In enterprise applications, it’s important to establish a structure for assessing the different privileges to grant to your team. Managers should have a different level of access to your applications than employees, and vice-versa. You certainly wouldn’t want your newly hired employees having the ability to view your core finances. These functional separations of activity are all possible in a specialized Hana Cloud Platform architecture, combining the object privileges of the HANA database with the application view of security of the Fiori Launchpad. In this article, we will introduce you to three techniques that you can apply today to secure your applications in SAP HANA and provide a more intuitive experience to your end-users.

Before you start, you will need the following:

• a HANA DB Server running in the cloud or on premise;
• a Fiori UI License;
• a Portal Service License;
• a HANA Web Development-based Workbench;
• and a HANA Web IDE License (optional, but recommended for ease of use).

Also, prior to beginning, review our primer “Everything You Need to Know About Configuring the Fiori Launchpad” for help with setting up your portal service along with general tips and tricks. Many of the items we discuss in the Fiori Launchpad article relate to this topic and vice-versa.

Without further ado, let’s get started!

Tip #1: Create an Object-Based Privilege

Object-based privileges are an essential part of any HANA installation. In short, these permissions allow your system administrator to set database level access in varying increments for user groups and individual users of the system. Each object type (i.e. tables, views, sequences) in HANA has a different set of permissions.

As an example, for tables you can activate or deactivate Alter, Drop, Select, Insert, Update, Delete, Index, Trigger and References. Views have other types of permissions.

By combining your tables, views and sequences strategically with different permission sets, it’s possible to create a use case for both individuals and groups of end-users.

In terms of security, the object privileges (along with other “back-end” permissions) are the last line of defense against malicious attacks. If someone happens to acquire an S-User ID for your system, and bypasses the Fiori Launchpad link, they still need these back-end privileges to view any data in your application. Even if they get to this point and launch your application, an error message will be displayed, stating that the user has insufficient privileges. Additionally, for legitimate users on your system, these privileges prevent cases where one user could potentially see another user’s personal information.

Here is an example of how you would create an object-based privilege:

• Navigate to your HANA Cloud Platform and open up the Applications > HANA XS Applications tab. Click on one of your applications and choose the blue hyperlink “Open in Web Based Development Workbench.” You should now be inside the HANA Back-end Editor. If you have not yet created a “.hdbrole file,” take a look at SAP Help Portal’s on creating a design-time role. Now that you’ve created two individual “.hdbrole” files, name one “employee” and one “projectManager.” Next, you will be configuring the permissions for each role.

• Navigate to your “.hdbrole” file, click on the “Object Privilege” tab and click the + button. From here you can associate individual tables, views, and sequences to the role.

• For the the Project Manager .hdbrole file, set the “read” and “write” permissions on all your tables that are necessary for the app to run. For the Employee .hdbrole file, give them only “read” permissions on all the tables that the Project Manager was previously associated with. Make sure to save your changes, and exit.