Skip to Content
Product Information
Author's profile photo Amit Kumar Singh

UI Data Protection – How to protect sensitive data in Long Text controls in SAP GUI Transactions

Introduction

In this blog, as an example, we will be showing how a Long Text field can be protected in MM03, ME23N, and ME53N transactions.

Purchase Order Text

A Purchase Order Text is a text describing the material in more detail. This text is subsequently copied to purchasing documents (such as purchase requisitions or purchase orders) automatically, where it can be changed if needed. It is valid for all organizational levels, not for a specific plant. Purchase order text can be entered in the material master record in many languages though only one text is allowed per language.

Sales Text

A Sales Text is a text describing the material in more detail. This text is subsequently copied to sales documents (such as requests for quotations or sales orders) automatically, where it can be changed if needed. It is valid for a specific sales organization and distribution channel. Sales Text can be entered in the material master record in many languages though only one text is allowed per language.

Here, we will learn the configuration process to protect Purchase Order Text tab through MM03 TCode and using the same configuration process we can protect Text tab information in other TCodes like, ME23N, ME53N.

DISCLAIMER: This is not out of the box solution supported by UI Data protection masking product but customer can use the manual approach mentioned in this blog to protect the sensitive information displayed in Long Text controls.

Prerequisite

UI data protection masking for SAP S/4HANA is a solution for selective masking of sensitive data on SAP S/4HANA user interfaces – SAP GUI, SAPUI5/SAP Fiori, Web Dynpro for ABAP, and Web Client UI. Data can be protected at field level, either by masking the content (replacing original characters with generic characters, such as asterisks) or by clearing or disabling the field.

Requirement

Here, we want to protect sensitive information displayed in Purchase Order Text tab in MM03 TCode using Role-based authorization concept.

Since we cannot mask the Long Text field information, we will hide the Text control. To achieve this, we will have to do masking configuration of a field which displayed along with text control, for example, Language field, etc. This configuration is a dummy configuration which is just done to activate masking solution.

Product “UI data protection masking for SAP S/4HANA 2011” is used in this scenario to protect sensitive data at field level and must be installed in the S/4HANA system.

Let’s begin

Configuration to achieve protection for information displayed in Purchase Order Text tab

Logical Attribute is a functional modelling of how any attribute such as Social Security Number, Bank Account Number, Amounts, Pricing information, Quantity etc. should behave with masking.

Configure Logical Attribute

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Maintain Metadata Configuration -> Maintain Logical Attributes

Follow below mentioned steps:

Under “Maintain Logical Attributes”, maintain following logical attribute.

Purchase Order Text tab
  • Click on “New Entries” button
  • Enter “Logical Attribute” as “LA_PO_TEXT
  • Enter “Description” as “Purchase Order Text Tab
  • Select “Is Sensitive” checkbox
  • Click on “Save” button

Maintain Technical Address

In order to mask the fields on SAP GUI Module Pool screens, Technical Information (Program Name-Screen Number-Field Name) is required which users can get by pressing “F1” on the field.

In this scenario, we will map Logical Attribute with Technical Address of any of the field available on the Purchase Order Text tab, for example, Language field. This is needed to trigger the masking framework.

To retrieve the Technical Address of Language field, you need to use Recording Tool feature as Technical Information on press of F1 key is not available here.

Refer to this blog to know how to use the Recording tool.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Maintain Metadata Configuration -> Maintain Technical Address

Follow below mentioned steps:

Under “SAP GUI (Module Pool) Field Mapping”, maintain technical address for following field.

Maintain Masking Pattern

In this step, we will configure Masking Patterns using the Masking BAdI strategy which will determine the way masked masked values will be displayed on the UI. Through Masking BAdI strategy, the masking string for a field to be displayed on the UI is dynamic and returned by the BAdI. The BAdI Implementation must have the filter value that has the same name as the masking pattern.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Basic Settings -> Field-Level Masking Patterns and Actions -> Maintain Masking Pattern – Follow below mentioned steps:

Maintain Field-Level Actions

In this step, we will configure the actions to be applied to a field that is configured for UI data protection. An action determines how a field appears and behaves when it is rendered on the user interface. Predefined patterns can be applied to specific actions to define how the field is displayed.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Basic Settings -> Field-Level Masking Patterns and Actions -> Maintain Field-Level Actions – Follow below mentioned steps:

BAdI Implementation

The visibility of Purchase Order Text tab can be controlled by implementing Masking Pattern BAdI /UISM/BD_MASK_PATTERN.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Business Add-Ins -> BAdI: Masking Pattern – Follow below mentioned steps:

In method “/UISM/IF_MASK_PATTTERN~EXECUTE_MASKING_PATTERN” of the BAdI Implementation class, the logic to set the visibility of the Purchase Order Text tab is implemented.

Add the same filter value as the name of the Masking Pattern “MASK_TEXT”.

Sample code is given below –

METHOD /uism/if_mask_patttern~execute_masking_pattern.

* Transaction MM03
    DATA: lr_ref TYPE REF TO cl_gui_textedit.
    DATA(lv_value1) = '(SAPLMGD1)<EDITOR_OBJ>'.
    ASSIGN (lv_value1) TO FIELD-SYMBOL(<fs_gt_control>).

    IF <fs_gt_control> IS ASSIGNED AND <fs_gt_control> IS NOT INITIAL.

      lr_ref = <fs_gt_control>.
      lr_ref->set_visible(
        EXPORTING
          visible           =  abap_false                " Visible
        EXCEPTIONS
          cntl_error        = 1                " CNTL_ERROR
          cntl_system_error = 2                " CNTL_SYSTEM_ERROR
          OTHERS            = 3
      ).
      IF sy-subrc <> 0.
      ENDIF.
    ENDIF.

    cv_output_value = '******'.
ENDMETHOD.

Maintain Field Level Security and Masking Configuration

Here, we will define how masking will behave with the logical attribute that we created in the above step. Here, we need to select the same Field Level Action which we have created in above step.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Masking and Blocking Configuration -> Maintain Field Level Security and Masking Configuration

Follow below mentioned steps:

Purchase Order Text tab
  • Click on “New Entries” button
  • Enter “Sensitive Entity” as “LA_PO_TEXT” and press “Enter” key. “Description” will get populated in corresponding fields
  • Check “Enable Configuration” checkbox
  • Select “Role Based Authorization” option
  • Enter “PFCG Role” as “/UISM/PFCG_ROLE“. In this example, we have used a blank role “/UISM/PFCG_ROLE”. Customers can use any role as per their requirement.
  • Enter “Field Level Action” as “MASK_TEXT
  • Click on “Save” button

Protecting Purchase Order Text tab information

Follow below mentioned steps:

  • Execute “MM03” TCode

  • Enter “Material” as “2257
  • Click on “Select View(s)” button

  • Select “Purchase Order Text” view
  • Click on “Continue” button

  • Select “Plant” as “GT01
  • Click on “Continue” button

  • Purchase Order Text information will not be displayed

Conclusion

In this blog post, we have learnt how we can use Role-based Authorization Concept to protect sensitive information displayed in the Purchase Order Text tab of MM03 transaction.

Assigned Tags

      4 Comments
      You must be Logged on to comment or reply to a post.
      Author's profile photo Tobias Keller
      Tobias Keller

      Hi Amit, nice and very clear depiction. Highly valuable - thanks!
      Tobias

      Author's profile photo Hima Raj
      Hima Raj

      Hi Amit,

      I tried following your instructions on setting a /N/UISM/TTRACE on MM03 to identify the technical address on the Text field and the language field , but unfortunately couldn’t not find the same field mapping as indicated on your screenshot

      i.e. Program : SAPLMGD1, Screen number : 2321, Field Name : LONGTEXT_MAINTAINED_TEXT

      Below is my recording on MM03

      image.png

      Author's profile photo Amit Kumar Singh
      Amit Kumar Singh
      Blog Post Author

      Hi Hima,

      I have used Recording Tool and able to get the desired information from the report. Screenshot is given below and the record is highlighted for your reference -

      I request you to follow the instructions specified below -

      • Execute /UISM/TTRACE TCode
      • Activate the recording for the logged-in user by clicking on "Activate User" button
      • Execute MM03 TCode
      • Enter Material Number
      • Select View as "Purchase Order Text"
      • Click on "Continue"
      • Enter Plant
      • Click on "Continue"
      • Go to Recording Tool screen
      • Select the User
      • Click on "Deactivate User" button
      • Click on "View Recording" button
      • Click on "Execute"
      • Verify the report, here you will see the highlighted record

      In case you face any issue, please raise an incident with us under "GRC-UDS-DO" component so that our support team can help you on the same.

      Regards,

      Amit Kumar Singh

      Author's profile photo Hima Raj
      Hima Raj

      Hi Amit, I had processed the traces in the same manner and did again in the same manner, it doesnt give me the same results as you. I will go ahead and create an incident.

      Thank you