# Integrate SAP HANA with Databox SAP HANA is an in-memory, column-oriented relational database management system designed for high-performance analytics and transaction processing. It serves as the data foundation for many SAP applications, including SAP S/4HANA, and is available both as a managed cloud service (SAP HANA Cloud) and as an on-premises deployment. Connecting SAP HANA to Databox lets you pull data directly from your database, build datasets using SQL queries, and visualize your business metrics alongside data from your other connected tools. ## Connection If you've already established a connection, you can [reuse](/add-a-data-source) it to add new data sources to your Databox account. The setup steps differ depending on whether you're using **SAP HANA Cloud** (managed, hosted by SAP) or a **self-managed SAP HANA** instance (on-premises or self-hosted in the cloud). ### Path 1: SAP HANA Cloud #### Step 1: Create a read-only database user Databox only reads data from your database — it never writes to it. Create a dedicated user with `SELECT`-only privileges. Connect to your SAP HANA Cloud instance using the **SAP HANA Database Explorer** or any compatible SQL client, then run: ```sql CREATE USER DATABOX_USER PASSWORD "YourSecurePassword1"; GRANT SELECT ON SCHEMA "YOUR_SCHEMA" TO DATABOX_USER; ``` Replace `YOUR_SCHEMA` with the schema you want to connect. To grant access to multiple schemas, repeat the `GRANT` statement for each one. SAP HANA requires passwords to contain at least one uppercase letter, one lowercase letter, and one digit. To prevent a forced password change on first login, append `NO FORCE_FIRST_PASSWORD_CHANGE` to the `CREATE USER` statement. #### Step 2: Add the Databox IP to your SAP HANA Cloud allowlist SAP HANA Cloud restricts inbound connections by IP address. Add the Databox IP to your instance's allowlist: 1. Open [SAP HANA Cloud Central](https://hana.ondemand.com/console) and select your SAP HANA Cloud instance. 2. Click **...** (Actions) > **Edit**. 3. Go to the **Connections** step. 4. Under **Allowed connections**, select **Allow specific IP addresses**. 5. Add **52.4.198.118** to the list. 6. Click **Save** and wait for the instance to finish updating. #### Step 3: Enter your SAP HANA Cloud connection details in Databox 1. In Databox, go to **Data Sources > + New connection**. 2. Search for **SAP HANA** and click **Connect**. 3. Fill in the connection form: - **Data source name** — a label for this connection in Databox. - **Host** — your SAP HANA Cloud instance endpoint (e.g., `abc123.hanacloud.ondemand.com`). Find this in SAP HANA Cloud Central under your instance details. - **Port** — `443` (SAP HANA Cloud uses HTTPS/TLS on port 443 by default). - **User** — the username created in Step 1 (e.g., `DATABOX_USER`). - **Password** — the password for that user. - **Database name** — the name of your tenant database. 4. If your instance uses custom TLS certificates, check **Use SSL/TLS with custom certificates** and paste in the required certificate content (see [SSL/TLS](#ssltls) below). 5. Click **Connect**. connect ### Path 2: Self-managed SAP HANA (on-premises or self-hosted) #### Step 1: Create a read-only database user Connect to your SAP HANA instance using the **SAP HANA Database Explorer**, **SAP HANA Studio**, or any compatible SQL client, then run: ```sql CREATE USER DATABOX_USER PASSWORD "YourSecurePassword1" NO FORCE_FIRST_PASSWORD_CHANGE; GRANT SELECT ON SCHEMA "YOUR_SCHEMA" TO DATABOX_USER; ``` Replace `YOUR_SCHEMA` with the schema you want to connect. Repeat the `GRANT` statement for each additional schema. #### Step 2: Open firewall access for the Databox IP Your SAP HANA instance must accept inbound connections from the internet on its SQL port. The SQL port is derived from the instance number: `3[XX]15`, where `XX` is the two-digit instance number (e.g., `30015` for instance `00`, `31515` for instance `15`). Configure your firewall or network security rules to allow inbound TCP traffic on that port from `52.4.198.118` (the Databox IP). #### Step 3: Enter your SAP HANA connection details in Databox 1. In Databox, go to **Data Sources > + New connection**. 2. Search for **SAP HANA** and click **Connect**. 3. Fill in the connection form: - **Data source name** — a label for this connection in Databox. - **Host** — the hostname or IP address of your SAP HANA server. - **Port** — the SQL port for your instance (e.g., `30015` for instance number `00`). - **User** — the username created in Step 1. - **Password** — the password for that user. - **Database name** — the tenant database name for MDC systems, or the system SID for single-container systems. 4. If TLS is enabled on your instance, check **Use SSL/TLS with custom certificates** and paste in the required certificate content (see [SSL/TLS](#ssltls) below). 5. Click **Connect**. ## SSL/TLS The **Use SSL/TLS with custom certificates** checkbox encrypts the connection between Databox and your SAP HANA instance using your own certificate material. **When to use it:** - **SAP HANA Cloud**: TLS is always required. Check this option if your instance is configured with a custom or private CA certificate rather than the standard SAP-issued certificate. If you're using the default SAP HANA Cloud certificate, the connection may succeed without this checkbox. - **Self-managed SAP HANA**: Check this option if your instance has TLS enabled and you want Databox to verify the server certificate or authenticate with a client certificate. When the checkbox is selected, paste the contents of your certificate files into the corresponding fields: - **CA certificate** — the root or intermediate CA certificate used to verify the server's identity. - **Client certificate** and **Client key** — required only if your SAP HANA instance enforces mutual TLS (mTLS). For SAP HANA Cloud, the root CA certificate bundle can be downloaded from the [SAP Trust Center](https://help.sap.com/docs/hana-cloud/sap-hana-cloud-getting-started-guide/connect-to-sap-hana-databases-in-sap-hana-cloud). ## Datasets The SAP HANA integration supports the creation of [datasets](/understanding-datasets), which allow you to define and shape the specific data you want to use for reporting in Databox. Datasets make it easier to focus on the most relevant information, enabling you to filter, visualize, and analyze metrics across projects, teams, and clients without writing complex queries each time. ### Steps to create a dataset 1. **Select a table**: Pick the appropriate schema within that database. 2. **Select columns**: Browse and select the specific columns (fields) from your tables or views to include in your dataset. These columns define the structure and content of your dataset. ### Optional: Write SQL For more advanced use cases, you can write a **custom SQL query** instead of selecting columns manually. This allows you to: - Join multiple tables - Apply filters and aggregations - Format or transform data before importing it into Databox Your query must return a valid tabular result to be used as a dataset. ### Additional resources - [SAP HANA Cloud documentation](https://help.sap.com/docs/hana-cloud) — Official SAP docs for SAP HANA Cloud, covering provisioning, connectivity, security, and administration. - [SAP HANA Platform documentation](https://help.sap.com/docs/SAP_HANA_PLATFORM) — Documentation for on-premises SAP HANA, including installation, administration, SQL reference, and security. ## Resources For comprehensive details on metrics, data availability, templates, specifications, usage guidelines, and other key information, refer to the resources listed below. The SQL port is derived from the instance number: `3[XX]15`, where `XX` is the two-digit instance number. For instance `00`, the port is `30015`. For instance `01`, it is `30115`. You can confirm the port by checking the **nameserver.ini** configuration file or by consulting your SAP HANA administrator. For SAP HANA Cloud, always use port `443`. Yes. For SAP HANA Multi-Database Container (MDC) systems, enter the tenant database name in the **Database** field when configuring the connection in Databox. If you leave this field blank, Databox will attempt to connect to the SYSTEMDB, which is not recommended for reporting workloads. Check the following in order: 1. **Firewall or security rules**: Confirm that inbound TCP traffic on your SQL port is allowed from `52.4.198.118`. 2. **SAP HANA Cloud allowlist**: If using SAP HANA Cloud, verify that `52.4.198.118` is listed under **Allowed connections** in SAP HANA Cloud Central. 3. **Port**: Double-check that the port matches your instance number (e.g., `30015` for instance `00`), or `443` for SAP HANA Cloud. 4. **User status**: Confirm the user is not locked and has the required `SELECT` privilege. Run `SELECT USER_NAME, USER_STATUS FROM SYS.USERS WHERE USER_NAME = 'DATABOX_USER';` to check. Databox can connect to the SYSTEMDB, but it is not recommended. The SYSTEMDB is used for administrative tasks and contains system-level data rather than business data. For reporting, connect to your tenant database instead.   Ask Genie Get instant answers or help with your data using the in-app AI assistant. Talk to an expert For customers: Get help with your setup, strategy, or making the most of Databox. Book a demo New to Databox? See how it works and get guidance on getting started. Send an email Reach out to support for help with your account, data, or technical issues.