Issue with referring a role from another container in WebIDE

[former_member333725]

Hello,

I had the idea to implement a centralized container in WebIDE for security, so that the composite roles can be built in the security container which would refer to roles created in different HDI containers. This would provide for easier transportability of the composite roles (which currently reside as runtime roles).

For eg.,

There's Container X with Roles A, B, C, and container Y with roles D, E, F. Now I want to create a container Z with roles P, and Q, wherein P refers to role A from container X and role D from container Y.

I referred to the hdbrole documentation and found out that there is a parameter schema_roles which can be used to refer to other schema-local roles with a proper reference maintained in hdbroleconfig file.

I did grant the A# role to the object container owner and the normal role A to the technical user in hdbgrants file. However, when I build the hdbrole file, I get the following error:

Error: com.sap.hana.di.role: "<Namespace of source role>::<role_name>": not authorized to access the referenced object [8207018]

I checked individual files are getting built except for the hdbrole file which should mean that the rest of the files are okay.

What could be the issue here or am I missing something?

TIA.

Regards,

Rahul Rai

[former_member832048]

HI. I've got the same issue. Have you resolved it?

[former_member832048]

I plan to use this approach:
1.Add AnaliticPrivilege from external container to the role.
a.In external container – add AP with grant option to grant_external_access.hdbrole.
b.In current container – add service and resource to external container in mta.yaml file.
c.In current container – add grants for the service using role grant_external_access#
... "object owner":{"container_roles":["grant_external_access#"]}...
d.In current container – add AP to the role with schema_reference.
e.Build the project and check HANA role

2.Add Role from external container to the role.
a.Create User-Provided service with Service Grantor User in Cockpit.
b.Grant external container roles with Admin option to the Service Grantor User.
d.In current container – add grants for the service.
... "object_owner": {"schema_roles" : [{"schema" : "Schema1","roles_with_admin_option":["exRole1"]}]} ...
e.In current container – add external role to the role :
... "schema_roles": [{"schema_reference": "RefSchema1","names": ["exRole1"]}] ...
f.Build the project and check HANA role.