Setup of CMO Dashboard SBEE for Marketing Leaders

[Former Member]

Hi Community,

I need some assistance in order to setup the CMO Dashboard in Hybris Marketing properly.

We did following steps:

- Installed SBEE on HANA

- Assigned roles and authorizations in Hybris Marketing

- Created Users (Business Users on HANA)

- Setup iFrame configuration, fnd security

- Assigned analytic privilege to the user

Current situation - I can access the dasboard, see all the tiles but I get "Insufficient privileges to show data".

Can anyone give me a hint to resolve this and get all data displayed?

Thanks in advance.

Cheers

Timo

[JanMatthes · Accepted solution]

Hi Timo,

to access the dashboard you need to have a HANA user with the right priviliges and tell HANA also which client shall be used for the user. You can do this directly in the Hana Studio settings for the respective user. See the screenshot below.

Cheers

Jan

[Former Member · Accepted solution]

Hi Jan,

basically I understood your suggestions (at least I hope 😉 )

- I have a user with a sap logon ticket on HANA, so I can see the content in general

- I added sap.hana-app.cuan.mkteff/AP_CMO_KPI analytical privilege to this specific user

- the only client I can add is a session client, this should be the right one??

Anyway, with these settings I still get "Insufficient privileges" - what privileges are necessary with the default configuration in Hybris Marketing to see data

I think the one above covers every KPI on the dashboard.

Thanks.

Timo

[Former Member · Accepted solution]

Hi Timo,

Could you please check if the role sap.ead.fnd.security::Consumer is assigned to your HANA user?

Best regards,

Michael

[Former Member · Accepted solution]

Hi Michael,

thanks for your answer, yes this role is assigned to my personal login user.

Timo

[Former Member · Accepted solution]

Hi Timo,

OK, then the next steps would be to check the following things:

• Is your user able to execute the views? You can check by executing for example the follwing SQL in the HANA studio: SELECT * FROM "_SYS_BIC"."sap.hana-app.cuan.mkteff.XSAPP.v/CA_D_CMO_KPI_VALUES"('PLACEHOLDER' = ('$$ip_analysis_type$$', 'BRAND_AWARENESS'))
• Is the technical user for SBEE setup correctly? Please check in the XS Admin UI which User is assigned to the SQL connection sap.ead.fnd.internal_services.utils::technicalUser. This user needs to have the role sap.ead.fnd.security::TechnicalUser assigned.

Best regards,

Michael

[Former Member · Accepted solution]

Hi Michael,

thank you - indeed you were right - so actually this is solved, but let me raise one final question 😉

In the guide it was not said that I would have to explicitly add authorizations per calculation view, but this was the key - in the guide they were only talking about adding permissions per analytical privilege?

So is there one general permission for the cmo dashboard or do I really have to add the individual calculation views to any specific user.

So could you give me advice in the correct final steps - is it really just add each single view (I am wondering if this would be manageable in terms of daily operational business) ...

Thanks in advance.

Timo

[Former Member · Accepted solution]

Hi Timo,

I'm glad to hear that it is now working. You're right, the guide is not precise with regards to the required authorizations here. I'll take this back to the documentation team.

Coming back to your question: The authorization is based on two components: The SELECT authorization on the runtime object in the _SYS_BIC schema and the analytic privilege which mainly controls the instance authorization.

The SELECT privilege on the column view can either be granted for individual calculation views or directly on the complete _SYS_BIC schema. Granting SELECT on the complete _SYS_BIC schema allows to execute all information views that do not have any analytic privilege assigned:

In case the view has the property "apply privileges" set, the SELECT authorization on _SYS_BIC is still required but no longer sufficient:

In this case it is required to have an analytic privilege that contains authorization for the view and this analytic privilege needs to be assigned to the user. To grant access to all information views, there is one super-privilege available. It is called _SYS_BI_CP_ALL. Nevertheless which privilege are assigned, the SELECT authorizations for the runtime objects in _SYS_BIC remain as a prerequisite.

Instead of assigning individual authorizations to single users it is strongly recommended to create a role which contains the set of authorizations and to assign only this role.

The standard role sap.hana-app.cuan.mkteff.XSAPP.roles.CMOKPI_S4H includes SELECT authorizations on the _SYS_BIC schema and the corresponding analytic privileges on the CMO dashboard views. If you need a finer granular access control, a custom role needs to be created.

I hope this helps.

Best regards,

Michael

[Former Member · Accepted solution]

Thanks a lot

Cheers,

Timo