Authorization Issue while Data Preview from HANA View

Question

Hi Experts,
We are using BW on HANA. We have created DSOs (info provider) in BW and generated HANA views from there. We have also created analysis authorizations in BW for authorization relevant characteristics. In HANA, we are able to go to the generated analytic view and preview the data from it successfully.
Now I have created a test user and assigned a custom role with below authorizations to this user in HANA:
- bw2hana/../REPORTING role (this role is automatically created by activation of DSO in BW).
- Roles MODELING, MONITORING, CONTENT_ADMIN, USER.
- Multiple system privileges although not needed, like REPO.EXPORT, REPO.IMPORT, etc.
- Analytic Privilege  _SYS_BI_CP_ALL
- Package Privilege: REPO.READ for all required packages (tried with ROOT package also).
In BW system also, the test user has analysis authorizations providing access to the relevant info objects.
But when I am trying to preview data for HANA view, I am getting attached error (also listed below):
"Cannot get the data provider outline
SAP DBTech JDBC: [2048]: Column store error: Search table error: [2950] user is not authorized"
I tried to trace the situation is HANA and got below details in 2 trace files:
indexserver_alert_saphana.trc:
[6433]{416977}[66/-1] 2014-10-14 00:59:27.541187 e CalcEngine       ceAuthorizationCheck.cpp(02365) : AuthorizationCheckHandler::addAPsToSearchObject: Error during converting SqlAPs to Query entries
indexserver_saphana.31003.075.trc
[6433]{416977}[66/-1] 2014-10-14 00:59:27.541197 i TraceContext     TraceContext.cpp(00702) : UserName=TEST_SSO, ApplicationUserName=<<computer name >>, ApplicationName=HDBStudio, ApplicationSource=csns.modeler.datapreview.providers.ResultSetDelegationDataProvider.<init>(ResultSetDelegationDataProvider.java:118);csns.modeler.actions.DataPreviewDelegationAction.getDataProvider(DataPreviewDelegationAction.java:278);csns.modeler.actions.DataPreviewDelegationAction.run(DataPreviewDelegationAction.java:242);csns.modeler.actions.DataPreviewDelegationAction.run(DataPreviewDelegationAction.java:127);csns.modeler.command.handlers.DataPreviewHandler.execute(DataPreviewHandler.java:53);org.eclipse.core.commands
[6433]{416977}[66/-1] 2014-10-14 00:59:27.541187 e CalcEngine       ceAuthorizationCheck.cpp(02365) : AuthorizationCheckHandler::addAPsToSearchObject: Error during converting SqlAPs to Query entries
Do you know what this "Error during converting SqlAPs to Query entries" actually means"? How can we resolve this issue? The authorization is working properly for our user ids. But we need to provide restricted access for business users so trying to create test user and custom role.
Thanks
Nitesh Gupta

Answer 1

Hi Pinaki and Prabhith,
Yes, my issue was resolved. Sorry, missed to updated here.
I was just a beginer for BW on HANA Security at that time and didn't know many small things. The solution was pretty simple.
Whenever you assign analysis authorizations to a user in BW, you also need to generate corresponding HANA authorization. This is done through tcode RS2HANA_CHECK tcode. This tcode converts  BW analysis authorizations into HANA analysis authorizations and assign to the HANA user. You can see generated HANA authorization table RS2HANA_AUTH_STR in both BW and HANA.
Once the HANA authorizations are successfully generated for a user, he should be able to see data from Views.
Let me know if this solves issues. Then I will close this thread.
Thanks