SAP HANA Developer Guide - Get a Free Blog

Validity Restriction
This restriction specifies the validity period of the analytic privilege. An analytic privilege must have exactly one
validity restriction.
Example: GT 2010/10/01, 01:01:00.000
Note: All analytic privileges automatically become immediately valid and have unlimited validity when
activated in the SAP HANA modeler. This restriction is therefore not configurable.
Attribute Restriction
This restriction specifies the value range that the user is permitted to access. Attribute restrictions are applied to
the actual attributes of a view. Each attribute restriction is relevant for one dimension attribute, which can contain
multiple value filters. Each value filter represents a logical filter condition.
Value filters for attribute restrictions can be static or dynamic.
● A static value filter consists of an operator and either a list of values as the filter operands or a single value as
the filter operand. All data types are supported except those for LOB data types (CLOB, BLOB, and NCLOB).
For example, a value filter (EQ 2006) can be defined for an attribute YEAR in a dimension restriction to filter
accessible data using the condition YEAR=2006 for potential users.
Note: Only attributes, not aggregatable facts (for example, measures or key figures) can be used in
dimension restrictions for analytic views.
● A dynamic value filter consists of an operator and a stored procedure call that determines the operand value
at runtime.
For example, a value filter (IN (GET_MATERIAL_NUMBER_FOR_CURRENT_USER())) is defined for the
attribute MATERIAL_NUMBER. This filter indicates that a user with this analytic privilege is only allowed to
access material data with the numbers returned by the procedure
GET_MATERIAL_NUMBER_FOR_CURRENT_USER.
Note: If you create an analytic privilege in the SAP HANA modeler, it is not possible to specify a
procedure call when defining restrictions. If you want to create analytic privileges with dynamic filter
conditions, you must do so using SQL.
It is possible to combine static and dynamic value filters.
An analytic privilege can have multiple attribute restrictions, but it must have at least one attribute restriction. An
attribute restriction must have at least one value filter. Therefore, if you want to permit access to the whole
content of a restricted view, then the attribute restriction must specify all attributes.
Similarly, if you want to permit access to the whole content of the view with the corresponding attribute, then the
value filter must specify all values.
334
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations