Standard HANA ODBC Connector with SSO Support

[bengel]

At our Customer we are using SAP HANA as our main database. in the moment we can only use the ODBC Client to connect against SAP HANA. In this scenario it is only possible to establish a connection with Username and Password. It would be very good if every Alteryx Designer user can connect via SSO to the HANA Database. It would be perfect to have this as standard feature and not through an add-on.

[MikeWenski]

I'm having the same issue, it severely limits the value of the tool

[aplima]

We have the same limitation here, but on the Alteryx server side. At Designer, you can SSO if HANA ODBC dsn is configured with no user/PWD, at least here it works very well. 

However, the same only works for Workflows running on Alteryx server, if users provide UserID and password as workflow credentials. It happens that we're all smart card users here, so general end users don't have password for more than 10 years now! Getting your account setup back with a password that you could provide to Alteryx is not a possibility, this forces users to request what we call as a "service account", basically an password enabled account used for running services/applications, which comes with a 25 chars long pwd requirement and a list of controls you must follow to protect it or you might have problems when auditors stops by every other year.

So we really need the same that Tableau does for Hana (see this), I think that's called SAML delegation or TLS Mutual Authentication. 

This is blocking some server side use cases as people don't want the "service account" overhead. Happy to explain this to anyone in Alteryx, can even bring a couple of our enterprise architects to explain the direction our company is going here.

[DataSandwich]

I agree, we really need the TLS mutual authentication if we are ever going to use Alteryx server at an enterprise level.  With HANA as well as other systems, this is extremely important.

@MikeWenski & @bengel though - I will point out that the HANA ODBC driver does support SSO so you can achieve this without any sort of custom driver on the Alteryx side.  Just use an ODBC connection string like below, including your user ID bug excluding your password, and it should perform a single sign on when the workflow executes.  Here's an example odbc connection string:

odbc:DRIVER={HDBODBC};SERVERNODE=yourserver:portnumber;UID=DataSandwich

[mbarnwell]

This idea is necessary for our operations for business areas who leverage SSO for query performance tracking. Thank you for your consideration to bring this tool in line with others in our stack