- You have created a calculation view.
- You have created a dynamic SQL-based analytic privilege to restrict row-level access to this view.
- Since the analytic privilege is dynamic you have also created a stored procedure to apply filter conditions at runtime.
- You have created a role and granted the analytic privilege to it.
- And finally you have granted the role to a user.
- However when this user does a data preview on the calculation view this fails with the following error:
500 insufficient privilege: Could not obtain all relevant analytical privileges for user <user>
accessing view <schema>.<view> due to exception: Invalid SQL AP definition
- This error is too generic so you increase the trace level to INFO for component INDEXSERVER:authorization as follows:
- ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') SET ('trace', 'authorization') = 'info' WITH RECONFIGURE;
- Preview the calculation view with the user affected until the authorization error is returned.
- ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') UNSET ('trace', 'authorization') WITH RECONFIGURE;
- Review the latest indexserver trace file.
- The enhanced authorization trace prints additional information in the indexserver trace file:
Invalid filter procedure: <schema>.<procedure>. Reason: Not supported data type Non-SQL-Type for unary operator EQUAL
Failed to obtain analytical privilege definition: ObjectId(xx,x,oid=xxxxxxxx)(convertToStatic: 1) due to error: Unsupported data type [$datatype$] of output parameters for procedure $schema_name$.$procedure_name$
- SAP HANA XS Advanced
- SAP HANA 1.0 SPS12
- SAP HANA 2.0
HANA, XSA, XS Advanced, SQL-Analytic Privilege, stored procedure, calculation view, insufficient privilege, data type, table type, output parameter , KBA , HAN-DB-SEC , SAP HANA Security & User Management , HAN-DB-DI , HANA Deployment Infrastructure (HDI) , Problem
About this pageThis is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP ONE Support launchpad (Login required).
Search for additional results
Visit SAP Support Portal's SAP Notes and KBA Search.