SAP_INTERNAL_HANA_SUPPORT

[i033659]

Hi all,

According to the documentation the role SAP_INTERNAL_HANA_SUPPORT is thought for access by SAP HANA development support
during support scenarios.

Moreover the role can be granted at maximum to only one user at a time. I had a look into several systems and observed that this
role is already granted to user SYS.

So shall I simply take it away from user SYS? Since SYS is a technical user I would prefer to be careful to change authorizations
for this user.

How to proceed?

Thanks,

Ingo

[lbreddemann · Accepted solution]

Hi Ingo

for this specific role, the story is a little tricky.

If the role is assigned to SYS all the time, which is perfectly fine since SYS cannot be used to logon to the system or to start a session.

You will notice that SYS does not only has the role granted to itself (GRANTOR is also SYS) but that it also owns the role.

Anyway: bottom line is that you don't need to do anything about this.

The support role will be grant-able to one additional regular SQL user.

BTW: this will be enhanced with SP8 a little bit. Then the role will be able to be assigned to multiple but limited number of users at the same time (which will make life in support a lot easier).

- Lars

[xu_xiang · Accepted solution]

Hi ,

is a way to find out who is owning the role SAP_INTERNAL_HANA_SUPPORT?

Actually we need support (in a 1.00.74 system) from HANA team. While trying to create a user with this role we got "SAP DBTech JDBC: [456]: not allowed for this role: grant to more than one user at a time".

Click through the user list and look into GRANTED_ROLES we found SYS user only.

Thanks in advance

Xu

[lbreddemann · Accepted solution]

select * from granted_roles

where role_name = 'SAP_INTERNAL_HANA_SUPPORT'

will do the trick.

With which user are you trying to perform the GRANT for this role?

- Lars

[xu_xiang · Accepted solution]

Hi Lars,

thanks for the quick reply!

(I tried to assign the role to a new user)

I found it: In this particular system someone has assigned the role 'SAP_INTERNAL_HANA_SUPPORT' to another ('admin.base.roles::support') ... and so forth.

Thanks for your help!

Xu