Skip to Content
Technical Articles
Author's profile photo Lucia Subatin

From zero to Analytics pt4: Installing the HANA Analytics Adapter

You’ve come a long way, but this is the final step before the visualizing fun:

This will be about installing the HANA Analytics Adapter. I will also test the live connection from SAP Analytics Cloud.

Deploying the HANA Analytics Adapter

I will be using the CLI from the console in the operating system of my HANA instance (you could install it and use it locally too: This also means I had to upload the zip file to the operating system.

Install the HANA Analytics Adapter

Log in to the CLI with a user powerful enough to perform installations in the development space:

xs login 
xs target -s development

You can now

xs install <<full path and name of the zip file>>

Give it a minute and let her work her magic:

Remember the diagram in the previous post? Here are all of the components I had promised:

Take note of the URL and port for xsahaa-entry. That is the approuter and you will need that to connect from the analytics tools.

Test it

Open a browser, and paste that URL. Use HAAUSR to log in… and Ta da!

If you are like me, after all of this effort, this page makes you very happy. Let’s do some real testing now (after all, that message does not really mean anything).

Add the following to the URL:  /sap/bc/ina/service/v2/HeartBeat


This one is not as pretty but you are now getting the backend module to execute something.

Modify CORS

If you unzip the file and check the mtad.yaml descriptor, you will see a variable for the approuter called CORS. By default, it is set to not accept requests from other origins, which is inconvenient when an external server like SAP Analytics Cloud is performing the request.

This is what xs env xsahaa-entry shows:

Create a file called cors.txt and add the following text in it (replace the host with your host for SAP Analytics Cloud):

    "uriPattern": "^/sap/bc/ina/(.*)$",
    "allowedOrigin": [
                       { "host" : "", "protocol":"https" }
    "allowedMethods": ["GET", "POST", "HEAD", "OPTIONS", "PUT", "DELETE"],
    "allowedHeaders": ["Origin", "Accept-Language", "Accept", "X-Requested-With", "Content-Type", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Authorization", "X-Sap-Cid", "X-Csrf-Token"],
    "exposeHeaders": ["Accept", "Accept-Language", "Authorization", "X-Requested-With", "X-Sap-Cid", "Access-Control-Allow-Origin", "Access-Control-Allow-Credentials", "X-Csrf-Token", "Content-Type"]

Set the new content of the CORS variable with:

xs set-env xsahaa-entry CORS --from-file cors.txt
xs restage xsahaa-entry
xs restart xsahaa-entry

Accepting that self-signed certificate

One more thing before you can connect… HANA Express brings a self-signed certificate. You can get yourself a proper, secure certificate signed by a Certificate Authority.. or you can insist on connecting anyways if, after all, you are just practicing and security risks such as a man-in-the-middle attack do not worry you.

If you tried to connect from SAP Analytics Cloud you would get a message saying something like “SSL certificate untrusted”. Analysis for Office would not even give you an error.

So let’s do a quick and dirty (insecure) workaround to that.

Right-click on a site that is logged in to XSA, click on certificate and follow the instructions to download a certificate (this works with Chrome):

Follow the wizard until completion. Remember where you are saving the certificate.

Now run mmc . File -> Add/remove snap-in -> Certificates (Add >):

Right-click on the certificates under Trusted Root Certification Authorities and Import the .cer file you exported.

(Sorry Mac users, please feel free to post the instructions in the comments or in your post)

Create a Live Connection from SAP Analytics Cloud

You can now proceed to connect from SAP Analytics Cloud!

(This is why you needed to rename your instance, because hxehost will not work… SAC does not know what you have mapped in your hosts file)

Use the Live Data connection option, because you can now:


I’ll let you guess how to fill the model configuration. If you made it all the way here I’m assuming you are among the smart ones. The Data Source should list your calculation view.

And who is that lovely K-anonymity view over there? We are ready to rock and roll and create information out of data and then intelligence out of information.

In a pretty way and without a clue about aesthetics (that’s what I like about this tool…)


I hope this has been of use! A special thanks to Ingo Siebeking, one of the makers of the connector, for all the support along the way.

I’ll be playing with my new connection and posting later. So stay tuned on Twitter or LinkedIn!

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Durairaj Athavan Raja
      Durairaj Athavan Raja

      Dear Lucia,

      Thanks a lot for the detailed steps. I was able to set it up all. I was also able to create a connection (LIVE) from SAP Analytics Cloud . However when i tried to create a model i am getting the below authorization error(at the point where i use the dropdown to choose datasource). I guess the error is coming from HXE. I have set up HAAUSR (which the connection uses) user with privileges mentioned in your previous blog. Any pointer to resolve this would be of great help.

      Error [Server]: (#42014) Caught exception : exception 42111: SQL Error : Not authorized
      exception 42111: SQL Error : Not authorized

      Author's profile photo Lucia Subatin
      Lucia Subatin
      Blog Post Author

      Hi, Raja,

      Do you have any roles restricting the calculation view by any chance? Can you get a data preview with the HAAUSR connected from the DB explorer?

      If that does not give you an error, I would suggest activating a trace to check what is missing


      alter system alter configuration ('indexserver.ini','SYSTEM') SET ('trace','authorization')='info' with reconfigure

      And then unset with:

      alter system alter configuration ('indexserver.ini','SYSTEM') UNSET ('trace','authorization') with reconfigure

      Hope this helps,






      Author's profile photo Durairaj Athavan Raja
      Durairaj Athavan Raja

      Thanks Lucia.

      This is a fresh HXE. I haven't done anything spl here. Yes i was able to preview data using user HAAUSR.

      I will try activating the trace and see whats going wrong. I am assuming that the user HAAUSR doesn't have enough privilege to read the list of data sources.  I did check HAAUSR for service "/sap/bc/ina/service/v2/GetServerInfo" and its working fine. The error mentioned earlier happens exactly at the point when trying to get the list of available data sources while creating model at SAC.

      Will analyze it further and post the results here.

      Thanks again for the excellent blog.



      Author's profile photo Durairaj Athavan Raja
      Durairaj Athavan Raja

      I did a HTTP trace and looks like the user HAAUSR should be granted access for "_SYS_BIC" schema.

      How can i view the current privileges of HAAUSR and how can i add the above privilege



      Author's profile photo Lucia Subatin
      Lucia Subatin
      Blog Post Author

      Hi, Raja, what is the SQL trace saying? The last pass (while documenting this) was also on a fresh HXE, only that upgraded to Rev 35.

      These are the privileges for my HAAUSR, you can check yours from the cockpit:





      Author's profile photo Bill Liu
      Bill Liu

      Hi Raj,

      did you get the problem resolved? I ran into the same issue.




      Author's profile photo Steffen Schmidt
      Steffen Schmidt

      Hello Lucia,


      I am struggeling with the guide after the installation of the adapter.

      When opening this url /sap/bc/ina/service/v2/HeartBeat I get the error “Text“: “ [10]: authentication failed”

      I am logged in with the created user from the previous guide (part 3).

      In the previous part of the guide I could create a connection with that user in the database explorer and query the calculation view.

      Do you have any idea what went wrong?

      Best Regards,


      Author's profile photo Lucia Subatin
      Lucia Subatin
      Blog Post Author

      Hi Steffen,

      I get that same error if I login from a different window, but same browsing mode that I am using with XSA_DEV. In other words, make sure you are switching to incognito mode (or another browser if you are already using incognito) to log in with HAAUSR.




      Author's profile photo Steffen Schmidt
      Steffen Schmidt

      Hello Lucia,

      I can reproduce the error in the incognito mode of Chrome, so when I am starting a new incognito browser session, also when I am using IE or Chrome with all Coockies cleared and not being logged-in in the WebIDE.

      Best Regards,


      Author's profile photo Lucia Subatin
      Lucia Subatin
      Blog Post Author

      It looks like the JWT identity provider is not added for the user in the tenant HXE.

      You can see the mappings in the view JWT_USER_MAPPINGS (make sure you are logged in to the tenant database). You can also repeat the "alter user.." statements logged in to HXE to make sure.

      You can also check the providers are the same in both databases. I would expect other types of errors if this was not the case, but it may guide you towards what is missing.





      Author's profile photo Steffen Schmidt
      Steffen Schmidt

      It worked for my then. Not 100% sure what was the issue, I went through creating the user and setting the permission with exactly your code.

      Before I was probably too brave and tried it with another user name, maybe is it case sensitive?

      Thanks for your help,

      Author's profile photo Michael Pytel
      Michael Pytel

      Great blog Lucia!  Question – where do I download the zip file?   I’m searching SWDC – but not finding it.  Can you share the path or component name to search for?


      Nevermind 🙂 Found it!

      Author's profile photo Lucia Subatin
      Lucia Subatin
      Blog Post Author

      Hi, Michael,

      You can download from here:



      Author's profile photo Matthias Eickhoff
      Matthias Eickhoff

      Hi Lucia Subatin ,


      I found this article very helpful! One question: Can the xsahaa-entry connection in Analytics Cloud also be used as an Odata source in analytical applications or would you say it is preferable to create a seperate service for that?


      Best regards,

      Author's profile photo Petter Huseby
      Petter Huseby


      Greate blog.


      I have manage to set up Live connection, but now after the samesite security, Im not able to add the needed parameters/variable. I have tried to add this to the dispatcher config PREFIX=/, FILE=/hana/shared/HXE/profile/rewrite.txt and created the rewitefile.txt. But I still get problemer with the new security settings in Chrome. Any suggestion on how to apply the samesite properties?


      Author's profile photo Bill Liu
      Bill Liu

      Hi Lucia,


      thanks for the blog. One question about the following

      (This is why you needed to rename your instance, because hxehost will not work… SAC does not know what you have mapped in your hosts file)

      I don't have a public IP address to expose my HANA host on internet, but I still want to use SAC direct live connection to show my data from HXE within intranet. Is there anyway to make it work without public IP or changing domain name?




      Author's profile photo Gregor Wolf
      Gregor Wolf

      Hi Bill,

      you could try to solve this using the SAP Cloud Connector and expose your HANA via an HTML5 app in the Neo environment or using the Approuter in Cloud Foundry.

      Best regards

      Author's profile photo Bill Liu
      Bill Liu

      thank you Gregor. SAC somehow accepted hxehost with an entry in my hosts file. I got a new issue below ;-(.

      Author's profile photo Bill Liu
      Bill Liu

      I got the good testing result from https://hxehost:51054/sap/bc/ina/service/v2/GetServerInfo, and the SAC connection is established. However, I can't see any calc views that I created/built in the following dialog in SAC somehow.

      Can someone please help? any hint is appreciated.



      Author's profile photo Marc Spiel
      Marc Spiel

      Dear Experts,

      we recently ran into a problem, which causes Objects from certain Stories in the SAC to not load properly. The underlying data comes from a Live-Connection to our on-premise HANA System.

      After some digging we found out that the Error is likely caused by a faulty SameSite Cookie Configuration in the Hana Analytics Adapter.

      More Info:

      However i can't seem to fix the problem at its root. A workaround, that has proven to be somewhat effective, is using an older Chrome Version but I would like to know how to configure the HAA correctly so that it works as intended.

      Anyone who has faced the same issue, I am happy to hear and understand how you fixed this problem.

      Best Regards.

      Author's profile photo William West
      William West

      Hi Lucia Subatin

      Thanks for the blog. One comment and one question.

      We recently tried installing the cloud connector on our on-prem HANA database using XSA SP 127. (As a note, we had done a clean XSA install on SP 127, not upgraded from a lower version). We got an error about part of the cloud connector requiring either node 8 or node 6. After running 'xs runtimes' we realized that SP 127 shipped with Node 10. In order to correctly install the cloud connector, we had to download XSA SP 123, extract the SAR file, and find NODE_8.tgz in the packages directory. Once we installed the Node 8 runtime, the cloud connector installed correctly.


      Now the question. We have all the connectivity working between SAC and our HANA db working correctly. I can create a connection to our HANA db in SAC. However, when I try to create a model from the live data connection, it doesn't find any data sources. We think we have set up the connection user id with all the necessary privileges (the INA role, EXECUTE_MDS_DEV obj privilege) and granted the necessary privileges to artifacts on the db, but the connection shows no available data source objects. Any idea what we are missing?




      Author's profile photo Thiago Franca Carvalho Silveira
      Thiago Franca Carvalho Silveira

      Hi Lucia,

      I got the process to create the HAAUSR and as far I understood this is a technical user used to estabilish the connection, am I right?

      I have a question on how some SAC end users are going to execute a story on top of the calculation view and let`s say I have an Analytic Privilege for this CV, how SAC will determine, during the live connection, the authorizations that  the given user should have? There should be one user in HANA DB for each SAC user?

      Great blog by the way! 🙂


      Best Regards,