SAP HANA Developer Guide - Get a Free Blog

Related Links
Note:
○ The technical name used for an attribute view attribute is /$. Hence, in the above example, the technical name for
CUST_ID is mypackage/CUSTOMER$CUST_ID. This implies that if there is any other
attribute view “STORE” which is a part of the analytic privilege and has CUST_ID as its
attribute, it will not get restricted.
○ Any analytic view that is part of the privilege’s secured list of models and has this attribute
view as its required object, gets restricted using the technical name. In the example
above, if an analytic view contains the attribute views CUSTOMER and STORE, both
CUST_ID attributes are handled independently, because their internal technical name
used for the privilege check are mypackage/CUSTOMER$CUST_ID and
myotherpackage/STORE$UST_ID.
○ If Applicable to all information models is selected, any analytic view (even if not part of the
secured models) having this attribute view as its required object, also gets restricted.
Structure of Analytic Privileges [page 332]
An analytic privilege consists of a set of restrictions against which user access to a particular attribute view,
analytic view, or calculation view is verified. Each restriction controls the authorization check on the restricted
view using a set of value filters. A value filter defines a check condition that verifies whether or not the values
of the view (or view columns) qualify for user access.
Runtime Authorization Check of Analytic Privileges [page 337]
When a user requests access to data stored in an attribute, analytic, or calculation view, an authorization
check based on analytic privileges is performed and the data returned to the user is filtered accordingly.
Access to a view and the way in which results are filtered depend on whether the view is independent or
associated with other modeling views (dependent views).
Dynamic Value Filters in the Attribute Restriction of Analytic Privileges [page 336]
The attribute restriction of an analytic privilege specifies the value range that the user is permitted to access
using value filters. In addition to static scalar values, stored procedures can be used to define filters. This
allows user-specific filter conditions to be determined dynamically in runtime, for example, by querying
specified tables or views. As a result, the same analytic privilege can be applied to many users, while the filter
values for authorization can be updated and changed independently in the relevant database tables. In
addition, application developers have full control not only to design and manage such filter conditions, but also
to design the logic for obtaining the relevant filter values for the individual user at runtime.
Creation and Management of Analytic Privileges [page 338]
Analytic privileges can be created, dropped, and changed in the SAP HANA modeler and using SQL
statements. The SAP HANA modeler should be used in all cases except if you are creating analytic privileges
that use dynamic procedure-based value filters.
Example: Creating an Analytic Privilege with Dynamic Value Filter [page 339]
This example shows you how to create an analytic privilege that contains a dynamic procedure-based value
filter and a fixed value filter in the attribute restriction.
344
P U B L I C
© 2012 SAP AG. All rights reserved.
SAP HANA Developer Guide
Setting Up Roles and Authorizations