SAP HANA Developer Guide - Get a Free Blog

Runtime Authorization Check of Analytic Privileges
When a user requests access to data stored in an attribute, analytic, or calculation view, an authorization check
based on analytic privileges is performed and the data returned to the user is filtered accordingly. Access to a
view and the way in which results are filtered depend on whether the view is independent or associated with other
modeling views (dependent views).
Independent Views
The authorization check for a view that is not defined on another modeling view is as follows:
1. The user requests access to an individual view, for example with a SELECT query.
This is possible if the both of the following prerequisites are met:
○ The user has been granted the SQL privilege SELECT on the view or the schema in which it is located.
○ The user has been granted an analytic privilege that is applicable to the view. An analytic privilege is
applicable to a view if it contains the view in the view restriction and at least one filter on one attribute of
the view.
Note: The user does not require the SELECT privilege on the underlying base tables or views of the
modeling view.
2. The authorization check determines the analytic privileges that are relevant for the current user and view.
Relevant analytic privileges are those that met all of the following criteria:
○ Analytic privileges previously granted to the user, either directly or indirectly through a role
○ Analytic privileges with a view restriction that includes the accessed view
○ Analytic privileges with a currently valid validity restriction
Note: This check is always positive for analytic privileges created and activated in the SAP HANA
modeler.
○ Analytic privileges with an activity restriction covering the activity requested by the query are considered
Note: This check is always positive for analytic privileges created and activated in the SAP HANA
modeler.
○ Analytic privileges with dimension restrictions covering some of the view’s attributes
3. If no relevant analytic privileges are found, the user’s queries are rejected with a “Not authorized” error.
This means that even though the user has the SELECT privilege on the view, access is not possible.
If the user does have a relevant analytic privilege but does not have the SELECT privilege on the view, access
is also not possible. If relevant analytic privileges are found, the authorization check evaluates the value filters
specified in the dimension restrictions and presents the appropriate data to the user.
Note: Multiple dimension restrictions and/or multiple value filters are combined as described in the
section on the structure of analytic privileges.
SAP HANA Developer Guide
Setting Up Roles and Authorizations
P U B L I C
© 2012 SAP AG. All rights reserved. 337