Analytic Privilege by script?

Hello,
I have a question - Is there any method of creating a Analytic Privilege with script and not a graphical creating?
I'm asking because the changes made inside the analytic privileges are very complex to change over and over again without script.
Thank you,
Or.

Yes see page 6 of this guide. You can apply APs to individual views or to all views.
http://help.sap.com/openSAP/HANA1/openSAP_HANA1_Week_02_Unit_09_Analytic_Privileges_Presentation.pdf

Similar Messages

Problems generating Hana analytic privileges based on BW info provider

Hi Experts
We generate Hana views based on BW Info Providers. We follow the guide “SAP First Guidance – SAP NetWeaver BW 7.40 on HANA View Generation”. . The views appear perfectly in Hana Studio but we are not able to generate the authorizations in Hana.
On the BW side we have a authorizations relevant info object in the DSO that generate the View in Hana. The info object is linked to an authorization object that again is linked to a role. The role is the assigned to a user. We have synced all our users from BW to Hana using the standard concept (same username in BW and Hana).
When the view is generated we can see that view in Hana and we can see that a role is also create in Hana. But there are no analytical privilege created and there are no entries added in the table RS2HANA_AUTH_STR. The user also do not get the role assigned to him.
Are there any other steps that need to be done to be able to generate the authorizations in Hana based on BW authorizations?
We use BW 7.4 and the generate function (not the import function into Hana).
Kind regards
Erik

Hi Erik,
Please check if below characteristics are included in the analysis authorization assigned to the user:
0TCAIPROV = Info provider id
0TCAACTVT = 03
0TCAVALID = *
0TCAKYFNM = *
<authorization relevant characteristic of your info provider> = Required value.
If you are assigning these authorizations now, run RS2HANA_CHECK tcode for this user. This should generate analytic privilege and user should get the role in HANA.
Thanks

Analytic Privilege : Something went wrong

Hi folks,
I am trying Analytic Privilege on SP08 system(doesn't matter what the system level is, but still ).
I created two tables in the schema "SREEHARIV" associated to the user "SREEHARIV".
Tables are Products and Desc.
Then I created one attribute view which joins the Products and descriptions (just like MARA and MAKT ).
Output result set
Now my intention is to make the user SREEHARIV to see only the data from country INDIA.
So I am creating an Analytic privilege with Country as attribute(is it the right way ?) .
After activating it, I added the same analytic privilege to SREEHARIV user.
Then, to test the same , I created a XSJS service which will query the attribute view.
var query = 'SELECT "PNAME","TEXT","COUNTRY","TURNOVER" FROM "_SYS_BIC"."Sreehari/ATR_PRODUCTS"';
var output = [];
try{
var dbconn = $.db.getConnection();
var pstmt = dbconn.prepareStatement(query);
var rs = pstmt.executeQuery();
while(rs.next()){
output.push({
PNAME : rs.getString(1),
TEXT : rs.getString(2),
COUNTRY : rs.getString(3)
$.response.setBody(JSON.stringify(output));
catch(err){
$.response.setBody(err.message);
And I am getting the whole records returned .
I believe it is a logical mistake I am doing . Please correct me if this is not the exact use of analytical privileges . Please don't pump me the Development guide URL
Thanks in Advance ,
Sreehari

Hi Krishna,
Even I suspected the same. I assigned the analytic privilege to another user which is not having _SYS_BI_CP_ALL. Still the same . Should I suspect SP08 anyway ?
Sreehari

Rev. 80: Error with counter and analytic privilege

Hey guys,
I have the following structure in my model:
Attribute View (AT) --> Calculation View 1 (CV1) --> Calculation View 2 (CV2)
The calculation views only contain the default aggregation. Additionally CV1 has a counter on one of the columns.
The content is about analyzing roles from ERP.
AT has columns RIAExtractID (its a GUID), AGR_NAME (Name of the composite role), CHILD_AGR (Name of the single role).
CV1 has the same columns but also a counter on CHILD_AGR called "NumberofAssignedSingleRoles".
CV2 has all columns of CV1 but not CHILD_AGR.
Here is how it looked like in Rev72: (filtered for one AGR_NAME = AC280-RECHERCHE-REPORTS)
AT:
CV1:
CV2:
(I would not need CV2 to get this result (I could just select these 3 columns from CV1). However, in CV2 the Column NumberofAssignedSingleRoles is of type "attribute" whereas in CV1 it's a "measure", and with this "hardcoded" aggregation in CV2 I can then apply a filter on NumberofAssignedSingleRoles in an OData request giving me for example all roles which have less than 5 single roles assigned. Otherwise you can't filter on a measure.)
However, now with Rev. 80 the result of CV2 looks like this:
Although, AT and CV1 still look the same (and return 4 rows with each a different CHILD_AGR). No matter how many child roles have been in CV1, CV2 gives me NumberofAssignedSingleRoles = 1 for every AGR_NAME!
Trying to track the issue down, I found that using SYSTEM user gives me correct output of NumberofAssignedSingleRoles = 4.
Since one major difference between my user for testing and SYSTEM are analytic privileges.
Currently there is a restriction in the analytic privilege for AT: RIAExtractID = 001CC4F....
When I remove this restriction, the output is correct, too. (i.e. 4 rows in AT, 4 rows in CV1, Counter= 4 in CV2)
When I add the restriction again, the output is wrong. (i.e. 4 rows in AT, 4 rows in CV1, Counter = 1 in CV2)
I'm pretty sure this is a bug in SP8/Rev 80.
What other options do I have to "debug" any further?
By the way it makes no difference if I move the restriction from AT to CV1 or CV2, behavior is still the same (=wrong).
Hope you can help me since this is a major problem for my application!
Kind Regards,
Fabian

I cannot believe it. Rev. 91 and still the same Problem.
@SAP: Do you just don't care or are you not able to reproduce? I could provide small Delivery Unit with Schema, Table, AT and CVs as well as an analytic privilege.

Dynamic Analytic Privilege Concept

HI Frzz,
Could you any one give some idea about what is Dynamic Analytic Privleges and how it works.
Best Regards,
Krishna.

Hi Krishna,
Please refer the below link
http://scn.sap.com/community/hana-in-memory/blog/2014/02/07/dynamic-analytic-privileges-using-procedures-in-sap-hana
Regards
Raj

How to create analytic privileges from sql command line in hana studio?

I want to create a bunch of analytic privileges, activate them and assign it a roles. I was wondering if there is a method where I can create these analytical privileges directly from sql?

Hi Krishna,
Thanks for the reply.
The use case is to create a bulk analytical privileges on the pre-existing analytical or calculation views and I'm failing to create it using the simple CREATE STRUCTURED PRIVILEGE.
The security guide shows below mentioned as the syntax but I'm failing to create it through that:
CREATE STRUCTURED PRIVILEGE AP_SALES_1 FOR SELECT ON TABLEOWNER.VIEW_SALES WHERE REGION IN ('DE','UK') OR PRODUCT = 'CAR';
It gives me this error -
SAP DBTech JDBC: [257] (at 44): sql syntax error: incorrect syntax near "FOR": line 1 col 44 (at pos 44)

Difference between analytic privilege and package privilege

Hello Team
Please suggest me on the difference between Analytic privilege and package privilege . Since both the privileges works on package only . So what is the exact difference between them .
Regards

Hi,
SAP HANA have several categories of privileges such as system privileges, object privileges, analytic privileges, package privileges and application privileges.
For analytic privileges and package privileges, they are very different.
When you use analytic privileges, you can grant different users to see different data. For example you have an analytic view including some sales data and there is a column LOCATION. You can use analytic privilege to grant the sales in the east US to only see the sales data where LOCATION = "EAST" and grant the sales in the west US to only see the sales data where LOCATION = "WEST". This is just a simple example. In short, you use analytic privileges to grant different users to see different data.
Regarding package privilege, when you develop on XS projects, you can grant different package privileges to different users. For example, you have a package named "services" in your XS project. You can use package privilege to grant user A to only read the content under "services" and grant user B to edit/activate or even delete the "services" packages.
Best regards,
Wenjun

Privileges on script from another partition

Hello all,
I currently encounter an error when I try to execute a process chain using indirectly the script RSI.RSI_RUN_BW_CHAIN though a customized script.
Here is the idea: I use a script "P.S", that belongs to a distinct partition P, in which there is a dynamic call to the RSI.RSI_RUN_BW script with the jcs.submit procedure.
The error I get is:
ORA-20800: JCS-02001: object RSI.RSI_RUN_BW_CHAIN does not exist
ORA-06512: at "SYSJCS.SECURITY", line 3128
ORA-06512: at "SYSJCS.VAL", line 5817
ORA-06512: at "SYSJCS.VAL", line 6058
ORA-06512: at "SYSJCS.JCS", line 2890
ORA-06512: at "P.S", line 51
ORA-06512: at "P.S", line 110
ORA-06512: at line 1
ORA-06512: at "SYS.DBMS_SYS_SQL", line 1200
ORA-06512: at "SYS.DBMS_SQL", line 323
ORA-06512: at "SYSJCS.DDL", line 1085
ORA-06512: at "SYSJCS.DDL", line 1118
JCS-00215: in statement RSOJ_EXECUTE_JOB
But works fine with any script in the partition SYSJCS for instance.
I have checked the privileges in my P partition and compared from an environment where the script P.S works; and notice nothing unusual.
Any clue about this error ?
Thanks for your help.
Regards,
Yi Jiang

Hi Anton,
The thing is that I haven't grant any privilege to the script RSI.RSI_RUN_BW_CHAIN in an environment in which the dynamic caller script (with jcs.submit) works fine. I have check the privileges of the script with the F3 key, and my partition doesn't belong the allowed users for execution or anything else.
Maybe there is somewhere else to check or an other way to give this privilege to RSI scripts ?
To unblock my issue, on the unworking environment, I have grant to the P user the following privileges 'VIEW_ANY_SCRIPT" and 'SUBMIT_ANY_SCRIPT". It works.
(But this solution was not implemented in the working environment).
Tell me if you need more information.
Thanks a lot.
Regards,
Yi Jiang

Looking for privilege reporting script

Some time back (quite some time back, actually!) I had a script that would report all the privileges granted to or inherited by a user or role. It recursed through all of the nested roles to develop the list. I seem to have lost that but hoped someone would know of it or something like it. It seems like it originally came from Pete Finnigan, but I can't find it on his site.

jgarry wrote:
[This one?|http://www.petefinnigan.com/find_all_privs.sql]
That would be the one!
Thanks.

What is the system privilege required to grant "Analytic Privilege" to a user

Hi SCN,
I have the user with following privileges:
SYSTEM Privileges: CATALOG READ,CREATE STRUCTURED PRIVILEGE,DATA ADMIN,STRUCTUREDPRIVILEGE ADMIN,USER ADMIN
PACKAGE Privileges: SECURITY
OBJECT Privileges: _SYS_BI,_SYS_BIC and REPOSITORY_TEST
Am able to create a AP, but not able to assign to a user. Checked different threads and documents, Am able to add with "SYSTEM" user but not with the generic user i have
I can't do tracing as it is disabled in the client system
Am i missing something here? Can someone help me please?
Regards,
Krishna Tangudu

Thank you so much Raj.
I was expecting this kind of privilege under SYSTEM PRIVILEGE.
So other privileges which i mentioned are fine right?
Regards,
Krishna Tangudu

Analytical Workspace Manager Script

I am using AWM to build and maintain my OLAP cube. Up until now, I've been maintaining the cube by hand (via the maintenance wizard). I'd like to set automatically maintain my cube every night. I used the maintenance wizard to automatically create a script for maintaining my cube, but when I tested the script, it ran but didn't update the cube! I went back and maintained by hand and that worked. Any ideas about what could going on?

In addition to what has been mentioned by Keith and LM, some few more points:
1. select * from OLAPSYS.XML_LOAD_LOG order by xml_date desc; will show you all the messages.
2. Sometimes there are errors that are not captured by XML_LOAD_LOG table. In that case, do look at database alert log also.
3. You can take the SQL script generated by AWM, replace the first word "declare" with "CREATE or REPLACE PROCEDURE xxxxx AS" and you will have a sql procedure which can execute the load.
4. Another option is to create a LONG variable (lets say l_script) in your sql procedure. Populate the l_script variable with the sql script (generated by AWM) and then do EXECUTE IMMEDIATE (l_script);
5. If it is a parallel load, then 10gscheduler jobs will be spawned, which will be outside of the database session from which you executed the load. You then need to go into some kind of loop and check for the spawned jobs. DBA_SCHEDULER_JOBS and SCHEDULER$_EVENT_LOG tables can provide you the information. There are other scheduler tables/views also.

SAP HANA Privileges for Frontend Tools

Hello,
I am pretty new to HANA and having problems to access my created views from Frontend Tools like Design Studio or Lumira.
I have created several tables and on top created an Analytic View. Tables and views are in the same schema, but I assigned the view to a package. If I want to access the view via Design Studio there are no views or packages shown.
My User has the following privileges and roles:
Roles:
CONTENT_ADMIN
USER
MODELING
MONITORING
PUBLIC
Object Privileges:
_SYS_REPO
REPOSITORY_REST (SYS)
Analytical Privileges:
_SYS_BI_CP_ALL
Package Privileges:
package to which the View was assigned
If I want to Data Preview myView I get an error: inssuficient privileges.
Has anybody an Idea? Is there an tutorial for granting privileges for reporting purpose? The Admin Guide is very general and I thought by using the standrad roles are sufficient for my sceanrio.
Help would be appreciated.
Thanks
Waldemar

So as the trace is saying did you give "Grant" option? And hence you are able to preview the data in HANA. It means:
1) You are able to see the package from "myUser"
2) You were able to do data preview from HANA on the analytic view
Right?
If it is "myUser" who created the tables, then i don't think you need to grant again.
I was mentioning you to grant SYS_BI (SELECT) ,_SYS (SELECT) to "myUser"
And after all this your issue currently is "myUser" cant see the views in Design studio? Could you confirm that you are logging into Design studio using "myUser"?
Regards,
Krishna Tangudu

Unity Express 8.6 custom script not working properly

Hello!
I'm having an issue with a custom auto-attendant script for Unity Express 8.6.6.
A brief overview of the expected call flow:
Call comes to 2600, which is set to forward to 2699 if busy or no answer.
Call to 2699 is sent to CUE, which is set to answer with the auto-attendant script.
Script does a time-and-day check to determine if the site is within business hours.
If within business hours, a prompt stating line is currently busy, please leave a message is played, and call is forwarded to 2601.
If outside business hours, a prompt stating office is closed is played, and call is forwarded to 2601.
Calls to 2601 are all forwarded to voicemail.
My first version had a Business Hours object, with a schedule parameter set so that the schedule could be chosen in the CUE GUI. This script did not appear to work properly, as the AfterHours option was always selected by the script. My current version removed this object and replaced it with manual Time-and-Day objects, but the same behavior as above occurs – the AfterHours option is always selected.
Both scripts validated in the editor, and the CUE has been rebooted since the script was first uploaded. TAC validated that nothing in the "show run" is causing CUE to ignore the time-and-day checks. I've attached a ZIP file that contains the scripts, "show software version" and "show license status application" output.
Am I missing anything?

I read through the document, and it says that the atrace.log file that is generated is not cleartext. Is there any application I can use to read the traces I generate?
EDIT: Apologies, it appears this documentation needs to be rewritten. I was looking at the process to enable traces on an AIM module, when our Unity Express module is on an Internal Services Module 300. I issued "show trace buffer trail" and placed a test call, and this is what I see:
3700 05/25 14:26:12.254 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=188,Step Class=com.cisco.wfframework.steps.core.StepComment,Step Description= /* Open/Closed check */
3700 05/25 14:26:12.255 ACCN ENGN 0 Execute step of Task 19000000034 : /* Open/Closed check */
3700 05/25 14:26:12.255 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=261,Step Class=com.cisco.wf.steps.ivr.DayOfWeekStep,Step Description=Day of Week
3700 05/25 14:26:12.255 ACCN ENGN 0 Execute step of Task 19000000034 : Day of Week
3700 05/25 14:26:12.255 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=275,Step Class=com.cisco.wfframework.steps.core.StepGoto,Step Description=Goto AfterHours
3700 05/25 14:26:12.255 ACCN ENGN 0 Execute step of Task 19000000034 : Goto AfterHours
3700 05/25 14:26:12.256 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=37,Step Class=com.cisco.wfframework.steps.core.StepLabel,Step Description=AfterHours:
3700 05/25 14:26:12.256 ACCN ENGN 0 Execute step of Task 19000000034 : AfterHours:
3700 05/25 14:26:12.256 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=228,Step Class=com.cisco.wfframework.steps.core.StepComment,Step Description= /* Play VTG_Closed prompt ... */
3700 05/25 14:26:12.256 ACCN ENGN 0 Execute step of Task 19000000034 : /* Play VTG_Closed prompt ... */
3700 05/25 14:26:12.256 ACCN APMG 0 EXECUTING_STEP:Executing a step: Application=App[name=autoattendant,type=Cisco Script Application,id=1,desc=autoattendant,enabled=true,max=2,valid=true,cfg=[ApplicationConfig[,name=autoattendant,id=1,type=Cisco Script Application.description=autoattendant,enabled=true,sessions=2,script=SCRIPT[aa_vtgnwd.aef],access=0,privilege=1,script=SCRIPT[aa_vtgnwd.aef]]]],Task id=19000000034,Step id=214,Step Class=com.cisco.wf.steps.ivr.OutputStep,Step Description=Play Prompt (--Triggering Contact--, pAfterHours)
3700 05/25 14:26:12.256 ACCN ENGN 0 Execute step of Task 19000000034 : Play Prompt (--Triggering Contact--, pAfterHours)
It appears as though the script engine is seeing the Day of Week object, acknowledging it without somehow doing anything with it, and then choosing a "goto AfterHours" step within that object and playing that prompt, which is consistent with the behavior we're seeing.
Any thoughts?

What happened to the SQL Privileges tab ???

Hi,
I wanted to create an analytical privilege and was following the steps given online (HANA Academy - Create Analytic Privileges - YouTube) for SP5 HANA studio during which you have to do some stuff under the SQL privileges tab of the user management screen.
I currently work on a SP6 HANA Studio which doesn't seem to have that tab.. It gives me a view as below.. Can anyone please tell me how this changes things..? I've created the analytical privilege in my Package. Now I am not able to add the relevant authorizations that were meant to go in the SQL Privileges tab..
Please let me know.
Thanks,
Shyam

Yes the name is changed from 'SQL privileges' to 'Object Privileges'.
I guess since system privileges are also kind of SQL privileges and there is a confusion on what 'SQL' in the 'SQL privilege' means.. Hence they changed the name to 'Object Privilege' ???? (Guess work )
Regards,
Krishna Tangudu

Issues with privileges in HCP development

Hi Everyone,
Issue with insufficient privilege while using data preview on Attribute & Analytical view.
Executed following command after going through some reviews:
GRANT SELECT, INSERT, UPDATE ON SCHEMA "DEV_XXXXXXXX" TO _SYS_REPO WITH GRANT OPTION;
But the above statement couldn't fetch anything. Please guide with the system privilege issues

Hi Vivek,
Couldn't find the _SYS_BIC schema. Tried many options mentioned in SCN. But couldn't fetch anything out the solution in SCN.
Recently I came across following steps:
1. Make sure _SYS_REPO has privilege SELECT WITH
GRANT OPTION for the schemas used. In order to grant _SYS_REPO this privilege
you can execute the following statement:
GRANT SELECT ON SCHEMA <YOUR_SCHEMA> TO _SYS_REPO WITH GRANT OPTION;
2. Make sure the user activating the Object has at
least SELECT privilege over the schemas used within the scenario. SQL
statement to grant this privilege would be:
GRANT SELECT ON SCHEMA <YOUR_SCHEMA> TO <USER_THAT_WILL_ACTIVATE_ANALYTIC_OBJECT>;
3. Make sure all the dependencies of the Analytic
Object to be activated is contained in the Analytic Privilege assigned to the
user that will actually activate the Main Analytic Object.
First option is known to everyone.
I am stuck with the second option. Can I know the user that Activate analytical object.

Analytic Privilege by script?

Similar Messages

Maybe you are looking for