SAP HANA Authorization (HA2)

Transcription

1 SAP HANA 1.0 SP5 June 2013 English SAP HANA Authorization (HA2) Building Block Configuration Guide SAP AG Dietmar-Hopp-Allee Walldorf Germany

2 Copyright 2013 SAP AG or an SAP affiliate company. All rights reserved. part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. thing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see for additional trademark information and notices. SAP AG Page 2 of 11

3 Icons Icon Meaning Caution Example te Recommendation Syntax Typographic Conventions Type Style Description Example text Words or characters that appear on the screen. These include field names, screen titles, pushbuttons as well as menu names, paths, and options. Example text EXAMPLE TEXT Example text Cross-references to other documentation. Emphasized words or phrases in body text, titles of graphics and tables. Names of elements in the system. These include report names, program names, transaction codes, table names, and individual key words of a programming language, when surrounded by body text, for example, SELECT and INCLUDE. Screen output. This includes file and directory names and their paths, messages, source code, names of variables and parameters as well as names of installation, upgrade, and database tools. EXAMPLE TEXT Keys on the keyboard, for example, function keys (such as F2) or the ENTER key. Example text <Example text> Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation. Variable user entry. Pointed brackets indicate that you replace these words and characters with appropriate entries. SAP AG Page 3 of 11

4 Content SAP HANA Authorization Purpose SLT Authority Create Initial r Assign Replication Roles on HANA r r Authority Set authorization for activation Create deploy user Create Analytic Privelege Creating display role Create r Integrating with SAP BusinessObjects BI Platform SQL Script for authorization Create deploy user Create display role SAP AG Page 4 of 11

5 SAP HANA Authorization 1 Purpose The purpose of this document is to describe the configuration for customer-specific authorization requirements. The content of this guide is specific for SAP HANA 1.0. For more indormation about specific topics, see the quick links in the table below: Content Link SAP HANA Security Guide 2 SLT Authority Usually the data coming from ERP is replicated to HANA via SLT Create Initial r Before you create the SLT configuration, you need to prepare an initial user that is responsible for the database connection between SLT and HANA. You can use SYSTEM for test purpose to create the connection, but in production system, it s recommended to create a limited SLT user. 1. In the Navigator panel, expand HANA server -> Security-> rs. 2. Right Click and choose New r. 3. Input the username and password. 4. In the below panel, you can find a lot of tabs. Select the following tabs and input the relevent values. Tab Value Select Details Grantable to Others SQL SYSTEM SYSTEM SYS_REPL CREATE SCHEMA ROLE ADMIN Check EXECUTE, SELECT, INSERT, UPDATE, DELETE SAP AG Page 5 of 11

6 SYSTEM USER ADMIN 5. Choose Deploy, F8, to effect the change. Result The user has been created and can be used in SLT configuration for HANA connection Assign Replication Roles on HANA r The replication roles are defined and have authorization on the target schema on SAP HANA system. In order to assess the target schema, the replicated roles must be assigned to your HANA user. You must connect to the HANA server with the user you create your SLT schema connection. 1. Choose Start->All Programs->SAP HANA->SAP HANA Studio to open your SAP HANA studio. 2. Expand your <HANA instance> ->Catalog->Authorization->rs 3. Open the HANA r you want to assign the roles 4. In the Granted Roles tab, click on add icon and the add role dialog pops up 5. In Select Role dialog box, add below Roles <REPLICATION SCHEMA>_DATA_PROV and click on OK 6. Similar, add below roles also. <REPLICATION_SCHEMA>_POWER_USER <REPLICATION_SCHEMA>_USER_ADMIN <REPLICATION_SCHEMA>_SELECT 7. Click Deploy button on top-right in main window. <REPLICATION_SCHEMA>_DATA_PROV Assign this role to users who configure and monitor the data provisioning process. This role has the right to select data in the replication schema and to insert values into the RS_ORDER table within the replication schema. <REPLICATION_SCHEMA>_POWER_USER This role provides full control over the contents of the replication schema. Assign this role only for urgent operations, such as maintenance operations. The rights granted by this role allow the user to perform operations that can destroy the consistency of the replicated data. <REPLICATION_SCHEMA>_USER_ADMIN SAP AG Page 6 of 11

7 This role provides access to the database stored procedures RS_GRANT_ACCESS and RS_REVOKE_ACCESS. They are used for fine-grained access control on the replication schema content. <REPLICATION_SCHEMA>_SELECT This role contains select privilegue of the entire replication target schema. For more user role details, please refer to document SAP HANA Security Guide Trigger-Based Replication (SLT) on 3 r Authority 3.1 Set authorization for activation Prerequisite After the SLT replication, you should have the data schema and power user that can grant further authority for the schema. After you have developed HANA content, the activation is done not by your own user but by specific user _SYS_REPO. To avoid missing authority during activation, we need to assign user _SYS_REPO necessary authority first. 1. Open SAP HANA studio, in the Navigator panel, expand SAP HANA server Security rs. 2. Double click _SYS_REPO to enter the edit screen for the user. 3. Choose tab SQL and set the corresponding schema to the user. Tab Value Select Details Grantable to Others Object <your schema name> SELECT, CREATE ANY, DROP, EXECUTE, INSERT, UPDATE, DELETE Yes 4. Click Deploy F8 for the changes to take effect. 3.2 Create deploy user Prerequisite You use a SYSTEM user for the following action. SAP AG Page 7 of 11

8 You can use SYSTEM user or create your own user for deploy existing HANA delivery unit into your own HANA system. 1. Open SAP HANA studio, in the Navigator panel, expand SAP HANA server Security rs. 2. Right-click rs and choose New r. 3. In the displayed New r panel, enter the r Name. 4. In the following panel, select the listed tabs and enter the relevant values. Tab Value Select Details Grantable to Others Object System REPOSITORY_REST(SYS) EXECUTE Yes REPO.IMPORT 5. Choose Deploy, to effect the change. 3.3 Create Analytic Privelege Analytic privilege is needed when you want to access HANA models and data preview. Also if you do not want a user with access to all of the data, you can set the filter here for row level restriction. 1. In the Navigator panel, expand SAP HANA server Content and find your package. 2. Right-click your package and choose New Analytic Privilege 3. Enter the Analytic Privilege name and description; choose Finish. 4. In the Reference Models panel, choose Add and select the model you want to grant access. 5. For some models, if you want to set the row level restriction, find them and in the right Associated Attributes Restrictions, click Add and choose the field to set restrictions. 6. In the bottom Assign Restrictions panel, click Add and set the restriction value. 7. Choose Save and Activate to activate the analytic privileges. 8. Choose Deploy F8 for the changes to take effect. Result You have created the analytic privilege and also with row restrictions. 3.4 Creating display role Prerequisite SAP AG Page 8 of 11

9 You use a SYSTEM user for the following action. This SYSTEM user must have the GRANT authority for the relevant schema and package. After the predelivered model has been deployed in the production system, create a display user. Currently, SAP HANA still does not support the user copy function. To manage the user authority, create a display role and assign the relevant users. 1. Open SAP HANA studio, in the Navigator panel, expand SAP HANA server Security Roles. 2. Right-click Roles and choose New Role. 3. In the displayed New Role panel, enter the Role Name. 4. In the following panel, elect the listed tabs and enter the relevant values. Tab Value Select Details Grantable to Others SQL SQL SQL Analytic Package _SYS_BI SELECT _SYS_BIC SELECT REPOSITORY_REST(SYS) EXECUTE <the analytic privileges you created in previous section> <Your analytic package1> <Your analytic package2> REPO.READ To extend Modification authority for the role, in the Package tab, select the relevant authority for the role. 5. Choose Deploy, F8, to effect the change. Result You have created a role with DISPLAY ONLY authority. 3.5 Create r Create a logon user with the created role. 1. In the Navigator panel, expand SAP HANA server Security rs. 2. Right-click and choose New r. SAP AG Page 9 of 11

10 3. Enter the <username> and <password>. 4. In the Granted Roles tab, choose the Add icon and enter the role you just created. 5. Click Deploy F8 for the changes to take effect. 3.6 Integrating with SAP BusinessObjects BI Platform When content is consumed by SAP BusinessObjects Business Intelligence (BI) platform, row level security can also be controlled using the BI platform. How you handle row level security must fit into the overall access and security approach for your organization. If a user is not using a BI client having an universe as middle tier, you must map the SAP BusinessObjects user as an SAP HANA limited user. 1. Open the BI platform Central Management Console (CMC) 2. Logon on as an administrator. 3. In the dropdown list, select rs and Groups. 4. In the left panel, select r List. 5. Right-click and choose New r. 6. In the Properties tab, enter the following information: Field Value Authentication Type Account Name Password 7. Choose Create & Close. 8. Right-click the created user and choose Properties. 9. Choose tab Account Manager. Enterprise <username> <password> 10. In the displayed panel, select Change Database Credentials and select Enable Database Credentials. 11. Enter the SAP HANA database Account Name and Password; choose Save & Close. 12. In your local machine, open Information Design Tool. 13. In your Repository Resources panel, open your existing BI platform CMS Session or click to insert a new session. 14. Expand the session and right-click Connections folder and select Insert Relational Connection to create a new connection. 15. Enter the resource name and choose Next. 16. Select SAP HANA database 1.0 JDBC driver and choose Next. 17. In the next screen, enter following information: Field Value Authentication Mode SAP BusinessObjects credential mapping SAP AG Page 10 of 11

11 Server <HANA server>:<port> 18. Choose Finish to finish the connection creation. Result The connection for direct report tools such as analysis for office has been created. r can use this connection to connect to SAP HANA with restricted row access. 4 SQL Script for authorization Some tasks can be easily done via sql scripts. When you need to do mass authorization tasks, sql script can fulfill the task more efficiently. 4.1 Create deploy user 1. Open SAP HANA studio, in the Navigator panel, right click SAP HANA server and choose SQL Console. 2. Input following scripts: create user <userid> password <password>; grant REPO.IMPORT to <userid>; grant EXECUTE on REPOSITORY_REST to test1 with grant option; 3. Choose Execute, F8, to effect the change. 4.2 Create display role 1. Open SAP HANA studio, in the Navigator panel, right click SAP HANA server and choose SQL Console. 2. Input following scripts: create role <roleid>; grant SELECT on SCHEMA _SYS_BI to <roleid>; grant SELECT on SCHEMA _SYS_BIC to <roleid>; grant REPO.READ on "sap.ecc.fica" to <roleid>; CALL GRANT_ACTIVATED_ANALYTICAL_PRIVILEGE('"<package>/<analytic privilege>"', '<roleid>'); grant role <roleid> to <userid>; 3. Choose Execute, F8, to effect the change. SAP AG Page 11 of 11