SAP HANA Developer Guide - Get a Free Blog

((Year = 2006) OR (Year BT 2008 and 2010)) AND (Country IN ("USA",
"Germany"))) OR (Country = "France")
Dynamic Value Filters in the Attribute Restriction of Analytic Privileges
The attribute restriction of an analytic privilege specifies the value range that the user is permitted to access using
value filters. In addition to static scalar values, stored procedures can be used to define filters. This allows userspecific
filter conditions to be determined dynamically in runtime, for example, by querying specified tables or
views. As a result, the same analytic privilege can be applied to many users, while the filter values for authorization
can be updated and changed independently in the relevant database tables. In addition, application developers
have full control not only to design and manage such filter conditions, but also to design the logic for obtaining the
relevant filter values for the individual user at runtime.
Procedures used to define filter conditions must have the following properties:
● They must be DEFINER procedures.
● They must be read-only procedures.
● A procedure with a predefined signature must be used. The following conditions apply:
○ No input parameter
○ Only 1 output parameter as table type with one single column for the IN operator
○ Only 1 output parameter of a scalar type for all unary operators, such as EQUAL
○ Only 2 output parameters of a scalar type for the binary operator BETWEEN
● Only the following data types are supported as the scalar types and the data type of the column in the table
type:
○ Date/Time types DATE, TIME, SECONDDATE, and TIMESTAMP
○ Numeric types TINYINT, SMALLINT, INTEGER, BIGINT, DECIMAL, REAL, and DOUBLE
○ Character string types VARCHAR and NVARCHAR
○ Binary type VARBINARY
When the procedure is executed as part of the authorization check in runtime, the following constraints apply:
● The user who must be authorized is the database user who executes the query accessing a secured view. This
is the session user. The database table or view used in the procedure should therefore contain a column to
store the user name of the session user. The procedure can then filter by this column using the SQL function
SESSION_USER. This table or view should only be accessible to the procedure owner.
● The user executing the procedure is the _SYS_REPO user. In the case of procedures activated in the SAP
HANA modeler, _SYS_REPO is the owner of the procedures. For procedures created in SQL, the EXECUTE
privilege on the procedure must be granted to the _SYS_REPO user.
● If the procedure fails to execute, the user’s query stops processing and a “Not authorized” error is returned .
The root cause can be investigated in the error trace file of the indexserver,
indexserver_alert_.trc.
When designing and implementing procedures as filter for dynamic analytic privileges, bear the following in mind:
● To avoid a recursive analytic privilege check, the procedures should only select from database tables or views
that are not subject to an authorization check based on analytic privileges. In particular, views activated in the
SAP HANA modeler are to be avoided completely as they are automatically registered for the analytic
privilege check.
● The execution of procedures in analytic privileges slows down query processing compared to analytic
privileges containing only static filters. Therefore, procedures used in analytic privileges must be designed
carefully.
336
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations