The DBADMIN user becomes locked after several consecutive failed logon attempts. This situation regularly occurs after a password change and there are old apps or scheduled jobs attempting to run multiple times using the old password and locking the user.
First, it should be discussed what exactly is the DBADMIN user. The DBADMIN user is a super user that has all the privileges to make major changes to a database. It is suggested that the DBADMIN user only be used to do your initial administrative tasks. Having the DBADMIN user do everything renders auditing and most security tracking useless.
So, what should you do???
Rather than using the DBADMIN user to do daily tasks, create new users/groups to do specific tasks. Though this adds some extra steps before you can start using SAP HANA Cloud, it’ll save you from production down time when the DBADMIN user gets locked
In the SAP BTP Cockpit, go to your SAP HANA Database Instances
Click on the ‘Actions’ button and select ‘Open in SAP HANA Cockpit’
Enter in the login information
The SAP HANA Cockpit will look like this
From the SAP HANA Cockpit, under the ‘User & Role Management’, we can create and edit users, groups, roles, and privileges.
User Management
We’ll cover creating a user first
After choosing the user options is done press the save button at the bottom
User Group Management
In BTP cockpit we could assign users to a group allowing admins to maintain user permissions as one group rather than individually (designer group, debugging group, admin group, etc).
Below are the steps to create a new group and add our “TEST” user to the new group, “TESTGROUP”
You can access the User Group via the BTC cockpit
or in the upper left-hand area next to the back button and SAP log
Once in the User Group Management page
and you press the “New User Group” button the following popup appears
Once created we can open the group and add our TEST user
Role Management
A role is a collection of privileges that can be granted to either a user, user group, or another role.
The following screens show the ‘Role Management’ page and the steps to create a Role
In the Role Management page press the ‘+’ button
You will be prompted to create a role
Once created, press the edit button to add your desired privileges
In ‘Role Management’ role groups can be made
When pressing the add button a popup of available roles appears
Role Assignment
In role assignment you will assign your roles to your user
When ‘Assign roles to a user’ is selected you will enter in a username and assign that user with your desired roles. In the below example we will be using our “TEST” user
Press the ‘Edit’ button
Then press ‘Add’ and the following popup will appear which allows you to select your desired roles
In the following example we will select ‘MODELING’ then press ‘Select’
‘MODELING’ will now appear as an assigned role for the ‘Test’ user
Press the ‘Save’ button when done.
Assign A Role To Multiple Users
If you select ‘Assign a role to multiple users’ in the search you would enter in a role, such as ‘PUBLIC’ and that would display all the users who are assigned ‘PUBLIC’
Press ‘Edit’ and this allows you to added or remove users
Privileges Management
In ‘Privilege Management’ enter in your object of choice to add privileges to, in the below example we are displaying the privileges of the DBADMIN user.
Disable the DBADMIN user
Once you have setup your required users and groups it is best-practice that the DBADMIN user is deactivated to avoid anyone logging in as a user with super user privileges. To do this, the user is needs to have object privilege OPERATOR for the DEFAULT user group. Below are screen shots on assigning the privileges to the above user and then deactivating DBADMIN user.
Now that the permissions are assigned to the TEST user, login as the TEST user and return to the ‘User Management’ page and select the DBADMIN user
Please note the DBADMIN user cannot be deleted and if attempted, the following message would appear
