Introduction
In this blog post, we will learn how to mask “Account Number” field displayed under "Bank Details" section in F110 transaction.
Attribute based authorizations are dynamic determination mechanism which determines whether a user is authorized to access specific data sets which can be based on the context attributes of the user and data (for example, price of certain sensitive materials are masked).
The end result for unauthorized users will look like below:
Prerequisite
UI data protection masking for SAP S/4HANA is a solution for selective masking of sensitive data on SAP S/4HANA user interfaces – SAP GUI, SAPUI5/SAP Fiori, Web Dynpro for ABAP, and Web Client UI. Data can be protected at field level, either by masking the content (replacing original characters with generic characters, such as asterisks) or by clearing or disabling the field.
The solution uses both role-based and attribute-based authorizations, affording customers a high degree of control.
Let’s begin
Configuration to achieve masking
Logical Attribute is a functional modelling of how any attribute such as Social Security Number, Bank Account Number, Amounts, Pricing information, Quantity etc. should behave with masking.
Configure Logical Attribute
Follow the given path:
SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Maintain Metadata Configuration -> Maintain Logical Attributes
Maintain Technical Address
In order to mask the fields on SAP GUI, Technical Information (Table Name-Field Name) is required which users can get by pressing “F1” on the field. There are some transactions like F110 where “F1” is not working for some or all of the fields in SAP GUI.
In this scenario “Recording Tool for Technical Address” will help user to find technical address for UI Masking. This report logs/records User Trace, Table Name-Field Name, Field Value and other metadata information that helps users to find Technical Address for masking.
Refer this blog to know how to use Recording tool.
Follow the given path:
SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Maintain Metadata Configuration -> Maintain Technical Address
Follow below mentioned steps:
Under “GUI Table Field Mapping”, maintain technical address for following field.
In F110 transaction, Technical Address of all the fields displayed under "Bank Details" section are same. Therefore, to get the desired technical information to mask "Account Number" field we need to configure a Derived Attribute.
Configure Derived Attribute
Derived Attributes are user defined attributes which are populated at run time. The derivation of these attributes can be maintained in a class method. The name of the Class can be specified while maintaining a derived attribute in the IMG.
Follow the given path:
SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Maintain Metadata Configuration -> Maintain Attributes and Ranges for Policy-> Derived Attribute Definition
Implementation of Derived Attribute
For the given case, we are masking Account Number field in transaction F110. As the technical information is same for all the fields displayed under Bank Details section, this implementation will provide the desired details for configuration.
Steps to implement Class for Derived Attribute:
- Execute transaction SE24
- Create Derived Attribute Class mentioned in the configuration (i.e. ZCL_MASK_F110)
- Implement the Interface: /UISM/IF_DERIVED_ATTR_VALUE in the Class
- Sample implementation of Method: /UISM/IF_DERIVED_ATTR_VALUE~EXECUTE
METHOD /uism/if_derived_attr_value~execute.
DATA: lv_progname TYPE dbglprog,
lv_struct TYPE string.
READ TABLE it_name_value_pair INTO DATA(ls_name_value_pair) WITH KEY sem_attribute = 'LA_BANK_ACC'.
IF sy-subrc = 0.
lv_progname = 'RFZALI20'.
lv_struct = 'GT_ADRS2PF-ADRS-BLINE4'.
CONCATENATE '(' lv_progname ')' lv_struct INTO DATA(lv_expr).
ASSIGN (lv_expr) TO FIELD-SYMBOL(<fv_bank>).
IF ls_name_value_pair-value_ext = <fv_bank>.
ev_output = abap_true.
ELSE.
ev_output = abap_false.
ENDIF.
ENDIF.
ENDMETHOD.Policy Configuration
A Policy is a combination of rules and actions which are defined in one or more blocks. The actions are executed on a sensitive entity (field to be protected) which has to be assigned to a Policy. The conditions are based on contextual attributes which help derive the context.
Context Attributes are logical attributes which are used in designing the rules of a policy. They are mapped to fields which are used to derive the context under which an action is to be executed on a sensitive entity.
Sensitive Entities are logical attributes which are sensitive and need to be protected from unauthorized access.
Follow the given path:
SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Data Protection Configuration -> Maintain Policy Details for Attribute based Authorizations – Follow below mentioned steps:
- Click on “New Entries” button
- Enter “Policy Name” as “POL_MASK_BANK_ACC”
- Select “Type” as “Field Level Masking”
- Enter “Description” as “Masking Bank account number in F110”
- Click on “Save” button
Write following logic into Policy
Maintain Field Level Security and Masking Configuration
Here, we will define how masking will behave with the logical attribute that we created in above step.
Follow the given path:
SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Data Protection Configuration -> Maintain Field Level Security and Masking Configuration
Follow below mentioned steps:
- Click on “New Entries” button
- Enter “Sensitive Entity” as “LA_BANK_ACC” and press “Enter” key. “Description” and “Application Module” will get populated in corresponding fields
- Check “Enable Configuration” check-box
- Select “Attribute Based Authorization” option
- Enter “Policy Name” as “POL_MASK_BANK_ACC”
- Click on “Save” button
Conclusion
In this blog post, we have learnt how Attribute-based masking is achieved in transactions F110 for masking “Account Number” field under Bank Details section.
- SAP Managed Tags:
2 Comments
