SAP HANA Developer Guide - Get a Free Blog

Dependent Views
Analytic views can be defined on attribute views, and calculation views that are defined on other modeling views. If
a user requests access to such a view that is dependent on another view, the behavior of the authorization check
varies as follows:
● Analytic view associated with attribute view(s)
A user can access an analytic view with associated attribute view(s) if one of the following prerequisites is
met:
○ The user has been granted an analytic privilege on the analytic view itself.
○ The user has been granted an analytic privilege on an underlying attribute view.
Result filtering is performed by a logical OR combination of all analytic privileges found on the analytic view
and on its underlying attribute views.
An analytic privilege on an analytic view with dependent attributes therefore does not restrict data access to
the view, but rather increases it because the privilege on the analytic view is combined with privileges defined
on the associated attribute views using logical OR.
● Calculation view based on other view(s)
A user can access a calculation view based on other view(s) if both of the following prerequisites are met:
○ The user has been granted an analytic privilege on the calculation view.
○ The user has been granted an analytic privilege on all underlying views if they are attribute, analytic, or
calculation views.
Result filtering is performed for each individual view. The underlying attribute, analytic, calculation views are
authorized and filtered using the analytic privileges relevant for these views. The result of the top-level
calculation view is then filtered using the analytic privileges defined on the calculation view itself.
An analytic privilege on a calculation view based on other view(s) therefore further restricts data access to the
calculation view as the privilege is evaluated on top of the result filtered by the analytic privileges defined on
the underlying views (corresponding to a logical AND combination).
Creation and Management of Analytic Privileges
Analytic privileges can be created, dropped, and changed in the SAP HANA modeler and using SQL statements.
The SAP HANA modeler should be used in all cases except if you are creating analytic privileges that use
dynamic procedure-based value filters.
To create analytic privileges, the system privilege CREATE STRUCTURED PRIVILEGE is required. To drop analytic
privileges, the system privilege STRUCTUREDPRIVILEGE ADMIN is required.
In the SAP HANA modeler, repository objects are technically created by the technical user _SYS_REPO, which by
default has the system privileges for both creating and dropping analytic privileges. To be able to create, activate,
drop, and redeploy analytic privileges in the SAP HANA modeler therefore, a database user requires the package
privileges REPO.EDIT_NATIVE_OBJECTS and REPO.ACTIVATE_NATIVE_OBJECTS for the relevant package.
338
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations