Analytical Privileges: Best approach to see all data of a view

[Former Member]

Hi all,

Creating an empty analytical privilege with just assigning for example the attribute view, but NO restrictions allows to see all the data.

A bit like _SYS_BI_CP_ALL.

But is this the correct approach for a HANA system where we have implemented full security for many users/roles?

Or should the analytical privilege be explicit? For example the head of finance has access to all the regions data and the regions are set explicitly.

Pro: It's more secure, you define what can be seen.

Con: This means if there is a new region created, he will not be able to see the new region and it has to be added into the privilege manually.

At a more granular level, new employees joining or new product this can be very maintenance intensive.

Opinions welcome 🙂

Denis

[justin_molenaur2]

I am not really clear on exactly what your question is here. I take it that you want to implement row level security, but are unsure how to achieve it? Not sure what the following comment means.

"But is this the correct approach for a HANA system where we have implemented full security for many users/roles?" Does this mean you already have authorization in place or wish to do so?

In general, you always want to start with some type of matrix that helps you map a group of users against what data they should see, ie - managers of region A should see all of region A, but finance clerks in region A should only see a subset of region A.

Once you have this functionally defined, the next step would be implementation. In this case I am only considering the HANA side security, no other client tools etc.

Two options right off the bat

1) Implement explicitly defined analytic privileges, that have the values allowed for a given set of users. For example, if you have three different groups of people that need three different slices of region A, then that requires 3 different analytic privileges.

2) Implement dynamic analytic privileges using stored procedures in combination with an authorization table. In this case, you have one single analytic privilege for all users, but move the mapping down into another table. This table may be a simple two column table like | USER | REGION |. A stored procedure is created and used inside of the analytic procedure, that reads the above table and returns authorized values.

In either case, you always have to maintain the authorizations, you mention "someone new joining or a new region being added", but in the second option there is no transport of analytic privileges required. You only need to insert/update/delete entries in the authorization table.

If you have a specific question please let me know. I have implemented dynamic AP's with some good success.

Regards,

Justin

[Former Member]

Thanks Justin,

my post was simply a discussion around "How best to allow a role/analytical priv to see all data?" and yes you are correct that would be row security.

I see 2 choices, one to set explicitly the regions a global manager can see and second not to restrict to any rows and see all data returned. (my first post lists pros/cons).

As I am no allowed to change the original topic of discussion, please post your insight around using stored procedures and AP in the following doc/post (where I am still trying to identify against which model the current stored procedure is executing):

http://scn.sap.com/docs/DOC-48801

Regarding: "In either case, you always have to maintain the authorizations,", this is where I noticed that an "empty" analytical privilege does not apply restrictions and will show all data. Which means I don't have to maintain authorizations when there are new regions added into the database - they will show up automatically.

I hope this makes a little more sense.

Thank you for your insight

Denis

[justin_molenaur2]

Hi Denis, first of all sorry about not reading the complete title of the post, I didn't fully understand your goal

In the cases I have seen, you just simply add the model to the analytic privilege without any restrictions, this would be the easiest and simplest way to accomplish what you are looking to do. At my current client, we have a set of data that is accessed by a group of users that have unrestricted/full access to all data, and then a group of users who are restricted to a certain set of data.

We have two separate roles with two separate AP's

Role 1 - unrestricted; AP has model only with no characteristic restrictions

Role 2 - restricted; AP has model with characteristic restriction based on stored procedure (dynamic AP)

With the first role, an "empty" AP makes the most sense to me, no need to make more maintenance work by explicitly defining regions.

I'll take a look at your other link as well.

Regards,

Justin

[henrique_pinto]

Wouldn't it be better to attribute privileges based on company rather than geography?

I mean, suppose you have company code 0001, which would be the master company (HQ) of the group.

In the hierarchy, under 0001, you could of course have underneath companies 0002, 0003, etc.

But giving 0001 to the head of finance should be enough until a new HQ company code is defined in SAP (not that common I'd say).

[Former Member]

Thank you Henrique,

I am in a more generic environment, sourcing from SQL Server, Oracle DBs, not only SAP ECC. The finance aspect was just an example.

Would you have a link to an example on using hierarchies and analytical privileges I am not sure how to set that up? (there is just object selection on dimensions, nothing specific to hierarchies when setting up the analytical privilege rev 63)

Regards,

Denis

[henrique_pinto]

I didn't mean hierarchy in the DW (a BI hierarchy), but more in the organizational structure, meaning everything would be relevant for company code '0001'.