cancel
Showing results for 
Search instead for 
Did you mean: 

Role missing after conversion to MDC

Former Member
0 Kudos

Hi all,

I have converted a SPS101 system from single DB to MDC and the role required to manage tenant database via the HANA cockpit is missing (sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin). I think it is supposed to be delivered by default from SPS95 and onwards but it is nowhere to be found on the system.

Does anyone know how to add the role manually?

Sander

Accepted Solutions (0)

Answers (7)

Answers (7)

Former Member
0 Kudos

We had the same roll (sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin) missing after MDC conversion. I noticed that when I do a clean install with the MDC option you get the role. So there is a bug in the MDC conversion.


To solve the issue I exported the HANA_SYS_ADMIN delivery unit from the clean installed MDC system and imported it in converted MDC system. The role is in the delivery unit. The problem was solved.


Regards,

Floris

Former Member
0 Kudos

Hi Hans, long time no see.

Erick, please see my original post as this also occurs in SPS10.

Mine was a new system so I decided to remove and reinstall it and then the role was created. Still not clear why it wasn't on the first try.

Former Member
0 Kudos

Hello,

Sander, yes, in your case is clear that there was a problem with your installation, since on SPS10 it is a must to have that role.

Good notice that you solved the problem.

Best Regards,

Erick Ilarraza

former_member247175
Discoverer
0 Kudos

Hi Sander,

Did you solve the problem? I have exact the same issue!

Thanks

Hans Kesteloot

Former Member
0 Kudos

Hello,

What is your HANA revision?

Best Regards,

Erick Ilarraza

former_member247175
Discoverer
0 Kudos

Hi Erick,

The Hana Revision is currently 96

Former Member
0 Kudos

Hello,

Then you are on SPS 9 release. According to the official documentation you only need:

1.2.2.1 Open SAP HANA Cockpit

Prerequisites

"You have the role sap.hana.admin.roles::Monitoring or sap.hana.admin.roles::Administrator. Roles can be granted in the User editor of the SAP HANA studio or the Security tool of the SAP HANA Web-based Workbench"

So please add the roles:

sap.hana.admin.roles::Monitoring

sap.hana.admin.roles::Administrator

Now you should be able to work with HANA Cockpit.

Role sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin is supposed to be from SPS 10.


If you need the admin guide for SPS 9 please let me know some email to sent it, since the current online version is for SPS 10.

Best Regards,

Erick Ilarraza

mauricio_ramrezcuevas
Participant
0 Kudos

Hello Gentlemen,

I've performed the same conversion to MDC in Rev97 and the role is missing.

SAP security guide describes

Note:

sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin is granted only if you are logging on to the system database of a multiple-container system.

However does not mention if can be created manually.

Did you get a solution?

Regards.

lucas_oliveira
Advisor
Advisor
0 Kudos

Hello Mauricio, Erick and Sander,

It should not be created manually. This will be available if the installation/upgrade was performed correctly.

If you're not able to see it I believe this could be due to two scenarios: (1) installation/upgrade failed in some point (check indexserver for errors) or (2) you're looking for it on a tenant DB instead of checking it from the system db.

This is what it should look like if you check from the repository perspective:

I hope that helps.

BRs,

Lucas de Oliveira

mauricio_ramrezcuevas
Participant
0 Kudos

Hello Lucas,

I'm looking for it in systemDB and does not exist.

I need to check what was wrong in the conversion process, we performed the convertion based in this link


We did not use the method as described in "SAP HANA Administration Guide"

Everything works fine with the exception of the missing role.

Regards

Former Member
0 Kudos

Hello,

We found the SAP Admin Guide for HANA SP 09. Page 45. Document Version: 1.1 – 2015-02-16

1.2.2.1 Open SAP HANA Cockpit

Prerequisites

"You have the role sap.hana.admin.roles::Monitoring or sap.hana.admin.roles::Administrator. Roles can be granted in the User editor of the SAP HANA studio or the Security tool of the SAP HANA Web-based Workbench"


So we added the roles:

sap.hana.admin.roles::Monitoring

sap.hana.admin.roles::Administrator


Now SAP HANA Cockpit is displayed perfect!


But let go to check the new admin guide version for SPS10.  SAP HANA Platform SPS 10. Document Version: 1.1 – 2015-07-20. page 52:


1.2.2.1 Open SAP HANA Cockpit

Prerequisites


"You have the role sap.hana.admin.roles::Monitoring or sap.hana.admin.roles::Administrator. These roles allow you to open the cockpit and access the tiles in the SAP HANA Database Administration

catalog. If you're opening the cockpit on the system database of a multiple-container, you also need the role sap.hana.admin.cockpit.roles::SysDBAdmin so that you can access the tiles in the SAP HANA System Administration catalog. You can grant roles using the Assign Roles app of the SAP HANA cockpit. For more information, see Assign Roles to a User in the SAP HANA Administration Guide"



Here is where you get the first statement to sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin role....


So, it appears that if you are still running on SPS09 you don't need to  take into account this role. In fact we are able to work in the SAP Hana Cockpit. Sadly we don't know exactly what SPS10 review includes this role. > or = to 101?


Best Regards,

Erick Ilarraza






Former Member
0 Kudos

Hi Sunil and Lucas,

Thx for your replies. This regards a 101 system though and all the documentation for that version mentions that you should assign sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin to any user who needs to manage tenant databases through the HANA cockpit. Without it the "manage databases" tile does not appear in the cockpit.

I have setup a couple of these systems and so far the role was always there after installation except for this last one where it was not, even though I do see other new roles that were delivered with SPS101.

This leads me to think that the installer failed to create it for some reason and I am hoping that there is a way to add the role manually. I have grepped though the installers files but have not been able to locate an archive that contains the roles yet.

lucas_oliveira
Advisor
Advisor
0 Kudos

Hello Sander,

I'd check the indexserver traces as they might have more info regarding your assumption (did it failed importing the DU or not?).

Anyhow, you can check on your system if that particular role is active or not (just check the repository packages and files and see if it's there).

BRs,

Lucas de Oliveira

Former Member
0 Kudos

Hi Lucas,

What do you mean by "check the repository packages and files and see if it's there"?

Sander

lucas_oliveira
Advisor
Advisor
0 Kudos

Hello,

Open the repository from the WebIDE editor (or HANA Studio Repository View) and you should be able to navigate to the package where the role should be. If the role is there and for any reason it was not activated successfully then you might have the chance to re-activate that and see what the error is.

BRs,

Lucas de Oliveira

Former Member
0 Kudos

Dear Sir,

Had you been able to find the sap.hana.admin.cockpit.sysdb.roles::SysDBAdmin role?

We are running a MDC on HANA SPS09 (97 revision).

Not roles are under the sap.hana.admin.cockpit.* macht code. We searched via the SAP HANA Web-base Development Workbench:Security



Best Regards,

Erick Ilarraza



Former Member
0 Kudos

Hi Sander,

We are on HANA SPS09 Revision 96 and I checked the permissions for the user SYSTEM on both SystemDB and Tenant Database but do not find any such role assigned to SYSTEM user

The below link does mention about the role you are referring to but somehow it does not exist

http://help.sap.com/saphelp_hanaplatform/helpdata/en/7c/587edbb4d34ec8bff0f7587e53cedb/content.htm

We are able to use the SYSTEM user for some activities and it works

We will be disabling it soon before the GO Live

Sunil

lucas_oliveira
Advisor
Advisor
0 Kudos

Hello,

I don't think that's available in SP09 (at least I can't see those here).

Are you sure you're logged in the systemdb to perform that kind of action? How did you check the missing role?

BRs,

Lucas de Oliveira