Security: Users, Privileges, Authentication, Auditing & Encryption

You enabled client-side TLS on SAP HANA and assume node-to-node traffic is now protected too. Why is the internal channel still in the clear?

Which authentication mechanisms does SAP HANA support?

A regional sales manager must see only their own region's rows inside a calculation view. Why won't an object (SELECT) privilege accomplish this, and what does?

You granted SELECT ON SCHEMA to a reporting user. Months later a developer creates a new table in that schema with sensitive data. Who can read it, and why is that the cost of a schema grant?

A user has too much access via a role, and you want to carve out one schema as forbidden. Why can't you just add a deny, and what does HANA do the moment it finds a matching grant?

Two HANA catalog objects look identical at runtime, but one is owned by _SYS_REPO and one by a developer. Which is which, and why does the ownership difference matter operationally?

You are recovering an encrypted HANA database from backup. In what order must the root keys and the data be restored, and what is the failure if you get it wrong?

You create an application account with CREATE RESTRICTED USER and the app immediately fails to connect over JDBC. Is this a bug?

User A granted a privilege WITH GRANT OPTION to B, who passed it to C. A now revokes from B. What happens to C, and why is this a trap before mass-revoking?

How do you reset the SYSTEM-user password of the HANA system database when no equivalent admin user is available?

Best practice is to deactivate the HANA SYSTEM user in production. What must be true before you run DEACTIVATE, and what audit control should accompany it?

A developer asks for CATALOG READ so they can 'see all the data' without lots of SELECT grants. Why does this not give them what they think?

A locked-out end user complains they can't change their own initial password without admin help. Is USER ADMIN actually required for that?

A security review asks you to 'use auditing to stop privilege abuse.' Why is that the wrong expectation of auditing, and what is it actually for?

Which system views expose HANA audit entries written to the internal table, and which privilege is required to read them?

You need an HR user set that no general DBA can touch and that shares one stricter password policy. Why are user groups the right tool, and what does the group administrator buy you?

You enabled HANA cross-database access so Tenant A can read Tenant B. Tenant B still can't read A, and an UPDATE from A fails. Are these bugs?

Why does SAP insist a technical (not personal) user own an application's data dictionary, and what is the disaster if you ignore it?

Which ALTER USER statements (a) force a password change, (b) exempt a user from password lifetime, and (c) unlock a locked HANA user?

A user gets [258] insufficient privilege on a calculation view that selects from several procedures and views. SELECT on the view alone doesn't fix it. What's the next-best diagnostic step?

You granted a privilege WITH GRANT OPTION by mistake. How do you remove just the option, and why is the obvious approach impossible?

What are the six privilege types in SAP HANA?

You enable persistence encryption on a long-running production HANA database. Why is the data NOT fully protected right after, and what's the safer time to encrypt?

Why do repository roles escape the cascade/side-effect problems of the GRANT/ADMIN option, even when ordinary admins assign them?

An identity team can create and drop USERS fine but gets 'insufficient privilege' creating a ROLE. Which privilege is missing, and what's the split?

A scheduled-backup service account should run backups but must NOT restore or change backup config. Which privilege, and why not the other?

What three default user groups does SAP recommend setting up in SAP HANA?

A restricted HANA user still can't connect over ODBC/JDBC even though the app account exists. Which specific roles unlock that, and why isn't 'enable client connect' enough?

What are the five SAP HANA audit levels?

A developer wants to manually LOAD, UNLOAD, and MERGE a table but has full DML on it. Which privilege are they still missing, and why isn't DML enough?

You want a tenant DBA to stop/start and manage their tenant. Why can't you grant DATABASE ADMIN inside the tenant, and where must it live?

You need to verify everything a user can actually do, including via nested roles. Which view, and why not GRANTED_PRIVILEGES?

A user hits [258] insufficient privilege (SPS03+) and gives you the error GUID. What's the fastest way to find the exact missing privilege?

A HANA user authenticates with correct credentials but the connection is still refused. In what order does HANA check, and what two non-credential gates could be failing?

What do HANA's three password-lifetime defaults mean: maximum_password_lifetime, and the two 'unused' lifetimes?

You add 'company' to the HANA password blacklist but users still set 'Company2024!'. Which field's setting is wrong?

After configuring a HANA user for LDAP authentication, can they still log in with their old local password? What else can LDAP drive?

What do HANA's maximum_invalid_connect_attempts and password_lock_time defaults mean, and what does password_lock_time = 0 do?

With password_lock_for_system_user at its default, can repeated failed logons lock the HANA SYSTEM user? What is the secure setting?

You create an audit policy that names CREATE USER and GRANT ANY but it captures nothing useful. What two things must every policy specify?

Why does Kerberos/SPNego SSO usually fail for internet-facing HANA, and what must remote users do first?

You need X.509 certificates for HANA SSO with an external partner. Why won't a self-signed certificate do, and what's the deciding property?

In a HANA system replication pair, where do you configure encryption settings and the root-key backup password — and what must you NOT do on the secondary?

Two HANA secure stores sound similar: the system PKI SSFS and the secure store for data encryption. What specifically does the system PKI SSFS protect?

What does the HANA secure store hold, and how is that different from the system PKI SSFS?

What encryption algorithm does SAP HANA use for data-at-rest encryption?

You want to trim the internal audit-table size by lowering its retention. How low can minimal_retention_period go, and why does the floor exist?

You move a multitenant HANA system to high isolation to stop one tenant attacking another's files at the OS layer. What concretely changes versus low isolation, and what is still shared?

A user owns several schemas full of tables. Someone drops that user. What happens to the objects, and why?

When is SAP's monthly security patch day?

What is the correct SQL sequence to rotate the HANA data-volume encryption root key without risking lockout?

You enable all of HANA's data-at-rest encryption. Which three layers does it cover, and what data does it still leave unencrypted?

Which Python script switches a HANA system to high-isolation mode, and what does running it actually do to the system?

Between the instance SSFS and the local secure store (LSS), which is the default, and which would you choose to keep the DBA from touching the root keys?

You're moving to high isolation and assigning a tenant its dedicated OS user/group. What must already exist, and what's the SQL?

You set up hdbuserstore connections on a Linux client and want to reuse them on a Windows client by copying SSFS_HDB.DAT. Why does that fail?

You enable global auditing on a tenant by setting global_auditing_state in global.ini. The same statement does nothing on the SYSTEM database. Why?

Can you log on as the HANA _SYS user to manage the system tables it owns?

Monitoring alerts and performance metrics suddenly stop appearing in HANA. Which internal user is responsible, and what can you NOT do to fix it?

How are SAP HANA security corrections delivered — as standalone hotfixes, or something else? What's the planning implication?

An admin disables every custom audit policy. Which security-critical events are STILL recorded, and why?

You want a quick flag for whether a local HANA user has remote identities in other databases. Which column/view, and how does it differ from REMOTE_USERS?

A user still has a privilege after you revoke it. The same privilege was granted by two different admins. Why is it still there, and who must act?

An external auditor needs read-only access to the HANA audit log and nothing more. Which of AUDIT ADMIN / OPERATOR / READ, and why not the others?

What does revoking the PUBLIC role from a HANA user cost them, and what else must you revoke to actually create a restricted-equivalent user?

You encrypted today's HANA tenants, but a tenant created next month comes up unencrypted. Which parameters governed that, and what are their defaults?

You run a plain DROP USER on an account that owns objects, expecting cleanup. What actually happens by default, and how do you force the deletion?

What is the hdbuserstore SET syntax to create a key, and how do you target a specific tenant database?

You need a role that transports across DEV→QA→PROD and survives the creating developer leaving. Catalog role or repository role, and why?

Why does SAP recommend certificate collections (in-database) over file-system certificate storage for HANA, and what's the recovery payoff?

What does a HANA standard user get out of the box that a restricted user does not, and how is one created?

Which three ALTER USER statements convert a restricted HANA user into a standard user?

Why should you NOT grant predelivered standard catalog roles (MONITORING, CONTENT_ADMIN) directly, and what's the exception for SAP_INTERNAL_HANA_SUPPORT?

A developer needs to debug a procedure running in another user's session. What does ATTACH DEBUGGER actually scope to, and what second privilege is also required?

A user has no SELECT grant on a sensitive table yet reads all its rows. How is that possible, and what's the audit lesson?

Where is the HANA password policy actually stored (system DB vs tenant), and which view tells you the policy a SPECIFIC user is subject to?

You try to grant a repository role with GRANT ... TO <user> and it fails. Why, and what's the correct mechanism?

You're adding row-level security to a new HANA calculation view. XML or SQL analytic privilege — which does SAP recommend, and why avoid the other?

In a SAML 2.0 SSO setup, is HANA the identity provider or the service provider, and what does SAML cover?

You need to disable an unused authentication method (e.g., turn off basic password). Which parameter and file, and what's the default you're narrowing from?

You grant a package privilege on a parent package to give a team access to one subpackage. What did you actually just grant?

You want a grantee to be able to pass a SYSTEM privilege on to others. Which option do you append, and what's the trap with WITH GRANT OPTION?

You imported a certificate into a HANA PSE but LDAP TLS still doesn't use it. What step did you miss?

Can you log on as _SYS_REPO, and can you delete it after moving off XS classic? Why does it matter?

You receive a preinstalled HANA appliance from a vendor. Why should you change the instance SSFS and system PKI SSFS master keys before production?

You must apply different row filters per user across a large, changing user base. Static or dynamic analytic privilege, and what's the maintenance cost of the wrong choice?

What are the two steps to enable cross-database access between two HANA tenants and create a remote identity?

You must reset a tenant’s lost SYSTEM password. Does either method — cockpit or SQL — let you avoid stopping the tenant?

What are HANA's default minimal_password_length and password_layout, and what does the Aa1 notation actually require?

To 'be safe,' an auditor wants every action of a daily-use admin audited. Why does SAP advise against this, and what's the recommended pattern?

To capture a missing-authorization (privilege) failure in a trace, which trace component, server, and level do you configure?

Why can a HANA tenant database, by default, only write its audit trail to an internal table — and who can change that?

Which tasks belong to the OS user <sid>adm versus a database user like SYSTEM, and what is <sid>adm actually for?

You must keep an audit trail that a rogue database administrator cannot read. Which HANA audit-trail target do you choose, and why not the internal table?

You detect a compromised HANA account and lock it. The attacker's existing session keeps running. Why, and what must you also do?

You're designing authorizations for a new HANA app today. Why should you NOT base them on application privileges?