SAP Datasphere also offers to restrict which data can be retrieved by users. Let's explore how row-level security for data can be set up using data access controls.
Authorization with Data Access Controls
Data access control in SAP Datasphere is a row-level security mechanism that manages and restricts access to data within the platform. Once a data access control is applied to an object, any user viewing its data, either directly or via an object using it as a source, will see only those records they are authorized to view, based on specified criteria.
A data access control can be assigned to the following object types:
- Graphical view
- SQL view
- Analytic model
The harmonization layer is the first recommended layer to apply data access controls. After data has been ingested and standardized from different source systems, data access controls can be used here to restrict users from accessing all data. Applying security at this layer ensures that downstream views and objects built on top of the harmonization layer automatically inherit the access restrictions, reducing the risk of unauthorized data exposure early in the data flow.
Data access controls are also recommended in the reporting layer for further restrictions related to reporting on specific data sets. This is where analytic models are built and consumed by tools such as SAP Analytics Cloud. Applying data access controls here ensures that even at the point of consumption, users only see the rows of data they are authorized to view, regardless of how the data was modeled in lower layers.
The set up of a data access control involves the following steps:
- Prepare a permissions entity: Create a table or view that lists SAP Datasphere user IDs (in the format required by your identity provider) and assigns them to one or more filter criteria. The permissions entity must include an identifier column containing user IDs and one or more criteria columns, defining what data each user is allowed to see.
- Create the data access control: Select the permissions entity, designate the identifier column (user ID), and mark the criteria columns.
- Assign the data access control to a view or analytic model: Map the criteria columns from the data access control to the corresponding columns in the target object.
Here are some key considerations when working with data access controls:
You can apply multiple data access controls to the same object. However, they operate with AND logic, which mean that a user must satisfy all data access control criteria simultaneously to see data. If two data access controls conflict, no data will be shown.
Wildcards, such as *, spaces, or null in permission tables, are not supported.
The row-level security provided by a data access control is enforced when the related object is shared to another space or consumed outside the space in SAP Analytics Cloud.
Permissions entities themselves must not be protected by a data access control, or have any protected view among their sources, as this may impact performance.
Instead of assigning permissions per individual user, you can create a user role table and join it with a user table in a view, which is then used as the permissions entity.
