SAP HANA Developer Guide - Get a Free Blog

Caution: Theoretically, a user with authorization to model and activate repository objects can change
a role that he has been granted. Once the role is activated, the user has the new privileges that he or
she just added. Therefore, it is important that roles in productive systems are imported from a test or
development system and changes to imported objects are not allowed. This danger is however not
specific to roles but also applies to other repository objects, for example, modeled views.
● You have granted privileges on non-activated runtime objects that you want to grant in the new role to the
technical user _SYS_REPO.
The following general conventions apply when modeling a role definition using the role DSL:
● Comments start with a double-slash (//) or double-dash (--) and run to the end of the line.
● When specifying a reference to a design-time object, you must always specify the package name as follows:
○ package::object if you are referencing a design-time role
○ package:object.extension if you are referencing any other design-time object
● When specifying multiple privileges on the same object or the same privilege on multiple objects, you can do
so individually line by line, or you can group them on a single line. Separate multiple objects and/or multiple
privileges using a comma.
1. From the main menu in the SAP HANA studio, choose File New Other SAP HANA Repository Role
.
The New Role dialog box appears.
2. In the Container field, enter the path to the package where you want to create the role.
3. In the Role name field, enter the name of the new role.
4. Choose Finish.
The new role appears in the Project Explorer view and opens in the role editor as follows:
// an empty role
role :: {
}
The role is now ready to be defined.
5. Optional: Specify the role(s) that you want to embed within the new role.
You can specify both roles created in runtime and repository roles as follows:
○ extends role ::
○ extends catalog role "role_name"
Example:
role ::
extends role sap.example::role1
extends catalog role "CATROLE2"
{
}
6. Model the required privileges.
SAP HANA Developer Guide
Setting Up Roles and Authorizations
P U B L I C
© 2012 SAP AG. All rights reserved. 325