help needed on error message: Can only grant privileges for objects owned by _SYS_REPO

[nicholas_chang]

Hi All,

Need some help on HANA security as hana security is not my sweet spot.

When i executed below command i'm getting "

Can only grant privileges for objects owned by _SYS_REPO, not for YS0h01"

call _SYS_REPO.GRANT_SCHEMA_PRIVILEGE_ON_ACTIVATED_CONTENT('select','YS0h01','Y.Y0.Y001::RXXXXXXXX_DBCHSCHEMA');

How do i check is the schema YS0h01 own by _SYS_REPO? and what action do i need to do inorder to make YS0h01 own by _SYS_REPO? I've done some reading on help.sap and the questions posted here, but couldn't find what the answer required.

How do i achieve something like below??

Thanks in advance!

Regards,

Nicholas

[nicholas_chang]

Anyone pls? I just want to clear my doubt on how _SYS_REPO is the grantor for e.g. SAPBAA ??

Thanks in advance!

[nicholas_chang]

think i move one step further and found out it is a design time role. Thus, i go to the content and able to find the role, add another schema into the role and activate it, unluckily i'm having error "Not authorized at ptime/query/checker/query_check.cc:4462(258)" probably due to

User _SYS_REPO is not allowed to grant privilege EXECUTE for SCHEMA YS01H01

I tried execute "GRANT execute ON SCHEMA YS01H01 to _SYS_REPO WITH GRANT OPTION;" but failed. FYI, schema

YS01H01 is generated by SLT, since we don't know its password, how do we run grant execute to _SYS_REPO in this case?

Appreciate if someone can shed some light on this.

Thanks!

[argyropoulos_yannis]

Hi

Same issue. SLT creates a schema (S4H_100) with the replicated tables from S/4 in our CAR HANA system.

But when I want to create the dummy SLT tables in the CAR system with a report, the system complains about the fact that the HANA CAR user (SAPHANA1) doesn't have CREATE ANY privileges on the schema S4H_100.

I tried to create a super roles with the autorisation on schema S4H_100 but I get the error

insufficient privilege: Not authorized at ptime/query/checker/query_check.cc:4810

--> I just opened a SAP OSS ticket....

Regards

[Former Member]

Hi Nicholas,

Are you able to get this resolved. when you say YS01H01 is generated by SLT? is SLT the user who owns the schema.

I think only the owner of schema YS0h01 will be able to grant access to _sys_repo with grant option.

you can find the owner in view SYS.SCHEMAS.

Thanks

Narsing.