Can we have column level security i.e desired column list using HANA models?

[former_member182302]

Hi All,

Request your help for the below Scenario:

User X logs in, should see only column1,column2 and column3

User Y logs in, should see only Column4,column5 and column2

I can do this using EXECUTE IMMEDIATE. But am looking for any other ways to do this?

Reporting tool: SAP BO Analysis Office

Regards,

Krishna Tangudu

[lbreddemann · Accepted solution]

Hi Krishna

Currently there is no feature for that available in SAP HANA and I am not aware that this is coming any time soon.

You might work around that by building calcviews without aggregation to do the actual work. Those won't be exposed to BI clients.

On top of these calc views you build the user facing calc views that would only contain the columns you want each user group to see.

While this is not super secure in any way, it still might be good enough depending on the use case.

- Lars

[Former Member · Accepted solution]

You could put SQL views over a Calc view and assign different people to different views? Think this would achieve the correct outcome, though it is fiddly.

[former_member182302 · Accepted solution]

Thanks lars for the reply. I got what you are saying, but the issue is i wouldn't want that many models to be created only for the sake of "implementing column security".

If there is no other way i think i will have to go in the way you suggested.

Regards,

Krishna Tangudu

[former_member182302 · Accepted solution]

Thanks John for your reply.

But since my Reporting tool is Analysis office, i cannot consume SQL views there. May be as lars suggesting can create calc views and consume them in AO.

Regards,

Krishna Tangudu

[justin_molenaur2 · Accepted solution]

I would agree with Lars. Current client is using AAO on HANA and we have dynamic AP's to handle row level security. To do the column security, it's really just choosing how wide to expose the data. In the case of AAO, the easiest path would be solely based on the view definition, and then assigning the views to the appropriate roles/AP's.

I'm sure you could come up with some fancier logic in a calc view to mask the columns without having separate objects. IE the columns are still available, but blank.

Regards,

Justin

[justin_molenaur2 · Accepted solution]

Lars/John, I know this is off topic, but I had a related question the other day.

"You might work around that by building calcviews without aggregation to do the actual work. Those won't be exposed to BI clients. On top of these calc views you build the user facing calc views that would only contain the columns you want each user group to see"

With regard to exposing "non-OLAP" style views like mentioned here, how can that really be achieved in a BI client? For example, a typical requirement will be just to browse master data (Material for example). Unless we put MARA into a view that has multidimensional reporting activated, it won't be visible to any clients.

With the multidimensional setting checked, it also requires a measure to be present and not hidden. You can get away with this by including a generic counter, but it's kind of clunky for end users at times.

Thoughts?

Justin

[lbreddemann · Accepted solution]

Hi Justin

Well for me it's pretty new that browsing through master data is a common requirement for BI front ends.

Faced with this I'd probably run SQL directly against the master data tables.

But there's no "expose the base table content" build into the modelling environment.

And looking into the different options for such a feature in SAP BW I think that an application specific solution will be required anyhow.

The non-olap views are there to serve as "lower level" calculation steps for the exposed views.

- Lars

[justin_molenaur2 · Accepted solution]

Maybe it's just me, but I sense the slightest hint of sarcasm here .

Thanks for the response, confirms my understanding.

Regards,

Justin

[former_member182302]

Hello All,

Do have a look on this document:

Request your comments on this.

Regards,

Krishna Tangudu