SAP HANA Developer Guide - Get a Free Blog

Privilege Action Necessary to Grant in Repository Role
Package privilege None
Analytic privilege None
Application privilege None
SQL object on activated object (for example, attribute
view, analytic view)
SQL object privilege on runtime object (for example,
replicated table)
Granting and Revoking
None
Grant privilege to user _SYS_REPO with WITH GRANT
OPTION
It is not possible to grant and revoke activated design-time roles using the GRANT and REVOKE SQL statements.
Instead, roles are granted and revoked through the execution of the procedures GRANT_ACTIVATED_ROLE and
REVOKE_ACTIVATED_ROLE. Therefore, to be able to grant or revoke a role, a user must have the SQL object
privilege EXECUTE on these procedures.
WITH ADMIN OPTION and WITH GRANT OPTION
When you create a role on the basis of SQL statements (that is, as a runtime object), you can grant privileges with
the additional parameters WITH ADMIN OPTION or WITH GRANT OPTION. This allows a user who is granted the
role to grant the privileges contained within the role to other users and roles. However, if you are implementing
your authorization concept with privileges encapsulated within roles created in design time, then you do not want
users to grant privileges using SQL statements. Therefore, it is not possible to pass the parameters WITH ADMIN
OPTION or WITH GRANT OPTION with privileges when you model roles as repository objects.
Similarly, when you grant an activated role to a user, it is not possible to allow the user to grant the role further
(WITH ADMIN OPTION is not available).
Auditability
The auditing feature of the SAP HANA database allows you to monitor and record selected actions performed in
your database system. One action that is typically audited is changes to user authorization. If you are using roles
created in the repository to grant privileges to users, then it is important to note that the creation of runtime roles
through activation cannot be meaningfully audited.
12.3.3 Creating Roles in the Repository
You model roles in the SAP HANA repository in a domain-specific language (DSL).
● A shared project must exist with a suitable package for storing roles.
● You have the package and system privileges required for modeling and activating objects in the repository.
324
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations