Symptom
- You have created a calculation view.
- You have created a dynamic SQL-based analytic privilege to restrict row-level access to this view.
- Since the analytic privilege is dynamic you have also created a stored procedure to apply filter conditions at runtime.
- You have created a role and granted the analytic privilege to it.
- And finally you have granted the role to a user.
- However when this user does a data preview on the calculation view this fails with the following error:
500 insufficient privilege: Could not obtain all relevant analytical privileges for user <user>
accessing view <schema>.<view> due to exception: Invalid SQL AP definition
- This error is too generic so you increase the trace level to INFO for component INDEXSERVER:authorization as follows:
- ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') SET ('trace', 'authorization') = 'info' WITH RECONFIGURE;
- Preview the calculation view with the user affected until the authorization error is returned.
- ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') UNSET ('trace', 'authorization') WITH RECONFIGURE;
- Review the latest indexserver trace file.
- The enhanced authorization trace prints additional information in the indexserver trace file:
Invalid filter procedure: <schema>.<procedure>. Reason: Not supported data type Non-SQL-Type for unary operator EQUAL
...
Failed to obtain analytical privilege definition: ObjectId(xx,x,oid=xxxxxxxx)(convertToStatic: 1) due to error: Unsupported data type [$datatype$] of output parameters for procedure $schema_name$.$procedure_name$
Read more...
Environment
- SAP HANA XS Advanced
- SAP HANA 1.0 SPS12
- SAP HANA 2.0
Product
Keywords
HANA, XSA, XS Advanced, SQL-Analytic Privilege, stored procedure, calculation view, insufficient privilege, data type, table type, output parameter , KBA , HAN-DB-SEC , SAP HANA Security & User Management , HAN-DB-DI , SAP HANA DI (HDI): diserver, HDI plugins& client libs , Problem
About this page
This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).Search for additional results
Visit SAP Support Portal's SAP Notes and KBA Search.