From 4594684ce73e94c028efd05bae042c1c5dad0994 Mon Sep 17 00:00:00 2001 From: Thomas Jung Date: Mon, 19 Oct 2026 11:39:55 -0400 Subject: [PATCH] fix(#2810): grant CREATE PSE via default_access_role.hdbrole, not hdbgrants MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first attempt added CREATE PSE to _grants.hdbgrants under the tutorials-kg-grantor SQL grantor. That failed on DEV deploy (20261019-105602): the deployer emitted GRANT "CREATE PSE" TO ...#OO, which HANA rejects as 'invalid role name' — a system privilege cannot be granted that way, and the grantor lacks CREATE PSE WITH ADMIN OPTION. Correct HDI-native mechanism (per the @sap/hdi-deploy README): a role at the exact path src/defaults/default_access_role.hdbrole named default_access_role is auto-granted by the container object owner to the service instance's global access role on deploy — so a system privilege listed in it is granted by #OO with no external grantor. - db/src/defaults/default_access_role.hdbrole: new; system_privileges [CREATE PSE]. Path + name are the trigger for the deployer special case. - db/src/_grants.hdbgrants: reverted to SPARQL-only (remove CREATE PSE). - runbook: B1 rewritten to the default_access_role mechanism + the failed hdbgrants attempt recorded. No .hdinamespace needed (db/src defines no real namespace prefix); db/src/.hdiconfig already maps .hdbrole. --- db/src/_grants.hdbgrants | 6 +- db/src/defaults/default_access_role.hdbrole | 8 +++ .../operations/hana-aicore-embeddings.md | 63 ++++++++++++------- 3 files changed, 49 insertions(+), 28 deletions(-) create mode 100644 db/src/defaults/default_access_role.hdbrole diff --git a/db/src/_grants.hdbgrants b/db/src/_grants.hdbgrants index 3d5cf995e..81458d70e 100644 --- a/db/src/_grants.hdbgrants +++ b/db/src/_grants.hdbgrants @@ -5,8 +5,7 @@ { "privileges": [ "SPARQL QUERY", - "SPARQL UPDATE", - "CREATE PSE" + "SPARQL UPDATE" ] } ] @@ -16,8 +15,7 @@ { "privileges": [ "SPARQL QUERY", - "SPARQL UPDATE", - "CREATE PSE" + "SPARQL UPDATE" ] } ] diff --git a/db/src/defaults/default_access_role.hdbrole b/db/src/defaults/default_access_role.hdbrole new file mode 100644 index 000000000..6f16faa9d --- /dev/null +++ b/db/src/defaults/default_access_role.hdbrole @@ -0,0 +1,8 @@ +{ + "role": { + "name": "default_access_role", + "system_privileges": [ + "CREATE PSE" + ] + } +} diff --git a/docs/developers/operations/hana-aicore-embeddings.md b/docs/developers/operations/hana-aicore-embeddings.md index 8faf63182..aeb49cad0 100644 --- a/docs/developers/operations/hana-aicore-embeddings.md +++ b/docs/developers/operations/hana-aicore-embeddings.md @@ -66,34 +66,49 @@ with `SELECT * FROM NLP_VECTOR_EMBEDDING_MODELS;`. > `d2f9fa53543e5c4e` (defaultOrchestrationConfig), > `dfad0fa7cd47ab38` (text-embedding-3-small). -### Step B1 — grant `CREATE PSE` (declarative) +### Step B1 — grant `CREATE PSE` via `default_access_role.hdbrole` The container runtime user already holds `CREATE REMOTE SOURCE`; it is -missing only `CREATE PSE`. Grant it through the existing -`db/src/_grants.hdbgrants` / `tutorials-kg-grantor` mechanism — add -`CREATE PSE` to the `system_privileges` of both `application_user` and -`object_owner`, then deploy `tutorials-db-deployer`. - -```jsonc -// db/src/_grants.hdbgrants → tutorials-kg-grantor → application_user / object_owner -"privileges": [ "SPARQL QUERY", "SPARQL UPDATE", "CREATE PSE" ] +missing only the system privilege `CREATE PSE`. Grant it the **HDI-native +way**, through the container's own `default_access_role` — **not** via +`_grants.hdbgrants` (that path needs an external grantor holding the +privilege `WITH ADMIN OPTION`, which `tutorials-kg-grantor` does not, and +it emits `GRANT "CREATE PSE" TO …#OO` which HANA rejects as an *invalid +role name*). + +Per the [`@sap/hdi-deploy` README](https://www.npmjs.com/package/@sap/hdi-deploy) +(the definitive HDI reference), a role at `src/defaults/default_access_role.hdbrole` +named `default_access_role` is, on deploy, created by the container object +owner (`#OO`) and granted to the service instance's global access role — +so a system privilege listed in it is granted by `#OO`, with no external +grantor service. + +```json +// db/src/defaults/default_access_role.hdbrole +{ + "role": { + "name": "default_access_role", + "system_privileges": [ "CREATE PSE" ] + } +} ``` -> **Try-first risk.** The grant only lands if the grantor identity behind -> `tutorials-kg-grantor` holds `CREATE PSE` **WITH ADMIN OPTION**. -> -> - **If deploy succeeds:** done, proceed to B2. -> - **Failure signature:** `tutorials-db-deployer` fails with an -> insufficient-privilege / cannot-grant error naming `CREATE PSE`. -> - **Fallback:** as a DEV HANA Cloud admin (DBADMIN or equivalent), run -> **one** of: -> ```sql -> -- Option 1: let the grantor delegate it (keeps the declarative path working) -> GRANT CREATE PSE TO WITH ADMIN OPTION; -> -- Option 2: grant the container user directly (bypasses the grantor) -> GRANT CREATE PSE TO AC9753D6C4764F5ABE3B3CA4E88233C0_..._RT; -> ``` -> then re-deploy (Option 1) or skip straight to B2 (Option 2). +Notes: +- The file **must** be at exactly `src/defaults/default_access_role.hdbrole` + and not excluded by an include-filter, or the auto-assignment won't fire. +- `.hdinamespace`: only needed (empty `"name":""` at `src/defaults/`) if + `db/src` defines a real namespace prefix. This repo has none, so no + `.hdinamespace` is added. +- `db/src/.hdiconfig` already maps `.hdbrole`, so the artifact deploys. +- Do **not** re-add `CREATE PSE` to `_grants.hdbgrants` — that was the + failed first attempt (DEV deploy `20261019-105602`, + `invalid role name: CREATE PSE`). + +After deploy, confirm the privilege landed: +```sql +SELECT PRIVILEGE FROM EFFECTIVE_PRIVILEGES + WHERE USER_NAME = CURRENT_USER AND PRIVILEGE = 'CREATE PSE'; -- expect one row +``` ### Step B2 — create the PSE and remote source