Explain HANA Security: Roles, Privileges & Data Masking in SAP

45 / 65

HANA DBadvanced

HANA Security: Roles, Privileges & Data Masking

Catalog and analytic privileges, role-based access control, and dynamic data anonymization/masking in HANA.

HANA has its own access control, separate from ABAP's PFCG roles. Where there is no ABAP layer — a BW/4HANA system, a side-by-side HANA application — this is the only layer there is.

Object privileges are like a building's master keys controlling which rooms (tables/views) you can enter at all; analytic privileges are like a shared open-plan office where everyone has room access but each desk's monitor only displays that specific employee's own assigned files; dynamic data masking is a privacy screen over specific sensitive documents on every desk, blurring only the sensitive parts even for people who are otherwise allowed in the room.

Key Concepts

Four privilege types, each for a different thing.

    system      administrative actions: create a schema, manage users
    object      SELECT, INSERT, EXECUTE on a table, view or procedure
    package     design-time repository content
    analytic    which ROWS of a calculation view you may see

Analytic privileges are the HANA-specific one. Object privileges are all-or-nothing: you can query the view or you cannot. An analytic privilege restricts which rows come back:

    sales rep in the west region queries SALES_VIEW
    -> the same view everyone queries
    -> only rows where region = 'WEST' are returned

One view serves everybody, and each person sees their own slice. Without this you would need a view per region and a way to route people to the right one.

Roles bundle privileges, and there are two kinds, which is worth knowing because it mirrors a shift across SAP:

    catalog roles     created with SQL at runtime. Traditional,
                      maintained by hand, not versioned.
    repository roles  .hdbrole files, deployed with the application,
                      in source control.

Repository roles are the modern approach: the role definition is an artefact reviewed and deployed like code, rather than a series of grants somebody ran once.

Dynamic data masking obscures values, not rows.

    CREATE VIEW v_employees AS SELECT ... WITH MASK (
      salary USING '***' );

Users without the unmask privilege see the masked value; everyone else sees the real one. One table, no second masked copy to keep in step.

HANA also offers anonymisation views using techniques such as k-anonymity, which is aimed at analysis over personal data rather than simply hiding a field.

The two mechanisms are complementary, and the distinction is the question.

    analytic privilege   which rows exist for you
    data masking         what the rows you can see reveal

A salesperson might see only their region's rows (analytic privilege) and, within them, see salary figures masked (masking). Different risks, different mechanisms, often used together.

One practical caution. Privileges can be granted directly to a user or through a role. Direct grants work and are close to impossible to audit later — the same reason ABAP assigns everything through roles.

What the interviewer is probing.1. "What are the privilege types in HANA?" Probing: breadth. Stalls: "Just roles." *Moves up:* system, object, package, analytic and application privileges — analytic privileges are the row-level ones on views.

2. "What is an analytic privilege for?" Probing: the row-level mechanism. Stalls: "Column access." Moves up: restricting which rows of a calculation view a user sees, statically or through a procedure for dynamic rules.

3. "Repository role or catalog role?" Probing: the lifecycle point. Stalls: "The same." Moves up: repository or design-time roles are transportable and version-controlled; catalog roles are created by SQL and drift between systems.

4. "How does masking differ from a privilege?" Probing: the distinction. Stalls: "It does not." Moves up: masking changes the value shown for a column; a privilege controls access to rows or objects — they solve different exposures.