SAP Knowledge Base Article - Public

2350681 - The setting in "Package Privileges" is not considered in AO

Symptom

Some packages are restricted in "Package Privileges" for logon user, and after logon HANA Studio with the user, when click "Content", only the packages restricted in Package Privileges can be seen. But, when logon HANA with AO, all packages can be seen without any restriction.

Environment

  • SAP BusinessObjects Analysis 2.2, edition for Microsoft Office
  • SAP BusinessObjects Analysis 2.3, edition for Microsoft Office

Reproducing the Issue

  1. Restrict packages in "Package Privileges" with HANA Studio.
  2. Open AO and logon HANA.
  3. Switch to "Area" tab, all packages can be seen.
  4. When click a View under the package, "Insufficient privilege" error occurs.

Cause

This is a system behaviour. The "Package Privileges" is just for design-time within the modeling in HANA Studio, not for runtime, for example, the execution in AO.

Resolution

To make sure that your users can only view data in SAP HANA data sources (analytic views and calculation views) that they have authorization for, please perform the following activities:

  1. Copy the role sap.bc.ina.service.v2.userRole::INA_USER.
  2. In the copied role, remove the Select privilege on schema _SYS_BIC.
  3. Replace the original role sap.bc.ina.service.v2.userRole::INA_USER by assigning the copied role to your users.
  4. Define the detailed privileges for the new copied role as described in SAP Note 1907697.

Keywords

Package Privileges, Object Privileges, HANA, insufficient privilege, Content, authorization, AO, Analysis for Excel, Analysis for Office , KBA , BI-RA-AO-XLA , Excel Addin , HAN-AS-INA-SVC , deprecated - please use HAN-DB-ENG-MDS instead , Problem

Product

SAP BusinessObjects Analysis 2.2, edition for Microsoft Office ; SAP BusinessObjects Analysis 2.3, edition for Microsoft Office