SAP HANA Developer Guide - Get a Free Blog

12.3.1 Roles
A role is a collection of privileges that can be granted to either a user or another role in runtime.
A role typically contains the privileges required for a particular function or task, for example:
● Business end users reading reports using client tools such as Microsoft Excel
● Modelers creating models and reports in the modeler of the SAP HANA studio
● Database administrators operating and maintaining the database and users in the Administration editor of the
SAP HANA studio
Privileges can be granted directly to users of the SAP HANA database. However, roles are the standard
mechanism of granting privileges as they allow you to implement complex, reusable hierarchies of user access
that can be modeled on business roles. Several standard roles are delivered with the SAP HANA database (for
example, MODELING, MONITORING). You can use these as templates for creating your own roles.
Roles in the SAP HANA database can exist as runtime objects only, or as design-time objects that become
runtime objects on activation.
Role Structure
A role can contain any number of the following privileges:
● System privileges for administrative tasks (for example, AUDIT ADMIN, BACKUP ADMIN, CATALOG READ)
● Object privileges on database objects (for example, SELECT, INSERT, UPDATE)
● Package privileges on repository packages (for example, REPO.READ, REPO.EDIT_NATIVE_OBJECTS,
REPO.ACTIVATE_NATIVE_OBJECTS)
● Analytic privileges on SAP HANA information models
● Application privileges for enabling access to SAP HANA XS applications
Note: Application privileges cannot be granted to roles in the SAP HANA studio.
A role can also extend other roles.
Role Modeling
You can model roles in the following ways:
● As runtime objects on the basis of SQL statements
● As design-time objects in the repository of the SAP HANA database
It is recommended that you model roles as design-time objects for the following reasons.
Firstly, unlike roles created in runtime, roles created as design-time objects can be transported between systems.
This is important for application development as it means that developers can model roles as part of their
application's security concept and then ship these roles or role templates with the application. Being able to
transport roles is also advantageous for modelers implementing complex access control on analytic content. They
can model roles in a test system and then transport them into a productive system. This avoids unnecessary
duplication of effort.
322
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations