Skip to Content
Author's profile photo Peter Murphy

File Uploader on HANA Cloud Platform

Recently I’ve started dipping my toes into the Hana Cloud Platform and as an exercise I thought I’d recreate a File Upload application on which I wrote a blog a number of years ago –

Upload data to HANA table with SAPUI5 FileLoader and HANA Extended Services

In that initial demo the UI and server-side javascript code were both deployed on the HANA XS engine of an on-premise Hana platform.

In this new demo the UI will be developed and deployed as an HTML5 application on HCP and call an xsjs service on a HANA instance running on HCP. The purpose is to upload a csv file with data to a table in the HANA database.

It will use Principal Propogation to pass the logged-in cloud user to the HANA XS application. The authentication mechanism used to propogate the logged in user will be Application-to-Application SSO. This has the benefit of the HANA XS dynamically creating a new DB user based on the forwarded details.

Much of the details of Principal Propogation and the setting up of the service provider certificate can be found in the following two excellent blogs by  and . I will be repeating many of those steps with some slight variations e.g. the HANA Studio will not be used and everything will be done with the web-based dev tools. Also it seems the limitation in using the “Generating Key Pair” button for the HTML5 Local Service Provider certificate has been fixed in the latest revisions of HANA.

Principal Propagation between HTML5- or Java-based applications and SAP HANA XS on SAP HANA Cloud Platform

“Play It Again, SAML” – How to Set Up SAML Authentication For Your SAP HANA Cloud Platform Trial Instance


To complete the steps below you will need the following pre-requisites in place:

  • A Hana Cloud Platform trial account and have created a HANA MDC database instance (see below for version of the database I am on).
  • OpenSSL installed to generate the key pair for SAML Service Provider.
  • Following roles assigned to the SYSTEM user

– sap.hana.xs.lm.roles::Developer
– sap.hana.ide.roles::Developer

  • Also add all roles containing “xs.admin”

1. Create schema and table to upload data to.

First up we’ll create a schema and table in the database to upload our data to.

Open up the catalog in the HANA Web based Development Workbench. Right click on Catalog and do New Schema.

Open SQL Console and execute the following to create the table:

id int primary key,
name nvarchar(20),
description nvarchar(50)

2. Create the xsjs fileupload service.

Now we create our service which will take in the uploaded file, read the content and write the content to the database table.

Open the Editor in the HANA Web based Development Workbench. Right click on Content and do New -> Package.

Right click on fileupload package and do Create Application.

Right click on fileupload package and do New -> File to create FileUpload.xsjs

Add the following code to FileUpload.xsjs

function escape(v1)
          var v2 = v1.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
          return v2;

$.response.contentType = "text/html";
    var conn = $.db.getConnection();

    var pstmt = conn.prepareStatement( "insert into TEST_UPLOAD.\"MY_TABLE\" (id, name, description) values(?,?,?)" );
        var file_body = $.request.entities[0].body.asString();
        var allTextLines = file_body.split(/\r\n|\n/);
        var lines;
        var entries;
        var col;
        for (lines=0; lines<allTextLines.length-1; lines++)
            entries = allTextLines[lines].split(',');
            col = entries.splice(0,allTextLines.length);
            if ( col[0].length > 0 )
                col[0] = escape(col[0]);
            if ( col[1].length > 0 )
                col[1] = escape(col[1]);
            if ( col[2].length > 0 )
                col[2] = escape(col[2]);
        $.response.setBody("No Entries");
    $.response.setBody("Upload successful!");
    $.trace.error("Error upload: "+err.message);
    if (pstmt !== null)
    if (conn !== null)

Open .xsaccess file and set the value for prevent_xsrf to false.

Create New -> File .xsprivileges and add the text per below

Create New -> Role and add the application privilege created in the previous step

Activate all the files.

The folder structure should look like this

3. Create the SAPUI5 application.

Now create our SAPUI5 frontend application.

Open the SAP Web IDE.

File -> New -> Project from Template

Open the FileUploadView.xml file and add the following code

<mvc:View controllerName="" xmlns:html=""
	xmlns:mvc="sap.ui.core.mvc" displayBlock="true" xmlns="sap.m" xmlns:unified="sap.ui.unified">
		<pages><Page title="{i18n>title}">
				    <unified:FileUploader id="FileUploader" uploadUrl="/pm/com/demo/fileupload" uploadComplete="onUploadComplete">
				    <Button text="Upload" width="100px" id="__button1" press="onUploadPress"/>	

Open the FileUploadView.controller.js file and add the following code

], function(Controller) {
	"use strict";

	return Controller.extend("", {

		*@memberOf pm.controller.Upload
		onUploadPress: function () {
			//This code was generated by the layout editor.
			var fileLoader = sap.ui.getCore().byId("__xmlview0--FileUploader");
		*@memberOf pm.controller.Upload
		onUploadComplete: function (oEvent) {
			//This code was generated by the layout editor."sap.ui.commons.MessageBox");
		    var sResponse = oEvent.getParameter("response");, sap.ui.commons.MessageBox.Icon.INFORMATION, "Information");

Open neo-app.json and add a new path as follows

      "path": "/pm/com/demo/fileupload",
      "target": {
        "type": "destination",
        "name": "xsfileupload",
        "entryPath": "/pm/com/demo/"
      "description": "HANA XS FileUpload backend service"

The project structure should look like the below

Deploy the application to the HANA Cloud Platform. Right click on the FileUploadUI folder and do Deploy -> Deploy to SAP HANA Cloud Platform.

4. Create PSE, assign for SAML and register the service provider Certificate in the HANA MDC instance.

In OpenSSL create a new certificate and key

openssl req -x509 -sha256 -newkey rsa:2048 -keyout certificate.key -out certificate.crt -days          1024 -nodes   -subj ‘/’

In the HANA Workbench Catalog open a SQL Console. When setting the certificate use the values generated in certificate.crt and certificate.key.




Examine table SYS.P_PSES_ and you should see the newly created PSE.


Examine table SYS.P_CERTIFICATES_ and you should see the newly created Certificate.


Now take a look at table SYS.PSE_CERTIFICATES to see how the PSE and Certificate is linked


5. Update the Service Provider Configuration

Go to the XS admin tool at the following path –

<mdcname><account name>

Click Edit and update the org info (as appropriate) for your Service Provider

Ensure the Default Role is set to PUBLIC

6. Configure the Local Service Provider for HTML5 apps

In the HANA Cloud Platform Cockpit, under Security click on Trust to go to the Trust Management screen.

Click on Edit and change Configuration Type to Custom. Click Generate Key Pair to generate key and certificate.

After generating the key and certificate click on “Get Metadata”. Save the generated Metadata XML file.

Save and then change the Configuration Type back to Default and Save again.

Click on the Trusted identify Provider. The SAP ID Service is the identity provider when the Default configuration type is selected.

7. Set up trust in HANA XS to the HTML5 Local Service Provider

Go to the XS admin tool at the following path –

<mdcname><account name>

Go to SAML Identity Provider and click the add (+) button. In the Metadata section paste the Metadata XML generated from step 6. Click Save. Make sure the Dynamic User Creation checkbox is checked and enter dummy values /saml2/sso for the SingleSignOn URLs.

Open the SQL Console in HANA and you should see an entry in _SYS_XS.HTTP_DESTINATIONS for the above


8. Create certificate in HANA for the generated HCP Local Provider certificate

Open SQL Console in HANA and execute the following statement taking the certificate value from above


Verify that the certificate has been created successfully


Now add the certificate to the PSE


Verfiy that it has been added successfully


9. Setup Destination for the xsfileupload service in HCP

In HCP, under Connectivity, select Destinations and click New Destination.

The URL should be the full url of the file upload xsjs service e.g.

Add additional property “saml2_audience” with value as per the name identifier in the SAML Service Provider.
Specify AppToAppSSO authentication.

10. Setup the default role for dynamically created users in XS.

In the HANA Web-based Development Workbench open the Security window. Right click on Roles and do New Role. Set name to DEFAULT_ROLE_FOR_FILE_UPLOAD and add the previously created role

Also add the TEST_UPLOAD.MY_TABLE table to the role.

Now open SQL Console again and execute the following statement to update the “defaultrole” configuration property.

SET ('saml', 'defaultrole') = 'DEFAULT_ROLE_FOR_FILE_UPLOAD';

11. Configure SAML for the XS Service

Go to
https://<mdcname><account name>

Select SAML and choose the HANA identity provider from the list

12. Test the application

I created some test data and saved in a file called uploadtest.csv. We will upload this data to the database using our new upload tool.

In the HCP Cockpit go to the HTML5 applications and select the fileuploadui. You should see a link to the application in the Active Version section.

Copy the link and open in a private browser so that you will be prompted to enter your user credentials.
You should be redirected to the HANA Cloud log on page

Enter credentials and click Log On. You should now be brought to the File Upload UI.

Click Browse and select the data file that you want to upload.

Click Upload

Now open a SQL Console and verify the data

select * from test_upload.my_table;


Now open the Security section of the workbench and expand the Users list. You should see a new user has been created with the same ID as your HCP ID and the default role assigned.


Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Moya Watson
      Moya Watson

      Nicely done! Thanks for taking the time to write this up.  Would love to find the time to try this.

      Author's profile photo Sridhar Karra
      Sridhar Karra

      Thanks a lot for the content. I see some of the images are not showing up. Appreciate a fix?

      Author's profile photo Peter Murphy
      Peter Murphy
      Blog Post Author

      Hi Sridhar, they show up fine for me. Maybe a browser issue on your end?

      Author's profile photo Former Member
      Former Member

      Hi Peter,

      I've followed this blog upto end, but I'm getting "

      Dynamic user creation failed (username=<account-name>). Reason was: insufficient privilege: Not authorized to grant role PUBLIC

      " message while run the application. Please help me out from this issue.


      Raja B

      Author's profile photo Peter Murphy
      Peter Murphy
      Blog Post Author

      Hi Raja, not sure on this. Can you check your config for the service provider - step 5?

      Author's profile photo Former Member
      Former Member

      Hi Murphy,

      I have created the same with Different SAP ID, on this I’m getting Information like

      After this message I checked in trace, there the message shown like

      Check above images, and please help me…..

      And we are in urgent to get through this issue, it would be grateful if you guide us to solve this issue by your valuable guidance. 
      It would be great if you personally help us.
      Looking forward for your guidance.

      Thanks & Regards,

      Raja. B

      Author's profile photo Former Member
      Former Member


      my application "does not want to open" in Fiori Lauchpad or it is completely empty in Web (below printscreen). I have done everything as you have. Can you help me with that problem?

      Best regards,

      Emilia Olszak

      Author's profile photo Former Member
      Former Member

      Hi Peter,


      Thanks for this detailed post. After completing all the steps, the fileuploader page is not showing anything(Browse/upload option page). Can you please let me know what I might have done wrong. Thanks.


      Author's profile photo Former Member
      Former Member


      Hello Mate,
      Thanks for the timely post, at least for me. I have encore time wondered about the transition, but somehow did not dare, because the information I came across very controversial.
      But today, after reading your article I’m very confident to take up any challenges.


      I have Hana 2.0 Platform and Lumira 1.31 Desktop and Server. I want to create a restricted user on <a href="">SAP S/4 Hana</a>
      database which can use lumira Desktop to access limited calculation views via analytical privileges. My success is that the user can access the Lumira view (through BI Platform Lumira Server) and access the data for view which were made by developers. But the user cannot create their own Live Hana Data Acquisition Lumira Documents using Lumira Desktop and their restricted user login.

      My question is then, what role or privileges do i need to assign to allow them this access?

      By the way do you have any YouTube videos, would love to watch it. I would like to connect you on LinkedIn, great to have experts like you in my connection (In case, if you don’t have any issues).
      Please keep providing such valuable information.
      Thank you,


      Author's profile photo Former Member
      Former Member

      Hi Peter,


      Thanks a trillion mate!

      We have a problem migration our client’s date to SAP S/4 Hana system.

      We are trying to upload around 50.000 BP data from legacy system to SAP with external batch input software(same as LSMW) .So we create flat files, intermediate files and upload it to batch input software. We have two problems:

      ① Process is very slow (it took us 3 days to upload 50.000 data)

      ②Each BP data contains a lot of bank details, but the system is only migrating maximum 4 banks ( Bank details section has 4 spots and for one to register more than 4, they have to scroll down, and we are not being able to stimulate that process in our software)

      As a solution, we are thinking of using BAPI. Is there anyone of who had similar problems during data migration, if yes, how did you resolve them. Also if there is anyone who has experience with BAPI for BP, please let me know how you did.


      It works like charm, saved a lot of energy & time.

      By the way do you have any YouTube videos, would love to watch it. I would like to connect you on LinkedIn, great to have experts like you in my connection (In case, if you don’t have any issues).

      Please keep providing such valuable information.

      Thank you,

      Irene Hynes