SAP HANA Developer Guide - Get a Free Blog

8. Select the packages to which you want authorize access and, in the Privileges for screen page, check the
required privileges, for example:
a) REPO.READ
Read access to the selected package and design-time objects (both native and imported)
b) REPO.EDIT_NATIVE_OBJECTS
Authorization to modify design-time objects in packages originating in the system the user is working in
c) REPO.ACTIVATE_NATIVE_OBJECTS
Authorization to activate/reactivate design-time objects in packages originating in the system the user is
working in
d) REPO.MAINTAIN_NATIVE_PACKAGES
Authorization to update or delete native packages, or create sub-packages of packages originating in the
system in which the user is working
12.4.4 Analytic Privileges
SQL privileges impose coarse-grained restrictions at object level only. Users either have access to an object, such
as a table, view or procedure, or they do not. While this is often sufficient, there are cases when access to data in
an object depends on certain values or combinations of values. Analytic privileges are used in the SAP HANA
database to provide such fine-grained control of which data individual users can see within the same view.
Note: Sales data for all regions are contained within one analytic view. However, regional sales managers
should only see the data for their region. In this case, an analytic privilege could be modeled so that they
can all query the view, but only the data that each user is authorized to see is returned.
Analytic privileges are intended to control access to SAP HANA information models, that is:
● Attribute views
● Analytic views
● Calculation views
Therefore, all column views modeled and activated in the SAP HANA modeler automatically enforce an
authorization check based on analytic privileges. Column views created using SQL must be explicitly registered
for such a check (by passing the parameter REGISTERVIEWFORAPCHECK).
Note: Analytic privileges do not apply to database tables or views modeled on row-store tables. Access to
database tables and row views is controlled entirely by SQL object privileges.
You create and manage analytic privileges in the SAP HANA modeler.
Note: Some advanced features of analytic privileges, namely dynamic value filters, can only be
implemented using SQL. The management of such analytic privileges created in SQL also varies to those
created in the SAP HANA modeler.
Structure of Analytic Privileges
An analytic privilege consists of a set of restrictions against which user access to a particular attribute view,
analytic view, or calculation view is verified. Each restriction controls the authorization check on the restricted
view using a set of value filters. A value filter defines a check condition that verifies whether or not the values of
the view (or view columns) qualify for user access.
The specification of these restrictions is contained in an XML document that conforms to a defined XML schema
definition (XSD).
The following restriction types can be used to restrict data access:
● View
332
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations