQL script as the SYSTEM database user:

-- 1. Create JWT Provider matching Entra v2.0 issuer
CREATE JWT PROVIDER testdb_entra
  WITH ISSUER 'https://login.microsoftonline.com/{TENANT_ID}/v2.0'
  CLAIM 'preferred_username' AS EXTERNAL IDENTITY;

-- 2. Import Public Key(s) from Entra JWKS
CREATE PUBLIC KEY testdb_entra_pubkey_1
FROM '-----BEGIN PUBLIC KEY-----
<INSERT_CONVERTED_PEM_KEY_1_HERE>
-----END PUBLIC KEY-----'
KEY ID HINT '<KID_FROM_JWKS_1>';

-- 3. Create Personal Security Environment (PSE)
CREATE PSE testdb_entra_pse;

-- 4. Add Public Key to PSE & assign JWT Provider purpose
ALTER PSE testdb_entra_pse ADD PUBLIC KEY testdb_entra_pubkey_1;
SET PSE testdb_entra_pse PURPOSE JWT FOR PROVIDER testdb_entra;

-- 5. Map Entra UPNs to HANA Database Users
CREATE USER jwt_user_1 WITH IDENTITY '<USER_UPN_1>' FOR JWT PROVIDER testdb_entra;
GRANT SELECT ON SCHEMA <YOUR_SCHEMA> TO jwt_user_1;

Note on User Mapping: If the SAP HANA database user already exists, attach the external identity via:
ALTER USER <HANA_USER> ADD IDENTITY '<USER_UPN>' FOR JWT PROVIDER testdb_entra;

3.0 Tableau Side Configuration (Custom XML Plugin)

Create an OAuth custom configuration XML file named custom_saphana_entra.xml and place it in the Tableau Bridge / Tableau Server / Tableau Desktop OAuth directory:

<?xml version="1.0" encoding="utf-8"?>
<pluginOAuthConfig>
  <dbclass>saphana</dbclass>
  <oauthConfigId>custom_saphana_entra</oauthConfigId>
  <clientIdDesktop>{ENTRA_CLIENT_ID}</clientIdDesktop>
  <clientSecretDesktop>{ENTRA_CLIENT_SECRET}</clientSecretDesktop>
  <redirectUrisDesktop>http://localhost:56666/Callback</redirectUrisDesktop>
  <redirectUrisDesktop>http://localhost:56667/Callback</redirectUrisDesktop>
  <redirectUrisDesktop>http://localhost:56668/Callback</redirectUrisDesktop>
  <authUri>https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/authorize</authUri>
  <tokenUri>https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token</tokenUri>

  <!-- Scope ordering and audience control -->
  <scopes>api://{ENTRA_CLIENT_ID}/session:role:consumer</scopes>
  <scopes>openid</scopes>
  <scopes>profile</scopes>
  <scopes>offline_access</scopes>

  <capabilities>
    <entry><key>OAUTH_CAP_SUPPORTS_HTTP_SCHEME_LOOPBACK_REDIRECT_URLS</key><value>false</value></entry>
    <entry><key>OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL</key><value>true</value></entry>
    <entry><key>OAUTH_CAP_PKCE_REQUIRES_CODE_CHALLENGE_METHOD</key><value>true</value></entry>
    <entry><key>OAUTH_CAP_REQUIRE_PKCE</key><value>true</value></entry>
    <entry><key>OAUTH_CAP_SUPPORTS_STATE</key><value>true</value></entry>
    <entry><key>OAUTH_CAP_SUPPORTS_GET_USERINFO_FROM_ID_TOKEN</key><value>true</value></entry>
  </capabilities>

  <accessTokenResponseMaps>
    <entry><key>ACCESSTOKEN</key><value>access_token</value></entry>
    <entry><key>REFRESHTOKEN</key><value>refresh_token</value></entry>
    <entry><key>access-token-issue-time</key><value>issued_at</value></entry>
    <entry><key>access-token-expires-in</key><value>expires_in</value></entry>
    <entry><key>id-token</key><value>id_token</value></entry>
    <entry><key>username</key><value>preferred_username</value></entry>
  </accessTokenResponseMaps>
</pluginOAuthConfig>

4.0 Verification & Troubleshooting Matrix

Issue / ErrorRoot CauseSolution
HANA Token Validation FailsToken issuer is v1.0 (sts.windows.net).Ensure App Manifest has "requestedAccessTokenVersion": 2 and HANA JWT Provider uses /v2.0 in ISSUER URL.
HANA Rejects Token AudienceToken scope defaulted to Microsoft Graph (aud 00000003-0000-0000-c000-000000000000).First requested scope in Tableau configuration XML must be api://{CLIENT_ID}/session:role:consumer.
Tableau: "Unrecognized object type"Missing preferred_username claim in id_token.Add profile scope to Tableau XML so the parser can locate the user identity.
Authentication Succeeds, Query DeniedHANA user mapped successfully, but missing database privileges.Execute GRANT SELECT ON SCHEMA <SCHEMA> TO <JWT_USER>; in HANA.

5.0 Key Rotation Maintenance

Microsoft Entra ID rotates its signing keys periodically. If authentication suddenly fails across all users:

  1. Fetch new JWKS keys using your tenant's discovery endpoint:
    https://login.microsoftonline.com/{TENANT_ID}/discovery/v2.0/keys
  2. Create a new public key entry in SAP HANA:
    CREATE PUBLIC KEY testdb_entra_pubkey_N FROM '...' KEY ID HINT '<KID_N>';
  3. Attach the new key to the PSE:
    ALTER PSE testdb_entra_pse ADD PUBLIC KEY testdb_entra_pubkey_N;
Knowledge-artikkelin numero

005390327

 
Ladataan
Salesforce Help | Article