Information Steward access to SLT schema for temp tables

[patrickbachmann]

Hi folks,

I have a colleague working on an Information Steward proof of concept for pulling master data from HANA.  He asked me to setup a HANA user for Information Steward to connect and read from our default schema that contains all tables replicated from SAP via SLT.  Let's call this SAP_SCHEMA.  Let's call the Information Steward user and schema INFO_STEWARD.  The INFO_STEWARD user has full access to it's own INFO_STEWARD schema and I also gave him SELECT_USER role against the SLT schema named SAP_SCHEMA.  But when they run their job they get error that they can not CREATE temporary table against SAP_SCHEMA. 

Normally we never allow any user except SLT user to create tables in the SAP_SCHEMA.  All users have SELECT only.  But as a test I humored him and gave POWER_USER role against SAP_SCHEMA, had him run his load job and then I monitored M_TEMPORARY_TABLES.  Suddenly his job started working and I watched 500+ temporary tables fill up M_TEMPORARY_TABLES, however they all listed the temp table schema as INFO_STEWARD schema.  So I'm completely puzzled; if all the temp tables are created in it's own INFO_STEWARD schema then why does it need CREATE against SAP_SCHEMA??  My only theory is that it truly created a single temp table in SAP_SCHEMA but it happened and dropped so fast that I could not see it with my own eyes.  Whereas the other 500+ I could see sitting there for several minutes before they were dropped.

Are there any Information Steward users out there whom can explain to me why it would need CREATE against the SLT schema where our source tables live?  I'm hoping it's some sort of configuration problem on the Information Steward side as we do not want to doll out create access.  Other system users we have such as MicroStrategy only have read access to the SLT schema and create temp tables fine in their own MicroStrategy schema.

Thanks for any insight you can provide!

-Patrick

[chandan_praharaj]

Is the Execute access given also?

[patrickbachmann]

I just tried two system generated roles;

<SCHEMA>SELECT_USER

This one only has select against SAP_SCHEMA and Info Steward job failed

<SCHEMA>POWER_USER

This has;

Create any

Alter

Drop

Execute

Select

Insert

Update

Delete

Index

This worked however has way too much access.  I'm assuming the 'create any' is what's allowing it to work as the error they get without this role is;

SQL submitted to ODBC data source <INFO_STEWARD> resulted in error <[SAP AG][LIBODBCHDB DLL][HDBODBC] General error;258 insufficient privilege: Not authorized>. The SQL submitted is <CREATE TYPE "SAP_SCHEMA"."DS_TT_6E771" AS TABLE ( "MANDT" VARCHAR (3) ,"MATNR"

etc

[former_member182114]

Hi Patrick,

Maybe someone from IS space can help to answer your question

Best regards, Fernando Da Rós

[patrickbachmann]

Ahhh thanks Fernando I didn't even know there was this topic area in SCN.  Let me post it there, thanks!