SAP HANA Developer Guide - Get a Free Blog

Secondly, roles created as design-time objects are not directly associated with a database user. They are created
by the technical user _SYS_REPO and granted through the execution of stored procedures. Any user with access
to these procedures can grant and revoke a role. Roles created in runtime are granted directly by the database
user and can only be revoked by the same user. Additionally, if the database user is deleted, all roles that he or she
granted are revoked. As database users correspond to real people, this could impact the implementation of your
authorization concept, for example, if an employee leaves the organization or is on vacation.
Caution: The design-time version of a role in the repository and its activated runtime version should
always contain the same privileges. In particular, additional privileges should not be granted to the
activated runtime version of a role created in the repository. Although there is no mechanism of
preventing a user from doing this, the next time the role is activated in the repository, any changes made
to the role in runtime will be reverted. It is therefore important that the activated runtime version of a role
is not changed in runtime.
12.3.2 Roles as Repository Objects
The repository of the SAP HANA database consists of packages that contain design-time versions of various
objects. Being a repository object has several implications for a role.
Grantable Privileges
According to the authorization concept of the SAP HANA database, a user can only grant a privilege to a user
directly or indirectly in a role if the following prerequisites are met:
● The user has the privilege him- or herself
● The user is authorized to grant the privilege to others (WITH ADMIN OPTION or WITH GRANT OPTION)
A user is also authorized to grant SQL object privileges on objects that he or she owns.
The technical user _SYS_REPO is the owner of all objects in the repository, as well as the runtime objects that are
created on activation. This means that when you create a role as a repository object, you can grant the following
privileges:
● Privileges that have been granted to the technical user _SYS_REPO and that _SYS_REPO can grant further.
This is automatically the case for system privileges, package privileges, analytic privileges, and application
privileges. Therefore, all system privileges, package privileges, analytic privileges, and application privileges
can always be granted in modeled roles.
● Privileges on objects that _SYS_REPO owns.
_SYS_REPO owns all activated objects. Object privileges on non-activated runtime objects must be explicitly
granted to _SYS_REPO. It is recommended that you use a technical user to do this to ensure that privileges
are not dropped when the granting user is dropped (for example, because she leaves the company.
The following table summarizes the situation described above:
Privilege Action Necessary to Grant in Repository Role
System privilege None
SAP HANA Developer Guide
Setting Up Roles and Authorizations
P U B L I C
© 2012 SAP AG. All rights reserved. 323