Security & GRCadvanced

HANA Security: Users, Roles, System, Object and Analytic Privileges

Key takeaway

Understand SAP HANA authorization as layered privileges: system privileges govern administrative capabilities, object privileges govern database objects, and analytic privileges restrict data slices in supported modeling scenarios.

Explanation

📌 KEY POINTS
✅ Identity and privilege assignment are separate — roles group privileges so direct grants stay minimal.
⚠️ Privilege inheritance through nested roles and object dependencies can be complex — troubleshoot outward from the object and operation, not from login.
💡 A SELECT failure may be a missing privilege on a DEPENDENT object, or a data-filtering analytic privilege — not the object itself.

━━━━━━━━━━━━━━━━━━━━
▶ 1. THE MODEL

Users/technical identities → roles → privileges (direct grants minimized)

━━━━━━━━━━━━━━━━━━━━
▶ 2. THE THREE PRIVILEGE TYPES

System — platform-level operations
Object — SELECT/EXECUTE on schemas, tables, views, procedures
Analytic — restricts which dimension VALUES are visible in analytic/modeling scenarios (finer-grained than object-level)

━━━━━━━━━━━━━━━━━━━━
⚠️ 3. LEAST PRIVILEGE FOR TECHNICAL USERS

A reporting connection needing only selected views should never get catalog-wide or admin privileges

━━━━━━━━━━━━━━━━━━━━
▶ 4. TROUBLESHOOTING DIRECTION

Work outward from the requested object/operation, not from login success
A SELECT failure may trace to a dependent object's privilege or an analytic-privilege filter, not the object itself
Cloud vs. on-premise HANA admin surfaces differ — use the current platform's model, avoid old blanket grants

✅ CHECKPOINT: name the three privilege types and what each one restricts.

Real project scenario

A reporting technical user was granted broad catalog access to solve one missing view permission. Security review replaced it with a narrow role covering only required views and dependencies, reducing unnecessary exposure.

Common mistakes

Granting admin/system privileges to fix object access.
Assigning privileges directly to many users.
Ignoring dependent objects.
Treating analytic privilege as authentication.
Reusing powerful technical users across applications.

Best practices

Use roles for grants.
Scope technical users tightly.
Review effective privileges.
Separate admin and application duties.
Audit powerful system privileges regularly.

Interview angle

Differentiate system, object and analytic privileges and explain role-based least privilege.

Practice this lesson

Quick check

1. Scenario — A reporting technical user was granted broad catalog access to solve one missing view permission. For the lesson "HANA Security: Users, Roles, System, Object and Analytic Privileges", which response shows the strongest architecture and production judgment?

2. In SAP HANA's authorization concept, which privilege type is used to grant access to perform SQL operations (SELECT, INSERT, UPDATE, DELETE, EXECUTE) directly on catalog objects such as tables, views, and procedures?

3. What is the primary purpose of analytic privileges in SAP HANA?

Interview questions

1. You are the senior consultant/architect responsible for HANA Security: Users, Roles, System, Object and Analytic Privileges. The project situation is: A reporting technical user was granted broad catalog access to solve one missing view permission. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

2. Using this SAP project situation — Create a reporting role with read access only to approved calculation views, then compare it with an administrator role to see why system privileges should not be used for application access — explain HANA Security Fundamentals: Users, Roles and Privileges. What should happen, which concepts or process steps matter, and what common mistake would you avoid?