Skip to main content

Module 13: Authorizations in BW/4HANA (BW/4HANA 2.0)

Authorizations in BW/4HANA control who can see which data, not just who can run a report.
Unlike OLTP systems, BW authorizations are data-driven and analytical.

This module covers:

  • Analysis authorizations
  • BW authorization objects
  • Variable-based authorizations
  • CDS-based authorization (intro)
  • BW vs S/4HANA authorization concepts

1. Authorization Philosophy in BW/4HANA​

BW authorization design focuses on:

  • Data visibility (row-level security)
  • Analytical semantics
  • Central governance
Key Difference

BW answers "What data can the user analyze?",
S/4 answers "What transaction can the user execute?"

2. Analysis Authorizations (Core BW Concept)​

2.1 What are Analysis Authorizations?​

Analysis Authorizations restrict data access based on:

  • Characteristics (e.g. Company Code, Sales Org)
  • Characteristic values
  • Authorizations assigned to users

They are evaluated:

  • At query runtime
  • Per user session

2.2 How Analysis Authorizations Work​

User
 ↓
Assigned Analysis Authorization
 ↓
Characteristic Restrictions
 ↓
BW Query Result

Example:

User can see:

Company Code = 1000, 2000

2.3 Authorization-Relevant Characteristics​

Only characteristics marked as:

Authorization-Relevant = X

are checked during query execution.

Best Practice

Mark only truly sensitive characteristics as authorization-relevant.

3. Authorization Objects in BW/4HANA​

3.1 Key BW Authorization Objects​

Authorization ObjectPurpose
S_RS_AUTHAnalysis authorizations
S_RS_COMPInfoProvider access
S_RS_COMP1Query-level access
S_RS_ADMWBModeling permissions
S_RS_DTPData load permissions

3.2 Separation of Duties​

RoleTypical Permissions
ModelerDesign-time access
OperatorLoad & monitoring
End UserQuery execution
warning

Never mix modeling and data consumption roles.

4. Variable-Based Authorizations​

4.1 What are Variable-Based Authorizations?​

Variable-based authorizations dynamically restrict data using:

  • Variables
  • User attributes
  • Derived values

Example:

Company Code = User Attribute

4.2 Typical Use Cases​

  • Country-based access
  • Region-based reporting
  • User-specific defaults

4.3 Best Practices​

DO

Use replacement path variables
Align variables with master data

AVOID

Complex customer exit logic
Hardcoded user logic

5. CDS-Based Authorization (Intro)​

5.1 CDS Authorizations – What They Are​

CDS-based authorizations use:

  • DCL (Data Control Language)
  • Roles defined on CDS views

Primarily used in:

  • S/4HANA Embedded Analytics
  • HANA-native scenarios

5.2 CDS Authorizations in BW Context​

Important

CDS authorizations are not a replacement for BW analysis authorizations.

In BW/4HANA:

  • CDS auth may apply to Open ODS Views
  • BW Queries still rely on analysis authorizations

When CDS Authorization Makes Sense in BW​

  • Federated scenarios
  • Direct HANA access
  • Mixed BW + Embedded analytics

6. BW vs S/4HANA Authorization Concepts (Very Important)​

Conceptual Comparison​

AspectBW/4HANAS/4HANA
FocusData visibilityTransaction control
GranularityRow-levelObject/action-level
EvaluationQuery runtimeTransaction runtime
ToolsAnalysis authsPFCG roles

Practical Example​

ScenarioBWS/4
Company Code restrictionCharacteristic-basedAuthorization object
Report executionQuery-levelTransaction code
Data filteringRuntimePre-execution
Interview One-Liner

BW authorizations filter data; S/4 authorizations control actions.

7. Authorization Design Best Practices (VERY IMPORTANT)​

DOs

Design authorizations early
Use authorization-relevant characteristics wisely
Reuse authorization concepts
Test with real user roles

DON'Ts

Don't mark too many characteristics as auth-relevant
Don't hardcode user logic
Don't mix BW & CDS auth concepts blindly

8. Common Authorization Issues​

IssueRoot Cause
No data visibleMissing analysis auth
Partial dataWrong characteristic restriction
Performance issueToo many auth-relevant chars
Inconsistent resultsMixed auth models

9. Interview-Grade Questions​

Q1. What are analysis authorizations in BW?​

Answer: Analysis authorizations restrict data access at runtime based on characteristic values and are evaluated during BW query execution.

Q2. Can CDS authorization replace BW authorization?​

Answer: No. CDS authorization is primarily for embedded analytics. BW queries still rely on BW analysis authorizations.

10. Summary​

  • Analysis authorizations are core to BW
  • Authorization objects control design vs execution
  • Variable-based auth enables dynamic restrictions
  • CDS auth is complementary, not a replacement
  • BW and S/4 authorization concepts differ fundamentally

11. What's Next?​

➡️ Module 14: Process Chains & Automation

Learning Tip

Security mistakes in BW are data leaks, not just technical bugs.