SAP Secure User Store

Use the SAP Secure User Store for non-ASE and non-IQ connectors, like ExpressConnect for HANA DB.

To support SAP Secure User Store logins, use the dsi_connector_sec_mech parameter with the create connection or alter connection commands. No interfaces file entry is required for the connection to the HANA DB instance when you use an SAP Secure User Store login.

The dsi_connector_sec_mech parameter is not a network-based security parameter. It is valid only for connections.

To use dsi_connector_sec_mech with ExpressConnect for HANA DB, you must first use the hdbuserstore utility to create a secure user store of encrypted credentials. For example:

hdbuserstore set hanads myhost:30215 myuser mYpA5Sw0rD

where "hanads" is a label used as the key for querying the secure user store, "myhost:30215" is the connection environment host name and port number, "myuser" is the user ID, and "mYpA5Sw0rD" is the password.

Note: The secure store must be created with the same operating system user ID that starts and runs Replication Server. Otherwise, Replication Server cannot access the secure user store.

Once you have created a secure user store, you can create a connection to the HANA DB instance with the encrypted credentials. For example, to connect to the HANA DB instance for ASE-to-HANA DB replication:

create connection to hanads.hanadb
using profile rs_ase_to_hanadb;ech
set username "foo"
set password "bar"
set dsi_connector_sec_mech to "hdbuserstore"
go

where the user ID and password "foo" and "bar" are unused values supplied only to satisfy the syntax of the create connection command.

Note: The same operating system user who started Replication Server must also own the secure user store.

You can alter an existing connection to a HANA DB instance to use dsi_connector_sec_mech. For example:

alter connection to hanads.hanadb
set dsi_connector_sec_mech to "hdbuserstore"
go

After running the alter connection command, you must suspend and resume the connection:

suspend connection to hanads.hanadb
go
resume connection to hanads.hanadb
go