Field Masking – Masking fields in IDoc documents in transaction WE05
In this blog post, we will learn how to mask “MATNR” field value in IDoc documents in transaction WE05.
A PFCG Role will be used for the authorization check which will allow users with the specified role to view the field value. If a user does not have this role, it means the user is not authorized and data will be protected either through masking, clearing, or disabling the field.
After configuration, unauthorized users will get the below mentioned result. However, in our scenario, only “MATNR” field is sensitive and only this fields value need to be masked. So, there is a need to implement a BAdI which will only mask this particular field value:
“Field Masking for SAP GUI” is a solution to protect sensitive data on SAP GUI screens at field level.Product “Field Masking for SAP GUI” is delivered to customer as add-on (UIM 100). To achieve Role based masking, Add-on UIM 100 must be installed in customer system.
Role based masking is required to mask “MATNR” field value in IDoc documents in transaction WE05.
Maintain Masking configuration
Configure Technical Information (Table Name-Field Name) of field in masking configuration.
You can get the Technical Address of a GUI field by pressing “F1” on the field.
Follow the given path and maintain following entries:
SPRO -> SAP NetWeaver -> Field Masking for SAP GUI -> Masking Configuration->Maintain Masking Configuration
Maintain Program and Screen Details
For the above entry, “Program and Screen Details” need to be maintained.
Follow below mentioned steps:
- Select the entry maintained above
- Double-Click on “Program and Screen Details” option
- Enter “Program Name” as “IDOC_TREE_CONTROL”
- Enter “Screen Number” as “0100”
- Enter “Field Name” as “INT_SEG-STRING“
- Click on “Save” button to save the information
- Select the entry maintained in above step
- Click on “Regenerate Programs” button
What is Context based Masking?
Attributes that deal with time, location or dynamic aspects is called Context (environment) attribute. Masking a field based on context attribute is called Context based-masking.
e.g. – Masking the salary of employees who belong to Germany.
Context based masking is also possible in IDoc document in transaction WE05. To achieve Context based masking, implementation of BAdI is required. In the given scenario, only “Material Number” field is sensitive and its value need to be masked.
Context-based masking can be achieved by implementing Masking BAdI /UIM/BD_MASKING.
Create BAdI implementation for method PREPARE_MASK_DATA under Class ZCL_BADI_IDOC.
Sample code is given below –
METHOD /uim/if_uisecurity~prepare_mask_data. DATA lv_varname TYPE string. FIELD-SYMBOLS: <fs_segment> TYPE any, <fieldname> TYPE any. lv_varname = '(IDOC_TREE_CONTROL)INT_SEG'. ASSIGN (lv_varname) TO <fs_segment>. IF <fs_segment> IS ASSIGNED. ASSIGN COMPONENT 'FIELDNAME' OF STRUCTURE <fs_segment> TO <fieldname>. IF <fieldname> IS ASSIGNED AND <fieldname> NE 'MATNR'. cs_mask_data-auth_flag = abap_true. cs_mask_data-masked_val = cs_mask_data-original_val. ENDIF. ENDIF. ENDMETHOD.
In this case, the end result for unauthorized users will look like below where “MATNR” field value will appear as masked and other field values will appear as unmasked:
In this blog post, we have learnt how Role-based masking is achieved to mask fields in IDoc document in transaction WE05.
I need help. I have requirement where I need to mask more than one field. How to achieve it.
Please let us know the requirement i.e. for which Transactions you need to configure the masking and what are those fields where the same needs to be applied.
Also, if you are struggling with any of the scenario then I request you to connect with our Support Team by raising an incident with us under "GRC-UDS-DO" component.
Amit Kumar Singh