Hello, HANA experts!
Recently I've faced with peculiar authorization problem on HANA SP09.
I'm trying to call procedure, which has an input table parameter, from XSJS using new API:
var loadedProcedure = connection.loadProcedure(schemaName,procedureName); response = loadedProcedure(inputTable);
Procedure has the following input parameter:
PROCEDURE "SCHEMA"."SCHEMA.DB.procedures.securityAdministration.region::spModifyTBL" ( IN userAdmins "SCHEMA"."SCHEMA.DB.types::ttUserAdmins", OUT errors "SCHEMA"."SCHEMA.DB.types::ttServiceError" ) LANGUAGE SQLSCRIPT SQL SECURITY DEFINER AS
At the same time, user has authorization to procedure on its role definition:
catalog sql object "SCHEMA"."SCHEMA.DB.procedures.securityAdministration.region::spModifyTBL":EXECUTE;
The problem is that when I called XSJS service, it couldn't execute the procedure because the lack of authorization rights:
"Error: $.hdb.Connection.executeProcedure: SQL error. NR: 258, ERROR: insufficient privilege: Not authorized at ptime/query/checker/query_check.cc:3289"
After some HANA API source code research, I found the possible reason: when framework calls the procedure with table type, it creates a temporary table with LIKE expression:
connection.prepareStatement('CREATE LOCAL TEMPORARY COLUMN TABLE "' + localschema + '"."' + localtemp + '" LIKE "' + schema_name + '"."' + table_name + '"').execute();Therefore, I tried to do the same in SQL Console:
CREATE LOCAL TEMPORARY COLUMN TABLE #userAdmins LIKE "SCHEMA"."SCHEMA.DB.types::ttUserAdmins";
And received the same authorization error message, so the problem must be in LIKE statement with reference to table type.
It doesn't matter how the table type was created: using CDS description or manually.
When I try to give the user an Object Privilige for my table type entirely, system responds me with error as on screenshot
However, when I give authorization for the whole schema "SCHEMA" , the authorization problem during creation local table dissapears and service works perfectly. But according to our authorization concept user is not allowed to have access to all schema.
Do you have any ideas how can I avoid authorization error message while using table types as type for input parameter in procedure?
Thank you in advance!