What roles are required to access Live Hana Data from Lumira 1.31?

[mrwong05]

Hi,

I have Hana 2.0 Platform and Lumira 1.31 Desktop and Server. I want to create a restricted user on HANA database which can use lumira Desktop to access limited calculation views via analytical privileges. My success is that the user can access the Lumira view (through BI Platform Lumira Server) and access the data for view which were made by developers. But the user cannot create their own Live Hana Data Acquisition Lumira Documents using Lumira Desktop and their restricted user login.

My question is then, what role or privileges do i need to assign to allow them this access?

thanks,

Matt

[mrwong05]

Hi Tammy, Thanks for changing the tag. I haven't searched extensively SAP Help for HANA security. I need some time, but was just wondering if it's possible. If i know it's possible then i'll search out the right roles. if not, then...maybe not.

Matt

[former_member183326]

Hi,

As a HANA restricted user technically very different to a standard user, its not a straight forward process in finding out what's wrong here.

Best thing to do is:

1: Run an authorization trace and check to see if there a indeed a role missing.

2: I'm assuming you are connecting via HTTP? Also run a trace HTTP watch trace and check here too to see if this shows anything.

Restricted users typically only have limited HTTP or HTTPS access to the system. They’re ideally intended to support user access to custom applications developed in the SAP XS engine

[mrwong05]

thanks, got it. i figured after lots of role changing that restricted user wasn't going to work out well.

[shiva_vishnubatla]

Hi Matt,

Looks to me your SAP BI user security is okay to view the documents, but Hana user seems the issue.

Does the HANA Security Guide help ?
There are some good examples of implemeting this on the community blogs -

eg:

https://blogs.sap.com/2014/10/01/restricting-access-to-views-in-sap-hana-for-sap-lumira/

https://blogs.sap.com/2013/09/22/creating-an-sap-hana-user-with-just-enough-rights-to-use-sap-lumira...

can you please check these. or refer to the HANA security guide to build a more comprehensive user role.

shiva

[mrwong05]

Hi Shiva,

Thank you for your reply, and yes I have read these two blogs you mentioned, but actually these methods do not include a "restricted user" which is defined as a 0 privilege, 0 schema user. I can make a normal user and give the correct privileges, per the blogs, but when i user restricted user, lumira access is blocked.

Matt

[shiva_vishnubatla]

Hi Matt,

This may not be the answer you are looking for, but may help you isolate the issue.

You said "user can access the Lumira view (through BI Platform" but they "cannot create their own Live Hana Data using Desktop" - as these use 2 seperate connectivity schemes [ server vs desktop] - can you check to make sure maybe they are connecting differently as in using a different user altogether in the desktop - and not using the user you intended to use.

Besides this, if they are using the exact same use and if the user is granted data access to create and view data, then i dont see why this cant work

shiva

[mrwong05]

Restricted user just doesnt seem to work for lumira desktop HANA live data access. but like i said, it can view a bi-platform hosted lumira view without problem. I need more time to do the authorization trace as Michael mentioned, but i'm pressed for time.