Connecting SAC to HANA Cloud the Easy Way - Using Application Studio to Deploy the HAA (Hana Analytics Adapter)

[Ian_Henry]

With SAP Analytics Cloud Wave 2020.20, this manual configuration is no longer required.

Please see the vastly simplified Three click method.

https://blogs.sap.com/2020/09/28/connect-sap-analytics-cloud-to-hana-cloud-in-three-clicks/

Warning, the steps below are only required if you do not have the new connection type.

Having previously deployed the HANA Analytics Adapter (HAA) I thought it was worth sharing the latest and greatest method.  SAP Analytics Cloud receives live data from HANA Cloud using InA (Information Access) protocol.  Previous the XS Engine provided this, but this is not part of HANA Cloud, we therefore need the HAA to provide this.

If you are lucky enough to have access to HANA Cloud, chances are you will want to connect that live to SAP Analytics Cloud aka SAC.

The SAP HANA Journey site now has a complete tutorial that also shows how this can be configured.  Additionally the official SAP help documentation can be found here for Set up Live Connectivity to SAP HANA on SAP Cloud Platform and the SAC Guided playlist is here SAP HANA HDI in SAP Cloud Platform Cloud Foundry (live).

The good stuff can be found at the HANA Academy on YouTube from philip.mugglestone, part 12 in the playlist covers the HANA Analytics Adapter App

https://www.youtube.com/watch?v=b5he1l6Y-J8&list=PLkzo92owKnVw3l4fqcLoQalyFi9K4-UdY&index=12

Finding this information can be hard, it is often good to refer to a text/static version so I have captured the steps in this blogpost.

The are 6 main parts to connect SAC to HANA Cloud

1. Access the Business Application Studio


2. Hana Analytics Adapter Configuration


3. Create Role Collection


4. Assign Role to Cloud Platform Users


5. Verify Access to InA using Application URLs


6. SAP Analytics Cloud Connection

Pre-requisites

• SAP HANA Cloud with an HDI Container created


• SAP Analytics Cloud


• Business Application Studio

1. Access the Business Application Studio

You need to have quota, the subscription enabled and the role collections assigned to your user (Trust Configuration: SAP ID Service - Role Collection Assignment).

Full details of how to provision the App Studio the first time can be found here. https://developers.sap.com/tutorials/appstudio-onboarding.html

If you prefer a video, Philip also created one for that too. SCP Onboarding: Provision Services - Subscribe to SAP Business Application Studio

With the Business Application Studio available, you should launch App Studio from the subaccount, subscriptions.
Click Go to Application.

Login to the Business Application Studio with your Cloud Platform credentials

Create a New Dev Space with the application type as SAP Cloud Business Application

After creating the Dev Space, we can click on the name to enter it.

 

2. Hana Analytics Adapter Configuration

Now we are inside our space in the Business Application Studio we can configure the HAA (Hana Analytics Adapter). The clever people from the SAP HANA Academy have created an npm we can use.

Open a New Terminal

Type the npm install command into the Business Application Studio Terminal.

npm install -g generator-saphanaacademy-haa

Execute the installed package, with yo.

cd projects

yo

For the curious ones the npm package source code is hosted on the HANA Academy GitHub Repo

Choose saphanaacaademy Haa

Please Note

The HDI container name can be quite ugly if it is generated.  The HDI Container name is controlled by the parameter service-name in the WebIDE mta.yaml project.

Complete the generator/wizard

The host of the Client Application is the full SAC tenant name without https://

? What project name would you like? haa

? Would you like to create a new directory for this project? Yes

## You are binding the HAA to this HDI Container, multiple can be added later if required

? What is the name of your HDI container? covid-nhs

? What is the host of your client application? my-sac-tenant.eu10.sapanalytics.cloud

## Yes = SSO to DB, No = HDI Container user used for DB connection

? Will you be configuring SSO (implies shadow users in HANA)? No

? Would you like to add multi-tenant SaaS application support? No

Upon completion, open the newly created project.

Click the link to download the SAP HANA Analytics Adapter release version WAR file from.

https://tools.hana.ondemand.com/#hanatools

Current file version is xsahaa-release-1.6.1-release.zip

Extract the downloaded xsahaa-release-1.6.1-release.zip

Drag and drop the file java-xsahaa.war into the project srv/target directory.

We can now select Build MTA on the mta.yaml file

When the build completes check the Task build log shows something similar to below with
BUILD SUCCESS. The log should open automatically.

Once successfully built we should see the MTA archive folder with the .mtar file inside.

We can now select the haa_0.0.1.mtar, right click and choose Deploy MTA Archive

You should be prompted to login to your SCP API Endpoint. Something similar to below. You can then see the organisation and space.

https://api.cf.eu20.hana.ondemand.com

3. Create Role Collection

After successful deployment we will have a 1 new application, 2 new services and 1 new role.

These can be seen in the Cloud Platform Cockpit, Subaccount.

Create a New Role Collection

Click the HAA Access role created.

Add Role to the Role Collection.

 

4. Assign Role to Cloud Platform Users

Within the Cloud Platform Subaccount we can navigate to Trust Configuration

Type in the users email address that you wish to assign the role to.

Click Show Assignments

Click Assign Role Collection

Select the HAA Access Role Collection

5. Verify Access to InA using Application URLs

We can see our new application URLs, by navigating to the Cloud Platform space Applications.

The Base URL (Application Route) is shown after selecting the haa app.

Click the URL to open the base HAA page, no authentication is required yet.

# Heartbeat URL Path

/sap/bc/ina/service/v2/HeartBeat

## GetServerInfo URL Path

/sap/bc/ina/service/v2/GetServerInfo

6. SAP Analytics Cloud Connection

We can now establish a Live Direct connection to HANA Cloud, using the SAP HANA connection option.

For the Authentication method SAML appears to be correct but basic User Name & Password may also connect.

Conclusion

Currently the HAA is a necessary evil that is required to connect from SAC to HANA Cloud.  Hopefully this blog post has shown that by using the Business Application Studio this configuration is becoming easier.

[former_member255619]

Hi Ian,

Thank you for the blog!

I followed it to connect my HANA Cloud Instance and SAC . We are using custom IDP for our subaccount and I assigned the roleCollection to the user in the custom IDP. But I see below error.

Wondering if you have faced similar issue before.

Thanks,

Keerthi

 

 

[former_member182748]

Amazing blog Ian!

I was able to connect to SAC thanks o the clarifying instructions!

Thank you VERY much also for your support as I used a wrong parameter in step 2 and you helped me to correct that.

All the best!

[Ian_Henry]

Thanks Keerthi,

I have not tried a custom IdP.

The error suggest to me that the binding to the HDI container is not working.  I would confirm you are bound to the HDI Container and also check the haa application logs.

Confirm that Database Explorer can open your HDI Container.

[Ian_Henry]

Thanks Christiano,

Glad we got it connected.

[david_pugh]

Great post Ian.

 

[Ian_Henry]

Thanks Dave, I updated the SAC connection screenshot, Authentication to SAML for SAC as I believe that is correct.

[remi_astier]

Nice ! You're the best Ian!

[former_member8565]

Thanks Ian for this great blog,I am able to access model via Live connection in SAC .

[Ian_Henry]

Thanks Ashish, glad you got it connected.

[former_member694995]

Dear Ian,

Thanks for the blog. We have received the following error when we completed all the steps in this guide.

com.sap.db.jdbc.exceptions.SQLInvalidAuthorizationSpecExceptionSapDB: [10]: authentication failed"

Would you happen to know a solution for this?

[Ian_Henry]

Thanks Onur,

Does the HeartBeat or GetServerInfo work?

I would double check the SCP user has the HAA_Viewer assigned to them.

[munishsuri]

Hi Ian,

 

thank you so much for your blog.

I am facing one issue while accessing the heartBeat and GetServerInfo URL

{"Messages":[{"Type":2,"Number":0,"Text":"java.lang.NullPointerException: while trying to invoke the method com.sap.xs.env.Credentials.getUrl() of a null object loaded from local variable 'cred'"}]}

can you please guide here.



Best regards

Munish Suri

[Ian_Henry]

Hi Munish,

I have also seen this issue before.

Can you double check that you have the correct HDI service name in your mta.yaml, it is in 3 places.

Did you answer “No”, as described to the last two prompts in the Yo configuration?

[munishsuri]

Hi Ian,

 

i have just cheched, all the 3 places have the same name and I selected no in the 2 options.

 

Best regards

Munish Suri

[Ian_Henry]

Could you try a different HDI container?

 

[munishsuri]

Hi Ian,

 

i tried and got the same error, is there something related to HANA CLoud, as these HDI containers are instantiated on HANA Cloud, not HANA as a service.

 

BR

Munish

[Ranganathan]

Hi Ian,

may i know what is the supported version of Analytics adapter.

I am using xsahaa-release-1.6.1-release for the time being.

it fails with exception.

 

"Text": "java.lang.RuntimeException: java.lang.NullPointerException: while trying to invoke the method com.sap.xs.env.Credentials.getUrl() of a null object returned from com.sap.xsahaa.context.DeploymentContext.getDbCredentials()"

thanks

Ranganathan

[Ian_Henry]

Yes, xsahaa-release-1.6.1-release is the latest and would be supported.

I believe this error indicates that authentication is failing. This could be between the HAA and the HDI container, or your SCP/IdP user and the HAA.

Did you answer “No”, as described to the last two prompts in the Yo configuration?

[apoorva_nagaraju]

Hi Ian,

I am also facing similar issue as Munish.

Could you please help.

Thanks,

Apoorva

[munishsuri]

Hi Apoorva,

 

Kindly create a new HDI and create a connection first.

Don't do any development or connectivity before the deployment of the Analytics Adapter and  App Router.

 

Post that you can deploy the artifacts.

i assume, this could be the case when we do any sort of development or connect the HDI to any any other say WEB IDE or BAS . This will create a service key and might cause some problem.

 

 

BR

Munish Suri

[apoorva_nagaraju]

It worked. Thanks Munish !

Regards,

Apoorva

[munishsuri]

Hi Ranganathan,

 

Kindly create a new HDI and create a connection first.

Don’t do any development or connectivity before the deployment of the Analytics Adapter and  App Router.

 

Post that you can deploy the artifacts.

BR

Munish Suri

[fabiosist]

Dear Ian,

Thanks for the blog. Following these steps I was able to correctly deploy the Adapter (both HearthBeat and GetServerInfo return the correct results) but when I try to create a connection in SAC I encounter this error:

We couldn't connect to your HANA system. For more information, see our troubleshooting page

Looking at the Google Chrome Console I noticed this error:

Access to fetch at <HAA-Route> from origin <origin-host> has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I checked the configuration of the Adapter but the mta.yaml file has the paramter “allowedOrigin” (in the CORS variable) correctly defined:

"allowedOrigin": [{"host":<SAC-HOST>, "protocol":"https"}]

Would you happen to know a solution for this?

Thanks,

F

[former_member256516]

Hi fabiosist ,

Were you able to resolve this issue? I am getting the similar error while connecting to SAP Analytics cloud. HearthBeat and GetServerInfo results looks correct.

Error – “We couldn’t connect to your HANA system. Possible causes: Third-party cookies are blocked, or CORS is not configured correctly. For more information, see our troubleshooting page.

Correlation ID: 12543003-8717-4676-b081-141882948993″

I did enable the cookies using the browser settings, but the error persist.

mta.yaml looks good with setting for “allowedOrigin”.

ian.henry : Appreciate your thoughts on this.

Thanks.

[former_member569009]

Hi! excelent post but have a question. If you have 3 different HDI container and want to see all data source from SAC in a live connection, how could we see data source that are created in other container? Should we edit mta.yaml in this new container to authorize this new one to check the other HDI Container information?

Regards.

[Ian_Henry]

Hi Luis,

The connection is established from the HDI container runtime user. This is the _RT user that is created for your container.
You can add permissions for the other HDI containers such as the access_role to this user.  To find the user check the service instances in the SCP cockpit.

Cheers, Ian.

[former_member569009]

Thanks Ian! last question, is it mandatory SSO?

Regards.

[Ian_Henry]

Hi Luis,

Yes, kind of. It's not true SSO, we are just authenticating to the SAP Cloud Platform, this requires SAML SSO setting.
The container _RT user is actually making the connection from SAC to HC.

[former_member680589]

Hi Ian,

Thank you for the blog. This is much better and simple compared to previous HANA Analytic Adapter settings.  I am having some challenges. In my system, I could able to access the test container, but unable to access  the main container. From the HANA cloud DB Explorer, I could be able to see all the container.

The Build MTA on the mta.yaml file is successful. But next step “haa_0.0.1.mtar, right click and choose Deploy MTA Archive” . This is not successful. It says.  Could not bind the service . Service instance not found. Attached is the screen shot.

Munish mentioned a good point. But we are trying to do this after all cal views are built. I tried for another container " ZPROJ_TEST" it working.

Could you please help to see what we are missing. Tried this at least 20 times with different names.

Thank you very much.

Regards

Ramakrishnan Ramanathaiah

[former_member680589]

My above issue is resolved. For some reason, when we tried to connect to existing container ( Already having Calc view) it did not work. It was not able to bind the instance. Then we copied the existing container to the new name and then tried to connect. It worked.

 

Regards

Ramakrishnan Ramanathaiah

[JasonHinsperger]

Just a note for anyone still using HAA.  As of this change to the Cloud MTA Build tool, building the MTA will delete the war file and fail.

https://sap.github.io/cloud-mta-build-tool/whatsnew/#configuration-of-maven-builder-has-changed

However, the workarounds listed in the link above do allow the build to succeed.

--Jason

[fabioferrari]

Many thanks Jason. Your comment helped me after many hours of struggling.

Fabio

[vijendra_pachoriya]

Hi  @Ian Henry,

How to do it in multi tenant mode instead of with single HDI container? Will Hana adaptor works with instance manager?

Best Regards,
Vijendra

[Ian_Henry]

Hi Vijendra,

You can access multiple HDI containers, by providing the relevant roles to the single HAA HDI Container user. If you wish to access multiple HANA tenants then you will likely need multiple HAAs. I'm not familiar with the instance manager.

Depending upon your scenario, you may also wish to consider the SSO approach to deploying the HAA.

[former_member740342]

Hi Ian,

thanks for the blog post, it helped a lot. After successfully establishing a live connection between SAC and SAP HANA, when I try to create a model in SAC, I am unable to see any databases from my HANA side on SAC platform.

Do you know why this is the case?

Best regards,

Leonard

[Jay2]

Hi Leonard,

Probably there are 2 things which I can see -

1. Confirm of your calculation view is of type cube and not dimension? - Calculation views with data category Cube are visible to the reporting tools and support data analysis with multidimensional reporting


2. The Database user has the Select privileges on the schema where you have created the view.

Kr,

Jay

[former_member740342]

Hi Jay,

 

Thank you for responding to this! I have configured my calculation views to be type CUBE but i am still unable to view the datasets.

The image below is the privileges that i have given to users. Do you have any advice on this!

The permission users have

[former_member740342]

Hi Ian,

I am currently trying to see data in multiple HDI containers. I followed your instructions and gave user the access to the schemas but it does not work.

The image attached shows the additional database that I am trying to view but I am still unable to see it from SAC. Do you have any workarounds for this?

[Ian_Henry]

Hi Leonard,

This connection is being made by the _RT user from your HDI container defined in step 2.
You can add permissions to this user to provide access to other calc views/containers. Typically this would be done by adding the access_role or similar for those containers.  Often you may find multiple _RT users so it can be trial and error to identify which one is the actual one being used by the HAA.