Security & GRCbeginner

HANA Security Fundamentals: Users, Roles and Privileges

Key takeaway

Understand the HANA security model by separating identity, roles and the privileges that permit platform administration, object access and analytical data access.

Explanation

📌 KEY POINTS
✅ Users/technical identities get roles; roles group privileges — direct grants are the exception, not the pattern.
⚠️ A login can succeed while a SELECT fails — troubleshoot from the failed operation and object, not from the login.
💡 Least privilege applies hardest to technical users — a reporting app needing 5 views should not get broad schema rights.

━━━━━━━━━━━━━━━━━━━━
▶ 1. THE THREE PRIVILEGE TYPES

System privileges — administrative platform capabilities
Object privileges — SELECT/EXECUTE on database objects
Analytical privileges — restrict which data VALUES a user can see in analytical scenarios

━━━━━━━━━━━━━━━━━━━━
⚠️ 2. THE FIRST PRINCIPLE

Least privilege — a reporting app needing five views should not get broad schema or admin rights

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP (TROUBLESHOOTING)

Start from the failed operation and the specific object.
Check object privilege on that object.
Check underlying dependencies and analytical-privilege logic if SELECT still fails despite apparent access.

✅ CHECKPOINT: explain why a successful login doesn't guarantee a successful SELECT.

Real project scenario

Create a reporting role with read access only to approved calculation views, then compare it with an administrator role to see why system privileges should not be used for application access.

Common mistakes

Granting powerful system privileges to fix read problems.
Assigning many direct grants to users.
Reusing one technical super-user across applications.
Confusing authentication with authorization.
Ignoring analytical restrictions.

Best practices

Grant through roles.
Scope technical users narrowly.
Review powerful privileges regularly.
Separate administrators and applications.
Troubleshoot the exact failed object and operation.

Interview angle

Differentiate system, object and analytical privileges and connect them to role-based least privilege.

Practice this lesson

Quick check

1. In the lesson "HANA Security Fundamentals: Users, Roles and Privileges", consider this project situation: Create a reporting role with read access only to approved calculation views, then compare it with an administrator role to see why system privileges should not be used for application access. Which statement is correct?

2. What is the purpose of the technical user _SYS_REPO in an SAP HANA system?

3. What is the primary purpose of analytic privileges in SAP HANA?

Interview questions

1. Using this SAP project situation — Create a reporting role with read access only to approved calculation views, then compare it with an administrator role to see why system privileges should not be used for application access — explain HANA Security Fundamentals: Users, Roles and Privileges. What should happen, which concepts or process steps matter, and what common mistake would you avoid?

Answer it in your own words first, then compare.

2. You are the senior consultant/architect responsible for HANA Security: Users, Roles, System, Object and Analytic Privileges. The project situation is: A reporting technical user was granted broad catalog access to solve one missing view permission. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?