SAP_INTERNAL_HANA_SUPPORT

Question

Hi all,
According to the documentation the role SAP_INTERNAL_HANA_SUPPORT is thought for access by SAP HANA development support
during support scenarios.
Moreover the role can be granted at maximum to only one user at a time. I had a look into several systems and observed that this
role is already granted to user SYS.
So shall I simply take it away from user SYS? Since SYS is a technical user I would prefer to be careful to change authorizations
for this user.
How to proceed?
Thanks,
Ingo

Answer 1

Hi Ingo
for this specific role, the story is a little tricky.
If the role is assigned to SYS all the time, which is perfectly fine since SYS cannot be used to logon to the system or to start a session.
You will notice that SYS does not only has the role granted to itself (GRANTOR is also SYS) but that it also owns the role.
Anyway: bottom line is that you don't need to do anything about this.
The support role will be grant-able to one additional regular SQL user.
BTW: this will be enhanced with SP8 a little bit. Then the role will be able to be assigned to multiple but limited number of users at the same time (which will make life in support a lot easier).
- Lars