Create an "Operator and Values" Data Access Control

Users with the DW Space Administrator role (or equivalent privileges) can create data access controls in which criteria are defined as operator and value pairs. Each user can only see the records that fulfill the operator-value pairs she is authorized for in the permissions entity, including support for complex AND and OR combinations.

Prerequisites

To create data access controls, you must have a scoped role that grants you access to the space with the following privileges:

Data Warehouse General (-R------) - To access SAP Datasphere.
Data Warehouse Data Builder (-R------) - To access the Data Builder.
Data Warehouse Data Access Control (CRUD----) - To create, read, update, and delete data access controls.

The DW Space Administrator role template, for example, grants these privileges. For more information, see Privileges and Permissions ↗️ and Standard Roles Delivered with SAP Datasphere ↗️.

Prepare an Operator and Values Permissions Entity

Before creating your data access control, you must have prepared a permissions entity with the following columns:

Permission ID column - Which should be marked as a key.
User ID column - Containing user ids in the format required by your identity provider (email addresses, logon names, or other identifiers). If you are using SAML authentication, this column must contain values in the form defined as your User Attribute / IdpUserID (see Enabling a Custom SAML Identity Provider (Legacy Custom IdP) ↗️).

Note:

If a user has no entries in the permissions entity, then they will not have access to any records in the protected view.
Restriction Column - Each restriction per user must have a unique name, and one or more criteria can belong to each restriction. All criteria belonging to a restriction act together as an AND condition. If you have more than one restriction per user then all restrictions act together as an OR condition.
Criterion Column - The criteria name must contain only alphanumeric characters and underscores and appears in the Mappings area when a user applies the data access control to their view. It does not need to exactly match a column name, but should guide the user to the column to which it should be mapped.
Operator Column - The following operators are supported:
- ALL (or *) - Provides access to all records. No values required.
- EQ (or =) - Equal to First Value.
- NE (or <> or !=) - Not equal to First Value.
- GT (or >) - Greater than First Value.
- GE (or >=) - Greater than or equal to First Value.
- LT (or <) - Less than First Value.
- LE (or <=) - Less than or equal to First Value.
- CP (or LIKE) - Contains pattern First Value. Optionally Second Value can be set to an escape character.
  
  See LIKE Predicate in the SAP HANA Platform documentation.
- BT (or BETWEEN) - Between First Value and Second Value.
First Value Column - This value acts as the first argument or lower bound of the operator.
Second Value Column - This value acts as the second argument or upper bound of the operator.

For example:

Permission ID	User ID	Restriction	Criterion	Operator	First Value	Second Value
`1`	`[email protected]`	`0`	`Code`	`BT`	`CA`	`CZ`
`2`	`[email protected]`	`0`	`Type`	`EQ`	`1`
`3`	`[email protected]`	`1`	`Class`	`CP`	`ERR%`
`4`	`[email protected]`	`0`	`Admin`	`ALL`

Based on these three records:

bob will have access to records with a:
- (restriction 0) - Code between CA and CZ, and having a Type equal to 1, or
- (restriction 1) - Class beginning with ERR.
ann (restriction 0) - will have access to all records thanks to the ALL operator.

Note:

A criterion with an ALL operator can have any name and can be mapped to any column in a view.