Skip to Content

SAP Web IDE for SAP HANA SPS 12 Patch 1 Tips and Tricks

Recently SAP has shipped the first major patch for the SAP Web IDE for SAP HANA SPS 12.  You might have seen the announcement blog here:
What’s New in SAP Web IDE for SAP HANA SPS 12 Patch 1

Or the documentation here:
SAP Web IDE for SAP HANA Documentation

First of all you might be wondering why we are making a big deal about a patch. Normally a patch or revision between SPS levels for SAP HANA would likely only contain bug fixes.  However for the development tooling we are now architecturally somewhat separated from the SAP HANA core which allows us to also ship new functionality in certain patches. This is key because there were several really good features which just didn’t quite get finished in time for SPS 12.  Now we are able to ship them to  you without having to wait until the next major release of HANA at the end of the year.

In this blog I’d like to point out a few of the differences you as a developer will encounter with this new patch and also how you can take advantage of some of the new features.

Patch 1

The first item I’ve seen some people confused about is the naming of Patch 1.  In the above announcement blog and the documentation, the name Patch 1 is used.  However if you look on the service marketplace at the patch download its actually listed as patch 3:


There is a Service Note that actually documents that fact that what we are calling SAP Web IDE for SAP HANA SPS 12 Patch 1 is technically numbered as Patch 3. That note is:

This note is useful because what we refer to as SAP Web IDE for SAP HANA SPS 12 Patch 1 is actually several separate components from the SMP with different patch levels:


The final piece of the puzzle comes when you look in the SAP Web IDE for SAP HANA itself in the Help->About menu option.  There you will see a completely different version number.  The number you want to see here is 3.12.25 or higher in order to have the fixes and functionality in what we are calling SAP Web IDE for SAP HANA SPS 12 Patch 1.


New Role for Using the SAP Web IDE for SAP HANA

If your system was recently upgraded and you logged into to see a “Not Authorized” message; don’t panic. You haven’t been demoted.  This patch level just comes with better security checks for using the development tools. There is a new role check and in order to continue using the SAP Web IDE For SAP HANA, you or your security admin needs to create a role collection and assign this to your user.

This can be done by an administrative user logging into the XS Advanced Administration tool and going to the Application Role Builder tile. After this patch you will see a new application role named webide*.  It has two role templates – one for the Web IDE Developer and one for the Web IDE Administrator.  The Web IDE Administrator is important because it is needed to run the new SSL Certificate Administration and Space Enablement admin tools we will talk about in a second.


Choose the Configure Role Collections option in the bottom right corner of this tool.  Then create a new role collect (or two if you want to separate the two templates).  My system is private, so I just created a single role collection named WEBIDE_DEVELOPER which contains both of the role templates:


Now you can go to the user administration tool in either the XS Advanced Administration or the older SAP Web-based Development Workbench Security tool. Assign the new role collection to all of your SAP Web IDE for SAP HANA users as appropriate.


Space Enablement

With XS Advanced, we introduced the concept of Spaces and Organizations. This is essentially a concept to better separate, control, and scale applications and services within the XS Advanced layer.  The initial version of the SAP Web IDE for SAP HANA in SPS 11 didn’t really support separate spaces at all and in fact only allowed development in the SAP space.  The SPS 12 initial version improved things a bit by at least allowing development in a single separate space which could be chosen as system installation or upgrade time.  With the Patch 1, we more fully support multiple spaces for development.

The first part of this change is the Space Enablement tool.  No longer must an admin choose the development space during upgrade/installation. Now one or more spaces can be made available for development by running the Space Enablement tool.  This is a new administration tool that gets installed with the SAP Web IDE for SAP HANA. Look at your XS Applications either from the command line (xs apps in the SAP space) or via the web based XS Advanced Administration tool to find the port/URL which this new tool is running on.


This tool is pretty simple.  You can see the status of all the spaces in your system or you can choose the space you want to use for development and Enable it.  This also solves a problem we had with the initial version of SPS 12.  This enablement creates the di-builder service in the development space.  In SPS 12 initially this service was created automatically upon first project creation in the SAP Web IDE for SAP HANA. However if something went wrong (for instance the user didn’t have proper authorizations for the space), it was very difficult to troubleshoot and/or rerun. Now this enablement can be redployed in a given space at any time via this tool.


The other aspect of this enhancement is that now that we can have multiple development spaces in use on a single system, we must specify the target space in the project properties in the SAP Web IDE for SAP HANA. Just right mouse click on the project and choose Project Settings and then switch to the new Space tab in the settings editor.


SSL Certificate Administration Tool

Also new in this patch level is an administrative tool to help with the upload of HTTPS certificates.  This is necessary for making outbound HTTPS requests from the SAP Web IDE for SAP HANA.  Most commonly this functionality is needed when communicating with the external Git server.  Often if you are running your own Git server within your enterprise, you will need to upload its certificate or your internal CA using this tool before we can connect to Git from the SAP Web IDE for SAP HANA.


HDI Deploy 2.0

The last new feature I want to detail is the fact that Patch 1 comes with the HDI Deploy version 2.0.  This is the Node.js module that runs during the Build of an HDB module.  This new version includes several enhancements especially when dealing with cross container and user provided services.

One of the problems with HDB module usage of cross container and user provided services in the past was that you had to hard code the service name in the design time files like the hdbgrant or hdbsynonymtemplate.  This was especially not nice when dealing with services that might have been created by the Web IDE for SAP HANA itself since they have the username and workspace in them.  Not only was this name long and nasty looking, but coding it within your development objects broke the ability to clone the project and test run it under a different user.

HDI Deploy solves this problem by introducing the concept of SERVICE_REPLACEMENTS. Basically this is a way to define a logical service name in the mta.yaml and use it in the various development objects. At build or deploy/installation time, this logical name will be replaced by the actual service name.

For example, we have have a single MTA project with two HDB modules – core-db and user-db.  From core-db we want to access user-db.  Therefore in the user-db container resource we define a property which can hold the generated service name:


Now in the core-db module definition of the mta.yaml when we list the user-container resource dependency we also add the SERVICE_REPLACEMENTS section.  We add a logical service name of hdi-user-service which maps to the user-container-name property (which in turn will be set to the generated service name).


This means that in the development objects themselves, we no longer have to hard code the container service name.  For example in our hdbsynonymtemplate for the user-db access from the core-db the target grantor is hdi-user-service (the key from the SERVICE_REPLACEMENTS) which gets replaced with the actual service name at build/deploy time.


A similar usage is when you want to access an existing Catalog schema via User Provided Service.  You use the same setup when you define the resource for the user provided service:


And in the requires section of the consuming module, you again use the SERVICE_REPLACEMENTS to define the logical service name:


This logical service name is again used in the development artifacts like the hdbgrants and replaced at build/deploy time:


The final HDI Deploy 2.0 feature I want to discuss is the concept of default access role. Before HDI Deploy 2.0, you couldn’t control the access grants to the container technical user.  If you created analytic or structured privileges within your container, the technical user never had access to these privileges by default. This meant a manual grant to these technical users.  This was not so nice because it involved a manual step after installation of an MTA, but also because it required knowing and working directly with the HDI container technical name (often a GUID like generated string of characters and numbers).

With HDI deploy 2.0 we now give the developer the ability to define a role which details what the technical user will be granted upon build/deploy.  The role name must be exactly default_access_role, therefore we recommend putting it in a separate folder where namespaces are deactivated. You then define an hdbrole design time object like any normal role. Now you as the developer have the control and can limit access.  For example you might not give the technical user Insert/Create/Update access to your tables; but instead only Execute to procedures. Inside the procedures you have definer rights and you have the insert/update/create operations. This further limits access forcing all modification operations to have to pass through your procedures as a pseudo API even for the container execution technical user.

You must be Logged on to comment or reply to a post.
  • Thomas,  I created a new 'DEV' space using the xs command line interface and enabled the space using the new Space Enablement tool.  When I try to attach the space to an existing project in Web IDE (or create a new project and select the DEV space using the wizard), I see the following message in the Web IDE console: 

    (Project Space) Failed to set workspace settings 

    Any suggestions?

    • Sorry, I've never seen that error myself. So I don't have any great suggestions for you.  Make sure your development user has the correct development rights for that space.  Beyond that check I can only suggest opening a support ticket.

      • Thomas, thanks for your quick response!  My development user has the SpaceDeveloper and SpaceManager roles for the space.  That should be all that is needed, correct?  

        • Yes that sounds right. After the space enablement do you see the di-builder in that space?  I'd probably go ahead and enter that support ticket so someone from support can have a look at your system.

          • Hi Michelle,

            Did you perform an upgrade from SPS11 to SPS12S on your machine, when the workspace for you user has already been created in SPS11.

            If this is a situation, it is probably a bug on our side, and i suggest to open a support ticket, providing system details.


          • Hi Thomas,

            I still can not find the di-builder in space.
            I have been able to find out that my DEV_SPACE is called PROD. and I have set roles for the PROD space. then I create a template project in web ide. After I xs target -s PROD, I can not find di-build in the PROD space.
            I have try xs rs di-core, and create a project again. but unfortunately I can not find the di-builder in PROD. I guess if the di-core installed successfully in my XSA runtime. the env of di-core show as below:


            C:\WINDOWS\system32>xs env di-core


            Getting env variables for app "di-core"...





              "VCAP_APPLICATION" : {

                "start" : "2016-10-10 09:53:38 +0800",

                "application_id" : "2054e877-bfb4-4c7a-983b-ac5f26f75b5b",

                "instance_id" : "2054e877-bfb4-4c7a-983b-ac5f26f75b5b",

                "space_id" : "cafd28e3-e0d6-4c5c-97e9-27a395789e0f",

                "application_name" : "di-core",

                "organization_name" : "orgname",

                "space_name" : "SAP",

                "started_at_timestamp" : "1476064418259",

                "started_at" : "2016-10-10 09:53:38 +0800",

                "state_timestamp" : "1476064217258",

                "full_application_uris" : [ "https://hanabox1:51007" ],

                "application_uris" : [ "hanabox1:51007" ],

                "uris" : [ "hanabox1:51007" ],

                "version" : "91628ace-ade6-4f32-8bf9-606f0b42f605",

                "application_version" : "91628ace-ade6-4f32-8bf9-606f0b42f605"


              "VCAP_SERVICES" : {

                "xsuaa" : [ {

                  "name" : "devx-uaa",

                  "label" : "xsuaa",

                  "tags" : [ "xsuaa" ],

                  "plan" : "space",

                  "credentials" : {

                    "clientid" : "sb-webide!i1",

                    "verificationkey" : "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgf7bokO/BvxeD/4OKg/m4nSSiDSXMnLknEmtD/i36kcMz1/UFlZx7PQDqrnFoGPVmJaihY6iJySRiuFJdKwhY3dze2aZcVqZrubYqcgNR4FpTwSxEX5jKxe1dp5UgS3ED6BvxCRarsh6hFenh3eoSuklltpZPzIQP0gLPtlWVHRkYLFNozYvAkg6DJzH1oHdedXaRFjxZnEIlc3eSxVAyhqU8Dleuu2piIKv+HxVLRSBft4ypGfYZVBJhcfEK4OsKGSwuQs4gVe5iLTS+x5WF/B2QgSbq9zazKtZVREnxX9b6EThzotqmcOCOTToOv37UimXlMSZ/IQYmWz1A2NgewIDAQAB-----END PUBLIC KEY-----",

                    "xsappname" : "webide!i1",

                    "identityzone" : "uaa",

                    "clientsecret" : "g32bAEN06CqYGjR90SznyW2+6timzd7ZyQt3KnV8egXQ1cuwi7Dk1pEwMADavLFL5kfOIMCZOgy5\n8kMeC4gpnQ==",

                    "url" : "https://hanabox1:30532/uaa-security"


                } ],

                "hana" : [ {

                  "name" : "di-core-hdi",

                  "label" : "hana",

                  "tags" : [ "hana", "database", "relational" ],

                  "plan" : "hdi-shared",

                  "credentials" : {

                    "schema" : "C695A2E5AB2E4922B5E045BD3D7C4B79",

                    "hdi_password" : "Aa_48524704945815767720272863894178898562905282983311160615237416425",

                    "password" : "Aa_75961536282741608832012685772156115489685556506008977267585090188",

                    "driver" : "",

                    "port" : "30515",

                    "host" : "hanabox1",

                    "db_hosts" : [ {

                      "port" : 30515,

                      "host" : "hanabox1"

                    } ],

                    "hdi_user" : "SBSS_92583228124014995117672329631117797060193412126990128199509647995",

                    "user" : "SBSS_67375619578762730215019188135675943711162281422374096118085308713",

                    "url" : "jdbc:sap://hanabox1:30515/?currentschema=C695A2E5AB2E4922B5E045BD3D7C4B79"


                } ],

                "fs-storage" : [ {

                  "name" : "devx-fs",

                  "label" : "fs-storage",

                  "tags" : [ ],

                  "plan" : "free",

                  "credentials" : {

                    "storage-path" : "/hana/shared/HD5/xs/bin/../controller_data/fss/fe60ab50-29bc-4de6-ac93-567b6c476cac"


                } ]






              uaa_service_name: devx-uaa

              JBP_CONFIG_SAPJVM_MEMORY_SIZES: metaspace:128m..

              XS_ENDPOINT: https://hanabox1:30530

              JBP_CONFIG_RESOURCE_CONFIGURATION: ['tomcat/webapps/ROOT/META-INF/context.xml': {service_name_for_DefaultDB : 'di-core-hdi'}]










                  "name": "di-core"


              DEV_SPACE: PROD







              JBP_CONFIG_JAVA_OPTS: [java_opts: ""]

              DI_CORE_URL: https://hanabox1:51007

              fs_service_name: devx-fs

              REGISTRATION_USER: M#11tMK*Zar0FaLy



                  "dependency-type": "soft"




                  "id": "",

                  "version": "3.12.25"


              TARGET_RUNTIME: tomcat


            Staging environment:

              MEMORY_LIMIT: 512m


            No execution environment variables have been set

  • there is an open bug on this issue, we are working on a fix.

    in the meantime, if you have sudo access to the machine on which di-core is deployed, you can make a manual fix for the affected workspace:


    temporary workaround to fix old workspaces :

    1:find base storage folder, by running "xs env di-core | grep storage-path"

    (example /usr/sap/hana/shared/XSA/xs/bin/../controller_data/fss/bf8b0860-fd2d-4a06-9d97-4da8782ba862)

    2: change to super user (sudo -i)

    3: go to that folder (cd /usr/sap/hana/shared/XSA/xs/bin/../controller_data/fss/bf8b0860-fd2d-4a06-9d97-4da8782ba862)

    4: find out workspace id (either by debugging WebIde requests, or by looking for project name from the base storage folder e.g. "find . -name <myProjectName>")

    (example workspaceid: workspace3sa9kk8goqjp0667)

    5: find all occurances of the workspace within the base storage folder: "find . -name workspace3sa9kk8goqjp0667"

    (example output:




    6: copy the .vfs folder from the old pathway to the new one: "cp -a ./fs-root/ab/60/49/workspace3sa9kk8goqjp066/.vfs ./ab/60/49/workspace3sa9kk8goqjp0667"

    7: restart di-core to apply the permission changes.


    Hope this helps.

  • Hi,

    Am getting data prview errors with calculation view in SPS12 with Eclipse NEON version that is available on

    Please can you advise if there is a workaround? Will WEB IDE help overcome any such Studio issues.



  • Hi all.

    After update webide lost my old projects.

    I tried creating a new project, and it successfully builds (from new workspace dir).

    I can see my old workspace dir on disk, and it stil contains project files, but they don't show up at https://webideUrl/che/project/workspacesMyWorkspace (as new project does).

    A also tried putting .vfs dir to the new workspace dir and restarting di-core as Sergey Kuperman advises, but no luck.

    Can I just move my old projects to the new workspace directory on disk with mv?

    • Hi Alexey,

      The workaround provided by Sergey is only fixing workspace content/settings access issue. In order to restore your old projects you need to copy whole workspace content (not only .vfs) from fs-root location to a new one, following Sergey explanation from./fs-root/ab/60/49/workspace3sa9kk8goqjp066/ to ./ab/60/49/workspace3sa9kk8goqjp0667.

      Take into account that if you have a project with the same name in new and old locations, the project will be overwritten with old version.

      In parallel we are working on the bug correction that will be provided in the nearest release.

      • Hi Zoya,

        Thanks for your answer, I was able to retrieve my projects.

        It looks though, that I was a little bit too fast to report successful builds as I just tried building node-js module to save time then.

        Now I have come into collision with the following issue: whether I try to build db module in a new project or an old one, it fails with the same error

        12:03:51 PM (Builder) Could not provision services for module 'qwe/db'. Could not create the HDI service for resource 'hdi-container'.
        Error: Could not create service key SharedDevKey: Binding service 7a7c139b-a119-4039-abb0-da1e11101c20 (service id 0eb0577d-677f-4f2c-bb0b-c23ab810af8b, plan id 463fc9b8-6546-4166-85c9-e4e61917344d) on service broker "hdi-broker" (url: to service key failed due to unexpected return code from broker: REST request PUT to url '' had response code 500 (Operation failed due to unexpected server error) with error message:
        stacktrace: Failed to create role 'hdi::odata::access_role'
        at javax.servlet.http.HttpServlet.service(
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(
        at org.apache.catalina.core.StandardWrapperValve.invoke(
        at org.apache.catalina.core.StandardContextValve.invoke(
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(
        at org.apache.catalina.core.StandardHostValve.invoke(
        at org.apache.catalina.valves.ErrorReportValve.invoke(
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(
        at org.apache.catalina.core.StandardEngineValve.invoke(
        at org.apache.catalina.valves.RemoteIpValve.invoke(
        at org.apache.catalina.connector.CoyoteAdapter.service(
        at org.apache.coyote.http11.AbstractHttp11Processor.process(
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
        at java.util.concurrent.ThreadPoolExecutor.runWorker(
        at java.util.concurrent.ThreadPoolExecutor$
        at org.apache.tomcat.util.threads.TaskThread$
        Caused by: java.sql.SQLException: Failed to execute 'GRANT SELECT ON _SYS_BI.BIMC_ALL_AUTHORIZED_CUBES TO "hdi::odata::access_role"'
        ... 27 more
        Caused by: SAP DBTech JDBC: [258]: insufficient privilege: Not authorized
        ... 31 more

        message: Failed to create role 'hdi::odata::access_role'

        12:03:51 PM (Builder) Build of /qwe/db failed.

        I tried building an empty db module in an app created from scratch, and it fails too.

        It looks like some kind of DB permissions issue to me.

        Yesterday I updated my HANA DB to after xsa update.

        Don't know if it could affect something.

  • hi, where can i find plugin for .hdbsynonymtemplate and .hdbsynonymgrantor? I saw in several posts but in none of sample .hdiconfig files with version indicated.

  • Hi, I have a question regarding Organizations, Spaces and Space Enablement:

    Scenario: I can create new Spaces in the initial Organization "orgname" and enable these using di-space-enablement-ui with the XSA_ADMIN User.

    a) I cannot enable spaces for different organizations that I've created from scratch.
    What is missing?
    I got following error message in the log for space "B2Dev3" for organization "B2Invent":
    Deploy Service is not available in space B2Dev3 for user XSA_ADMIN.
    space B2Dev3 not found
    Could not deploy the builder. Cause: Could not deploy the builder MTA..
    Could not deploy the builder MTA.
    The builder deployment has finished with status: FAILED in space B2Dev3.

    b) I cannot enable spaces with a different user than XSA_ADMIN.
    What roles are required to run the di-space-enablement-ui application?
    The user has the XS controller Admin role collection assigned.
    I get the error message "Permission denied" when opening the space enablement UI

    Thanks for your help

    • As far as the roles required, please refer to the following documentation item:
      It contains a table of the required authorizations.  The Space Enablement is an SAP Web IDE Administrative task.

      As far as the errors performing the enablement as XSA_ADMIN, double check the authorization on XSA_ADMIN. I don't believe as delivered that even the Admin user has the SAP Web IDE Admin roles described above.  Baring that, then please enter a support ticket for further assistance.


      Hi Arndt,

      I am running into the same error as you described in item a) - I am able to activate a new space in the initial organization, but not in a new one I created. The error message is the same as in your case.

      Have you been able to overcome the issue?

      Thanks a lot and kind regards


        • See:

          You need to install WebIDE for each (new) Organisation separately.

          The space-enablement-ui operates on spaces within the same organisation.

  • Hello everyone,

    Could any one help over here..

    We got a problem after installing XSA on our SP12 system, Whenever we try accessing WEBIDE over the URL from xs app webide -urls we are getting an error/message "Permission denied!",  not sure what went wrong..

    The header response says 403 forbidden..
    We have a clean install of SP12, XSA, and user created with required previlages and space manager access.

    Do we got anything missing over here??



    • Have you created the role collection and assigned it to your XSA user as described in this blog?  You said your user has the required privileges, but you haven't actually described what you granted to this user. Permission denied error would seem to indicate that something is still missing.

      However this question should really be its own Q&A thread not posted to the comments section of a blog.

      • Hello Thomas,

        I am getting the same issues here, can you please take a look on it ?

  • Thank you Thomas.
    It appeared not an issue because Mozilla somehow opens it blank but with Chrome everything is okay.
    and could you say if it is possible to add a plugin to the OnPremis WebIDE?
    I don’t see such an option in Tools -> Preferences.

      • I just heard back from the note owner.  It was taken offline to edit some details for an upcoming patch.  It has been re-released and should be visible to you once again.

        • Thanks a lot, that was fast.

          And indeed, I can already see it. Seems to be the first time I like new “Support Portal”. In the past synchronisation issues were not that uncommon…


  • /
  • /
  • Hi,

    I am enabling a space in the Space Enablement Tool. After which I get the status 'Outdated' and I cannot see this space in WebIDE.

    Please suggest what would have gone wrong.

    • Outdated would generally mean that the di-builder in your space is a version older than the di-core. If you still see this error after performing an update, then I suggest you enter a support ticket for assistance. You might try manually deleting the di-builder from the command line and then re-running the space enablement.

  • Hi Thomas,


    Very nice blog.. We have installed webide. everything is working fine. How do I connect to HANA database from webide, do I need to install sap hana connector separately?


    Thank you,


    • There is no need to configure a connection.  The SAP Web IDE for SAP HANA is automatically connected to the HANA system in which it is installed. Just create an HDB module and when you build it will be deployed to the same underlying HANA system.



      • Thank you Thomas.. I created HDB module successfully. But now when I try to create flowgraph and select datasource, I am not able to search any tables in the database. At the time of HDB module creation, I have added SCHEMA name. Any idea why I would not see any tables or views?


        Thank you,