Hi,
We are on HANA SPS 08 Revision 85 and we are trying to create repository roles for restricted users so that users are only entitled to select data out of certain HANA models using an ODBC connection.
To facilitate my testing, I created a new query view making use of a number of reuse views delivered in standard SAP HANA Live content. For the sake of simplicity, let's name them RV1, RV2, RV3...etc. All of the reuse views remain untouched in sap.hba.ecc package. To avoid assigning the analytic privilege _SYS_BI_CP_ALL to users, I created an analytic privilege and added my own query view to it with no attribute restriction. My respository role has all the catalog sql object for selecting from column views generated for my query view. My testing follows the procedures as below:
1. Add the analytic privilege _SYS_BI_CP_ALL to my repository role and assign the role to the restricted user (The user has ONLY this repository role assigned).
2. Data is successfully returned on Analysis for Office and the user is only able to see my query view.
3. Remove the analytic privilege _SYS_BI_CP_ALL from the role and add my analytic privilege I created with only my query view in.
4. User is still only able to see my query view but gets 'user is not authorized' message when selecting data from the view.
5. Do a trace on authorization and from the trace, I can see that my analytic privilege lacks RV1 and RV2.
6. Add RV1 and RV2 to my analytic privilege. (Keep in mind that other reuse views like RV3, RV4 are not added).
7. User is able to see my query view only and data is returned successfully.
Since my query view has multiple reuse views, how do I know in this case, only RV1 and RV2 need to be added to this analytic privilege? Do I have to rely on trial and error and tracing?:)
Thanks,
James