Required Permissions

The following are the required permissions for the specific operations mentioned below:

Note

  • USER ADMIN privileges are required for Enable/Disable/Lock/Unlock Account/Delete Account/change password.

  • For SAP HANA Cloud database, the USER ADMIN system privilege is not available and instead the OPERATOR system privilege on the user group in which the user is to be created is required for Enable/Disable/Lock/Unlock Account/Delete Account/change password. For more information, refer to the SAP Help Portal.

CATALOG role a public

System Privileges

  • CATALOG Read

  • ROLE ADMIN

  • USER ADMIN

  • CATALOG Read

  • ROLE ADMIN

Revoking the role can be achieved by the same user who has granted it.

Minimum required permissions for existing SAP HANA connector:

CATALOG role and Application privilege

Repository roles

System Privileges

System privileges

  • CATALOG Read

  • ROLE ADMIN

System Privileges

  • CATALOG Read

  • ROLE ADMIN

  • USER ADMIN

Object Privileges

EXECUTE Privilege on the following objects:

  • _SYS_REPO.GRANT_ACTIVATED_ROLE

  • _SYS_REPO.REVOKE_ACTIVATED_ROLE

  • _SYS_REPO.GRANT_APPLICATION_PRIVILEGE

  • _SYS_REPO.REVOKE_APPLICATION_PRIVILEGE

The service account must have the system privilege assigned to it with the Grantable to other user and groups flag enabled.

Minimum required permissions for SAP HANA Cloud database connector:

CATALOG role and Application privilege

Repository roles

System Privileges

System privileges

  • CATALOG Read

  • ROLE ADMIN

System Privileges

  • CATALOG Read

  • ROLE ADMIN

  • USER ADMIN

Object Privileges

  • ALTER and REFERENCES object permissions are required on SAML provider object in order to provision user with the respective SAML provider for SAP HANA Cloud database.

    Note
    To grant a role created with the role group assigned, the object privilege OPERATOR on the role group is required.

The service account must have the system privilege assigned to it with the Grantable to other user and groups flag enabled.