(Re-)Establish Trust with XSUAA and HANA DB
You installed XSA with MDC and you assigned your application in a organization / space to a logical database. This assignment can be done in XSA Admin in Service Broker Config (l#/serviceBrokerConfig)
Now the identity propagation fails.
The reason is that there is not automatic trust between UAA and HANA MDC. The trust creation will come with HANA 2 SP01 during MDC creation. The installation creates a trust to system DB only.
You can create this trust with the attached bash script yourself. You need to following parameters to do this.
- system user (of logical database)
- system password (of logical database)
- xsa admin user (is optional but if you provide this name this user is enable to logon with SAML / JWT)
- jdbcURL This URL can be taken from uaa.log. In case you can create trust to a logical database you need the database name
Download the files from https://github.com/strehle/xsuaa-scripts/tree/master/saml to your XSA machine.
Prepare execute. Configure settings in xsuaa_settings.cfg. Example for HANA with SID : XSA on instance 00 with logical database ABC
# documentation about jdbc url, see http://help.sap.com/saphelp_hanaplatform/helpdata/en/ff/15928cf5594d78b841fbbe649f04b4/frameset.htm
# this is the jdbc url for a multiple instance database with connect to tenant DB ABC
Save this to file xsuaa_settings.cfg
Execute the shell script xsuaa_hdbtrust.sh. Best you execute it on the XSA instance under the <sid>adm user of your XSA installation, however you can also call if from another machines. For xs login you need xs command tool.
The script creates the trust and executes the test. Typical successful output is:
In case you can here an error you can check in uaa.log the error reason or in HANA trace you will find the reason.