SAP HANA Developer Guide - Get a Free Blog

326
Note: Unlike when you create a role using SQL statements, it is not possible to grant ALL
PRIVILEGES when creating a role in the repository. You must model every privilege individually.
a) Model system privileges using the keyword "system privilege" as follows: system privilege:
PRIVILEGE;
Example:
role ::
{
// multiple privileges in one line are OK
system privilege: BACKUP ADMIN, USER ADMIN;
}
// you can also split lists into multiple entries
system privilege: LICENSE ADMIN;
b) Optional: Model object privileges on the design-time objects views and procedures using the keyword
"SQL object" as follows: sql object :.extension: PRIVILEGE;
Example:
role ::
{
sql object sap.example:MY_VIEW.attributeview: DROP;
// object privileges can be split across lines
sql object sap.example:MY_VIEW.attributeview: DROP;
// a single privilege can be given on multiple objects in a
single line
sql object sap.example:MY_VIEW.attributeview,
sap.example:MY_OTHER_VIEW.analyticview,
sap.example:MY_THIRD_VIEW.analyticview: SELECT;
}
c) Optional: Model object privileges on catalog objects using the keyword "catalog SQL object" as follows:
catalog sql object "SCHEMA"."CATALOG_OBJECT": PRIVILEGE;
Example:
Note: You must always qualify catalog objects with the schema name. You must also reference
catalog objects within double quotes, unlike design-time objects.
role ::
{
// catalog objects must always be qualified with the schema name
catalog sql object "MY_SCHEMA"."MY_VIEW": SELECT;
}
d) Optional: Model schema privileges on schemas using the keywords "catalog schema" or "schema" as
follows depending on whether you are referring to an activated schema or a schema in the repository:
○ catalog schema "SCHEMA": PRIVILEGE;
○ schema :.schema: PRIVILEGE;
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations