---
schema_version: "1"
id: f016f937540af42a241599042b19aa6a1a40eeeb45903b1fff25762f0ebf0e2f
title: Configure SAP HANA SSO
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/server-linux/config_sap_hana_sso.md
canonical_url: https://help.tableau.com/current/server-linux/en-gb/config_sap_hana_sso.htm
source_site: help.tableau.com
content_type: documentation
content_hash: de90aa525433efaa4c49cab462448b32acc886b406c97ebe8f860157cbd693ce
description: Configure Tableau Server SAML delegation to provide single sign-on for SAP HANA.
---
[Skip to main content](#main-content)

# Configure SAP HANA SSO

You can configure Tableau Server to use SAML delegation to provide a single sign-on (SSO) experience for SAP HANA. This scenario is not dependent on SAML authentication to Tableau Server. You do not need to use SAML sign on with Tableau Server in order to use HANA SAML delegation. You can sign in to Tableau Server using whatever method you choose.

With SAML delegation for SAP HANA, Tableau Server functions as an identity provider (IdP).

## Before you begin

Configuring SAML delegation with SAP HANA requires configuration on both Tableau Server and on SAP HANA. This topic provides configuration information about configuring Tableau Server. Before you configure Tableau Server, you must complete the following:

- Acquire a SAML certificate and key file for Tableau Server.
    - The certificate file must be a PEM-encoded x509 certificate with the file extension .crt or .cert. This file is used by Tableau Server and must also be installed on HANA.
    - The private key must be a DER-encoded private key file, in PKCS#8 format, that is not password protected and has the file extension .der. This file is only used by Tableau Server.
- Install the certificate in HANA. To avoid `libxmlsec` errors in HANA, we recommend configuring in-memory certificate store on SAP HANA. For more information, see this [SAP support topic](https://launchpad.support.sap.com/#/notes/0002148434).
- Install the latest version of SAP HANA driver (minimum version is 1.00.9) on Tableau Server.
- Configure network encryption from Tableau Server to SAP HANA (recommended).

For more information about generating the certificate/key pair, encrypting the SAML connection, and configuring SAP HANA, see [How to Configure SAP HANA for SAML SSO with Tableau Server](https://trailhead.salesforce.com/trailblazer-community/feed/0D5KX00000gUuG80AK "Link to the Tableau Trailhead Community") in the Tableau Trailhead Community.

## Configure Tableau Server SAML for SAP HANA

The following procedure describes how to configure SAML for SAP HANA on Tableau Server using `[tsm data-access](https://help.tableau.com/current/server-linux/en-gb/cli_data-access.htm#set-saml-delegation)`. You can also configure SAML for SAP HANA using the [sapHanaSettings Entity](https://help.tableau.com/current/server-linux/en-gb/entity_sapHanaSettings.htm).

If you are running Tableau Server in a distributed deployment, run the following procedure on the initial node.

1. Place certificate files in a folder named `saml`. For example:
    
    `/var/opt/saml`
2. Run the following commands to specify the location of the certificate and key files:
    
    `tsm data-access set-saml-delegation configure --cert-key <cert-key> --cert-file <cert-file>`
    
    Where `<cert-key>` and `<cert-file>` are file paths to the private key and certificate file, respectively.
    
    For example,
    
    `tsm data-access set-saml-delegation configure --cert-key /var/opt/saml/hana_pkey_pkcs8.der --cert-file /var/opt/saml/hana_cert.pem`
    
    You can specify other options. For example, you can specify user name format and how credentials are normalised. See [tsm data-access](https://help.tableau.com/current/server-linux/en-gb/cli_data-access.htm#set-saml-delegation).
3. Run the following commands to enable delegation:
    
    `tsm data-access set-saml-delegation enable`
    
    `tsm configuration set -k wgserver.sap_hana_sso.enabled -v true`
    
    `tsm configuration set -k wgserver.delegation.enabled -v true`
4. When you have finished, run `tsm pending-changes apply`.
    
    If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case, there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behaviour. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/current/server-linux/en-gb/cli_pending-changes.htm#pending-changes-apply).