Analytic privileges for analytic view – Error on data preview

[Former Member]

Hello,

I have an issue concerning analytic privileges within HANA Studio. The data preview raises an error message when querying the raw data tab. We are using SPS05 and HANA Studio Rev 56.

I created an analytic privilege ("AP_TEST") that contains one analytic view ("AN_DAILY") as the reference model. I also added a attribute restriction and assigned a fixed value with the equal operator. The activation of this analytic privilege worked without any problems.

I then created a user account ("TEST") in order to test my analytic privilege. I compared my configuration with several tutorials and finally assigned the following permissions to my user:

Granted Roles: PUBLIC

SQL Privileges: _SYS_BI (Execute, Select), _SYS_BIC (Execute, Select), REPOSITORY_REST (Execute)

Analytic Privileges: AP_TEST

System Privileges: Catalog Read, Data Admin

Package Privileges: TEST (the name of the package where my analytic view and analytic privilege are located in)

After assigning the privileges to my test user I added a new system with the respective user. Afterwards I tried to open the data preview for my analytic view in order to validate the restricted data output. When I now click on "Raw Data" I am getting the following error message:

Until now I do not really understand the root cause of this problem. I assume that the necessary privileges are given to my test user. I also assume that I do not explicitely need to assign privileges for the respective database schema (but I also tried this as well, same result).

I also tried a couple of more configurations / cobinations but at the end I am always getting the same message. The output of my indexserver trace file says the following:

[188296]{222130}[-3650053] 2013-07-14 23:20:38.298984 e CalcEngine   ceAuthorizationCheck.cpp(00331) : AuthorizationCheckHandler::isAuthorizedToSelect (AP check): (Original) User TEST is not authorized on _SYS_BIC:TEST/AN_DAILY (793303)

I already tried to assign SQL privileges on the specific analytic view ("AN_DAILY") but it didn't work either.

Does anyone know what to do to resolve this problem? I really appreciate your help.

Thanks,

Fabian

[Former Member]

I have recently had the same problem.  It is currently a bug that will be fixed once you upgrade to SP06.  Our issue was the same.  Our analytic privileges would not work if they had an attribute restriction like "territory number".  If I removed the restriction and then a data preview on the analytic view, it would work just fine but once I added the restriction back on territory number I would get the same column store error.  The work around to this is adding an additional attribute to your privilege like "document number" (that is used in the analytic view you have inside of your privilege) or something like that.  For example:

Analytic privilege for Territory 51 contains an analytic view called "ZAN_SALES".

Added attribute in the Attributes Restrictions called "Ship To District" and assigned restriction on territory "51".

Added attribute "BELNR" that is tied to the same analytic view ZAN_SALES".

Once I added "BELNR", it worked and the territory restriction is applied in the raw data.

This is a work around.  I'm told that once we upgrade to SP06, we will no longer need that "extra" attribute.  

I hope this helps!

[patrickbachmann]

Also I'm looking at list of issues that SPS06 resolves and noticed this on the fix list;

Using analytic privileges on attributes of attribute views - which are itself being used within calculation views - can result in unexpected behavior in terms of authorization issues. For instance data access restrictions are not enforced or errors like “column store error: search table error: [2950] user is not authorized" may be shown.

-Patrick

[justin_molenaur2]

Just to confirm this behavior, I am seeing the same thing. I am working in SPS05 Rev 48 and attempting to apply a retriction on an attribute view field within an analytic view.

When no restrictions are applied and the analytic view is selected as a whole, data preview works fine. However, once I restrict on a column of an attribute view within the analytic view, I get the error. Following Mike's suggestion of adding a column with no restriction that is sourced from the analytic view foundation, it worked and performed the appropriate restriction on the attribute view.

Thanks,

Justin

[justin_molenaur2]

As a side note/finding (and sorry to deviate) - what I found somewhat interesting is the following: Combining mutliple analytic privileges for objects contained within the view did not produce the expected result. For example, I was thinking you could modularize the analytic privileges like this.

Provision a user with one role with all the analytic privileges for the views they should be able to access and one role for the analytic privileges that would restrict the attribute views contained within the previous views. Essentially matrixing the views with the allowed master data, for example a user may always be restricted to AT_MATERIAL-Material Group = "A" no matter what analytic views they use, and should be able to exceute AN_COPA, AN_INVENTORY, etc as new views are created. Logically, this seperates the actual views from the master data and would make maintenance for large users easier (in my mind) as new views are rolled out.

However, in some testing - I performed the above and it looks like the restriction in the attribute view role is not being enforced. When the user goes to data preview they can still see ALL data in the analytic view AN_COPA, even if they have an analytic privilege assigned that is based on the AT_MATERIAL = 'A'.

Granted Roles: PUBLIC

SQL Privileges: _SYS_BI (Execute, Select), _SYS_BIC (Execute, Select), REPOSITORY_REST (Execute)

Analytic Privileges: AP_AN_COPA, AP_AT_MATERIAL_MATKL_A

System Privileges: None

Package Privileges: COPA, MASTER_DATA

Analytic Privilege: AP_AN_COPA

Views: AN_COPA, no restrictions

Analyitc Privelege: AP_AT_MATERIAL_MATKL_A

Views: AT_MATERIAL, restiction on MATKL = "A"

It seems that maybe the logical OR operation is being performed for authorization and the analytic privilege on the AN_COPA view with no restiction on MATKL is being picked as the winner?

Thoughts?

Thanks,

Justin

[Former Member]

Hi Justin,

I would agree that the analytic privilege on the AN_COPA view with no restriction wins and the system would see this as being the higher level of authorization.  If there is any kind of restriction, it has to be a privilege that contains the analytic view "AN_COPA" with the associated attribute restriction AT_MATERIAL, restiction on MATKL = "A".

[patrickbachmann]

Fabian,

I once experienced this exact problem with a prior release of HANA and the solution was to go into the Analytic Privilege and click 'applicable to all models'.  Of course this issue was fixed when we went to rev 55 but now I'm wondering if maybe that is broken again in 56.  Perhaps you can try just for curiosity sake?

-Patrick