Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA as a Service and in this video we
will take a look at Authorization, a security topic.
This video has been recorded in January 2019.
For earlier or later releases, please check the playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
Authorization for SAP HANA as a Service works the same as for a regular on-premise HANA.
You connect with a client, regardless whether this is ODBC, JDBC, or web, and then, if you
manage to get pass the authentication stage, HANA will do a check for your credentials,
or, for your privileges, I should say.
Typically, privileges are granted through roles, best practice, keep things organised,
but you could, if you insist, grant privileges directly as well to any user.
Not a good idea but works the same.
Note that you cannot explicitly deny privileges in HANA.
What you can do is the sum of your privileges granted.
There are two apps, in the SAP HANA cockpit, which you can use to assign privileges.
One is called Assign privileges to users.
You then need to search for a user.
And then you can assign privileges.
First column concerns System Privileges.
Select Edit
And then Add
And here we have all of our system privileges.
Almost 60 (6 0) in total.
For auditing, for backups, client side encryption, certificates, R script (for data science),
and so on.
When you have added your privilege, you can then decide whether it should be grantable
to others.
Take care when activating this.
Some privileges are like rabbits.
Suddenly everyone has got them.
On the other hand, you do not want a single point of authority either.
It is a balance.
Let’s cancel.
Object Privileges.
Works the same way.
Edit
And then Add object.
Could be any object.
Synonym, view, table, procedure, and so on .
And then when you have selected your object, you can select the actual privilege on the
object.
Alter, drop, select, insert, etc.
And whether this particular privilege then can be transferred by the person you just
granted the privilege to.
OK.
Analytical privileges are for end users, typically.
System and object privileges for administrators and developers, most often.
Analytic privileges are used to allow read access to information models, the calculation
views.
Application and package privileges do not apply to the cloud platform.
Privileges on users.
There is only one: attach debugger.
This is for debugging SQLScript.
If you need this, you will be probably be informed by SAP Support or your developer.
Rare case.
OK.
Let’s go to our navigation menu.
And select Manage Roles.
This is how this normally works.
You grant privileges to roles and then assign roles to users.
You can edit existing roles, of course.
These are all standard roles.
AFL application function library.
And to create a new one, click the plus.
Give the role a name and a description, a comment.
Select whether you want to create the role in a schema.
Doing so will allow you to export the role with your schema, when going from development
to production, for design time purposes.
Although in this case, typically, the role would be created with code, not interactively
by me, clicking around in the UI.
Side effect, of course, is that when we drop the schema, the role is also gone.
So for one-off, interactively created roles, the default setting is the most common one:
No.
Then we can also assign the role to LDAP groups for automatic mapping but for this you would
first need to setup LDAP.
Save
And then we have our role.
Should we want to change our selections, maybe add some comments, just click edit in the
header
And otherwise, you can start to assign the required privileges.
Works the same way.
We have two additional columns: Roles and Is Part of Roles.
You can assign roles to roles.
Create a hierarchy.
This would be a good idea.
Then, final step, Assign Roles to Users.
Enter the user name.
Edit, Add - you know the process by now.
And select your role.
New in SPS 03 was that you can now also select to grant the role using the HDI Container
API.
Previously this could only be done using SQL, now there is Cockpit support.
HDI - HANA Deployment Infrastructure.
This is for design time.
So we can move objects from dev to test and production as a container, with all objects
and the required privileges bundled.
If this is completely new to you, you might want to check the Security Guide for the SAP
HANA service.
SAP HANA Authorization topic, Database Roles, Catalog Roles and Design-Time Roles Compared
I will add the link to the description of this video below.
Also explains how this works with HDI.
Also new in SPS 03, is Shared Business Authorizations in SAP HANA, so you can leverage the ABAP
authorization objects from the NetWeaver Application Server, should you be running S/4HANA, for
example.
At this stage, there is just SQL support, so there is not much I can show you in cockpit
but if you are interested and new to this topic, you can read about it here.
Also new in SPS 03 is Data Masking.
This enables you to grant access to an object but hide certain columns for everyone except
those with the UNMASKED object privilege.
Basically brings the fine-grained flexibility of analytical privileges to regular object
privileges.
There is a video tutorial on the Academy from the documentation team which explains in detail
how this works.
I will add the URL as well to the description below.
OK —That’s it.
Authorization for the SAP Cloud Platform, SAP HANA Service for Cloud Foundry, overview.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching the SAP HANA Academy