SAP HANA Developer Guide - Get a Free Blog

Some database objects depend on other objects. Views, for example, are defined as queries on other tables and
views. The authorization for an operation on the dependent object (the queried tables and views) requires
privileges for the dependent object and the underlying object. In case of views, the SAP HANA database
implements the standard SQL behavior. A user has the authorization for an operation on a view if the following is
true:
● The privilege for operations on the view has been granted to the user or a role assigned to the user.
● The owner of the view has the corresponding privileges on the underlying objects with the option to grant
them to others.
This behavior can be used to grant selective access to a table.
12.4.3 Package Privileges
In the SAP HANA repository, authorizations can be assigned to individual packages.
Authorizations assigned to a repository package are implicitly assigned to the design-time objects in the package
as well as to all sub-packages. Users are only allowed to maintain objects in a repository package if they have the
necessary privileges for the package in which they want to perform an operation, for example to read or write to
an object in that package.
Note: Package authorizations can be set for a specific user or for a role.
If the user-authorization check establishes that a user does not have the necessary privileges to perform the
requested operation in a specific package, the authorization check is repeated on the parent package and
recursively up the package hierarchy to the root level of the repository. If the user does not have the necessary
privileges for any of the packages in the hierarchy chain, the authorization check fails and the user is not
permitted to perform the requested operation.
In the context of repository authorizations, there is a distinction to be made between native packages and
imported packages.
● Native Package
A package that is created in the current system and expected to be edited in the current system. Changes to
package objects must be performed in the original development system where they were created and
transported into subsequent systems. The content of native packages are regularly edited by developers.
● Imported Package
A package that is created in a remote system and imported into the current system. Imported packages
should not usually be modified, except when replaced by new imports during an update. Otherwise, imported
packages should only be modified in exceptional cases, for example, to carry out emergency repairs.
To perform every-day, package-related, application-development tasks in the repository, developers typically
need the following privileges for the application packages:
● REPO.READ
Read access to the selected package and design-time objects (both native and imported)
● REPO.EDIT_NATIVE_OBJECTS
Authorization to modify design-time objects in packages originating in the system the user is working in
● REPO.ACTIVATE_NATIVE_OBJECTS
Authorization to activate/reactivate design-time objects in packages originating in the system the user is
working in
● REPO.MAINTAIN_NATIVE_PACKAGES
330
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations