Restrict list of HANA models

[Former Member]

Hi,

We are planning to use Lumira for Adhoc Reporting. We have enabled single sign on for HANA and Lumira if able to authenticate the users based on SSO. However when the user connect to the HANA server, hes able to see all the models though he has access to only one package under root directory. Is there a way we can display the models only from this package ?

Thanks,

Aamod

[justin_molenaur2]

Hi Aamod - what revision HDB are you on? For a short period of time (rev 60-63) there was control over which views a user can see through a front end tools. This was based on the analytic privileges granted and the can be observed through the system view "SYS"."ACCESSIBLE_VIEWS".

Before 60 and after revision 64, a user can see ALL views through a front end tool unless further SQL privileges are defined as James has indicated. See OSS message 1907697 for the details. If you check version 1, there is actually a solution given to allow the previous authorization to be in effect but warns of performance issues.

To me, this seems a little clunky since you really need to maintain the authorizations in two places; one for DISPLAY to the end user (SQL privilege) and one for EXECUTION (analytic privilege). I just tested this, and as an end user I might have analytic privileges assigned for only two views, but I can see all of them.

Even worse, when I attempt to run the data from one (when I don't have the AP), I get a "not authorized error" from within Analysis for Office, but in Lumira it literally just spins and never stops - no error message or anything.

Regards,

Justin

[Former Member]

Hello Aamod,

what the user sees on the New Dataset dialog under Available Views depends on what they have access to under _SYS_BIC in the HANA System. If the user has SELECT on _SYS_BIC they will see all models listed under Available Views.

To limit what the user sees under Available Views their SELECT privileges need to be limited to the specific views you want them to see.

For example if you want user LUMIRA to see only analytic view MYPACKAGE/AN_MYVIEW you grant them SELECT privileges to "_SYS_BIC"."MYPACKAGE/AN_MYVIEW" which can be done via HANA Studio security UI or directly with SQL statement:

GRANT SELECT ON "_SYS_BIC"."MYPACKAGE/AN_MYVIEW" TO LUMIRA;

Thank you

James Anderson
SAP Active Global Support

[justin_molenaur2]

So James, in your example, user LUMIRA would need two things to access view AN_MYVIEW

1) SELECT ACCESS specifically on the SYS_BIC representation of the view

2) An analytic privilege that contains AN_MYVIEW

Without the second part, a user may be able to SEE that the view is available but won't be able to execute, is that correct?

This seems to be a slight duplication of effort, just want to make sure I have it correct.

Regards,

Justin

[achab]

Hi,

What is the behavior for the particular user in SAP HANA Studio?

Thanks

Antoine

[Former Member]

Hi Antoine,

The user currently can see only one folder when he logs into HANA studio as he has package privilege to only that folder.

However when the user logs in Lumira, he can see all the other packages as well.

Thanks,

Aamod