Skip to Content
Technical Articles

From zero to Analytics pt4: Installing the HANA Analytics Adapter

You’ve come a long way, but this is the final step before the visualizing fun:

This will be about installing the HANA Analytics Adapter. I will also test the live connection from SAP Analytics Cloud.

Deploying the HANA Analytics Adapter

I will be using the CLI from the console in the operating system of my HANA instance (you could install it and use it locally too: This also means I had to upload the zip file to the operating system.

Install the HANA Analytics Adapter

Log in to the CLI with a user powerful enough to perform installations in the development space:

xs login 
xs target -s development

You can now

xs install <<full path and name of the zip file>>

Give it a minute and let her work her magic:

Remember the diagram in the previous post? Here are all of the components I had promised:

Take note of the URL and port for xsahaa-entry. That is the approuter and you will need that to connect from the analytics tools.

Test it

Open a browser, and paste that URL. Use HAAUSR to log in… and Ta da!

If you are like me, after all of this effort, this page makes you very happy. Let’s do some real testing now (after all, that message does not really mean anything).

Add the following to the URL:  /sap/bc/ina/service/v2/HeartBeat


This one is not as pretty but you are now getting the backend module to execute something.

Modify CORS

If you unzip the file and check the mtad.yaml descriptor, you will see a variable for the approuter called CORS. By default, it is set to not accept requests from other origins, which is inconvenient when an external server like SAP Analytics Cloud is performing the request.

This is what xs env xsahaa-entry shows:

Create a file called cors.txt and add the following text in it (replace the host with your host for SAP Analytics Cloud):

    "uriPattern": "^/sap/bc/ina/(.*)$",
    "allowedOrigin": [
                       { "host" : "", "protocol":"https" }
    "allowedMethods": ["GET", "POST", "HEAD", "OPTIONS", "PUT", "DELETE"],
    "allowedHeaders": ["Origin", "Accept-Language", "Accept", "X-Requested-With", "Content-Type", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Authorization", "X-Sap-Cid", "X-Csrf-Token"],
    "exposeHeaders": ["Accept", "Accept-Language", "Authorization", "X-Requested-With", "X-Sap-Cid", "Access-Control-Allow-Origin", "Access-Control-Allow-Credentials", "X-Csrf-Token", "Content-Type"]

Set the new content of the CORS variable with:

xs set-env xsahaa-entry CORS --from-file cors.txt
xs restage xsahaa-entry
xs restart xsahaa-entry

Accepting that self-signed certificate

One more thing before you can connect… HANA Express brings a self-signed certificate. You can get yourself a proper, secure certificate signed by a Certificate Authority.. or you can insist on connecting anyways if, after all, you are just practicing and security risks such as a man-in-the-middle attack do not worry you.

If you tried to connect from SAP Analytics Cloud you would get a message saying something like “SSL certificate untrusted”. Analysis for Office would not even give you an error.

So let’s do a quick and dirty (insecure) workaround to that.

Right-click on a site that is logged in to XSA, click on certificate and follow the instructions to download a certificate (this works with Chrome):

Follow the wizard until completion. Remember where you are saving the certificate.

Now run mmc . File -> Add/remove snap-in -> Certificates (Add >):

Right-click on the certificates under Trusted Root Certification Authorities and Import the .cer file you exported.

(Sorry Mac users, please feel free to post the instructions in the comments or in your post)

Create a Live Connection from SAP Analytics Cloud

You can now proceed to connect from SAP Analytics Cloud!

(This is why you needed to rename your instance, because hxehost will not work… SAC does not know what you have mapped in your hosts file)

Use the Live Data connection option, because you can now:


I’ll let you guess how to fill the model configuration. If you made it all the way here I’m assuming you are among the smart ones. The Data Source should list your calculation view.

And who is that lovely K-anonymity view over there? We are ready to rock and roll and create information out of data and then intelligence out of information.

In a pretty way and without a clue about aesthetics (that’s what I like about this tool…)


I hope this has been of use! A special thanks to Ingo Siebeking, one of the makers of the connector, for all the support along the way.

I’ll be playing with my new connection and posting later. So stay tuned on Twitter or LinkedIn!

You must be Logged on to comment or reply to a post.
  • Dear Lucia,

    Thanks a lot for the detailed steps. I was able to set it up all. I was also able to create a connection (LIVE) from SAP Analytics Cloud . However when i tried to create a model i am getting the below authorization error(at the point where i use the dropdown to choose datasource). I guess the error is coming from HXE. I have set up HAAUSR (which the connection uses) user with privileges mentioned in your previous blog. Any pointer to resolve this would be of great help.

    Error [Server]: (#42014) Caught exception : exception 42111: SQL Error : Not authorized
    exception 42111: SQL Error : Not authorized

    • Hi, Raja,

      Do you have any roles restricting the calculation view by any chance? Can you get a data preview with the HAAUSR connected from the DB explorer?

      If that does not give you an error, I would suggest activating a trace to check what is missing


      alter system alter configuration ('indexserver.ini','SYSTEM') SET ('trace','authorization')='info' with reconfigure

      And then unset with:

      alter system alter configuration ('indexserver.ini','SYSTEM') UNSET ('trace','authorization') with reconfigure

      Hope this helps,






      • Thanks Lucia.

        This is a fresh HXE. I haven’t done anything spl here. Yes i was able to preview data using user HAAUSR.

        I will try activating the trace and see whats going wrong. I am assuming that the user HAAUSR doesn’t have enough privilege to read the list of data sources.  I did check HAAUSR for service “/sap/bc/ina/service/v2/GetServerInfo” and its working fine. The error mentioned earlier happens exactly at the point when trying to get the list of available data sources while creating model at SAC.

        Will analyze it further and post the results here.

        Thanks again for the excellent blog.



        • I did a HTTP trace and looks like the user HAAUSR should be granted access for “_SYS_BIC” schema.

          How can i view the current privileges of HAAUSR and how can i add the above privilege



          • Hi, Raja, what is the SQL trace saying? The last pass (while documenting this) was also on a fresh HXE, only that upgraded to Rev 35.

            These are the privileges for my HAAUSR, you can check yours from the cockpit:





  • Hello Lucia,


    I am struggeling with the guide after the installation of the adapter.

    When opening this url /sap/bc/ina/service/v2/HeartBeat I get the error “Text“: “ [10]: authentication failed”

    I am logged in with the created user from the previous guide (part 3).

    In the previous part of the guide I could create a connection with that user in the database explorer and query the calculation view.

    Do you have any idea what went wrong?

    Best Regards,


    • Hi Steffen,

      I get that same error if I login from a different window, but same browsing mode that I am using with XSA_DEV. In other words, make sure you are switching to incognito mode (or another browser if you are already using incognito) to log in with HAAUSR.




      • Hello Lucia,

        I can reproduce the error in the incognito mode of Chrome, so when I am starting a new incognito browser session, also when I am using IE or Chrome with all Coockies cleared and not being logged-in in the WebIDE.

        Best Regards,


        • It looks like the JWT identity provider is not added for the user in the tenant HXE.

          You can see the mappings in the view JWT_USER_MAPPINGS (make sure you are logged in to the tenant database). You can also repeat the “alter user..” statements logged in to HXE to make sure.

          You can also check the providers are the same in both databases. I would expect other types of errors if this was not the case, but it may guide you towards what is missing.





          • It worked for my then. Not 100% sure what was the issue, I went through creating the user and setting the permission with exactly your code.

            Before I was probably too brave and tried it with another user name, maybe is it case sensitive?

            Thanks for your help,

  • Great blog Lucia!  Question – where do I download the zip file?   I’m searching SWDC – but not finding it.  Can you share the path or component name to search for?


    Nevermind 🙂 Found it!

  • Hi Lucia Subatin ,


    I found this article very helpful! One question: Can the xsahaa-entry connection in Analytics Cloud also be used as an Odata source in analytical applications or would you say it is preferable to create a seperate service for that?


    Best regards,

  • Hi

    Greate blog.


    I have manage to set up Live connection, but now after the samesite security, Im not able to add the needed parameters/variable. I have tried to add this to the dispatcher config PREFIX=/, FILE=/hana/shared/HXE/profile/rewrite.txt and created the rewitefile.txt. But I still get problemer with the new security settings in Chrome. Any suggestion on how to apply the samesite properties?


  • Hi Lucia,


    thanks for the blog. One question about the following

    (This is why you needed to rename your instance, because hxehost will not work… SAC does not know what you have mapped in your hosts file)

    I don’t have a public IP address to expose my HANA host on internet, but I still want to use SAC direct live connection to show my data from HXE within intranet. Is there anyway to make it work without public IP or changing domain name?




    • Hi Bill,

      you could try to solve this using the SAP Cloud Connector and expose your HANA via an HTML5 app in the Neo environment or using the Approuter in Cloud Foundry.

      Best regards

  • /