7

Attribute Based Access Control (ABAC) – Field Masking Scenario in Change Log (CD...

 3 years ago
source link: https://blogs.sap.com/2021/08/21/attribute-based-access-control-abac-field-masking-scenario-in-change-log-cdpos-table-in-se16-transaction/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

Introduction

In this blog post, we will learn how to mask “New Value” and “Old Value” fields based on “Object Class” and “Field Name” field information of table CDPOS in SE16.

“New Value” and “Old Value” fields of table CDPOS in SE16 transaction need to be masked where “Object Class” is “MATERIAL” and “Field Name” is “NTGEW” or “BRGEW“. For other “Object Class” and “Field Name”, “New Value” and “Old Value” fields will appear as unmasked.

Attribute based authorizations are dynamic determination mechanism which determines whether a user is authorized to access specific data sets which can be based on the context attributes of the user and data (for example, price of certain sensitive materials are masked).

The end result for unauthorized users will look like below:

1070.png

Prerequisite

UI data protection masking for SAP S/4HANA is a solution for selective masking of sensitive data on SAP S/4HANA user interfaces – SAP GUI, SAPUI5/SAP Fiori, Web Dynpro for ABAP, and Web Client UI. Data can be protected at field level, either by masking the content (replacing original characters with generic characters, such as asterisks) or by clearing or disabling the field.

The solution uses both role-based and attribute-based authorizations, affording customers a high degree of control.

Requirement

Here, we want to configure masking using Attribute Based Access Control (ABAC) concept for “New Value” and “Old Value” fields in CDPOS table in SE16 transaction based on “Object Class” and “Field Name” fields information. Product “UI data protection masking for SAP S/4HANA 2011” is used in this scenario to protect sensitive data at field level and must be installed in the S/4HANA system.

Let’s begin

Configure Logical Attributes

Login to Fiori Launchpad and click on “Manage Sensitive Attributes” app available under “UI data protection masking” catalog.

797-1.png

798-1.png

Maintain Sensitive Attributes

A Sensitive Attribute is a type of logical attribute that define a field which needs to be configured for UI data protection.

  • Click on Add icon

799-1.png

  • Enter “LA_NEWVALUE” in Sensitive Attribute field
  • Enter “New Value field -> CDPOS table” in Description field
  • Click on “Create” button

1071.png

  • Sensitive Attributes with specified details will be created.

1072.png

Note: Using the above steps, create “LA_OLDVALUE” Sensitive Attribute.

1076.png

Maintain Mapping to Technical Addresses

In the Manage Sensitive Attributes application, you can link technical addresses of fields to sensitive attributes. A technical address describes the exact technical path or technical information which is used by the solution to process the field for UI data protection masking.

To find the technical addresses for SAP GUI screens, navigate to the field and choose F1, then the Technical Information icon. The system displays the relevant information.

  • Under Technical Mapping > SAP GUI, choose the Add icon.

  • Use the the value help to select the table name and the field name. You can also enter the referenced transaction codes as a comment to describe the mapping.

1073-1.png

1074.png

1075.png

Note: Using the above steps, maintain Technical Address for “LA_OLDVALUE” Sensitive Attribute.

1077.png

Maintain Context Attributes

In the Manage Sensitive Attributes application, you can create and update context attributes, and map them to sensitive attributes.

A context attribute is a type of logical attribute which is used to define the context within which a sensitive attribute is to be protected.

  • To assign a context attribute to a sensitive attribute, under Context Attributes, choose the Add icon.
  • To create a new context attribute, select Create New, enter the name of the context attribute beginning with LA_ and a description.
  • Open a context attribute by tapping the arrow next to it and under Technical Mapping, you can map technical addresses to the context attribute in the same way we did for sensitive attribute

1078.png

1079.png

1080.png

1081.png

1082.png

1083.png

Note: Using the above steps, create “LA_FLDNAME” Context Attribute and maintain Technical Address for “LA_FLDNAME” Context Attribute.

1084.png

1085.png

Note: Map both (LA_OBJCLAS and LA_FLDNAME) Context Attributes with LA_OLDVALUE Sensitive Attribute using “Use Existing” option.

1086.png

Masking Configuration

In the Manage Sensitive Attributes application, you can configure masking for a sensitive attribute to define in detail how it is to be protected in the system. Masking configuration defines which fields are to be masked for unauthorized users and in which contexts.

To configure masking for LA_NEWVALUE sensitive attribute, under Configuration > Masking Configuration, choose Edit.

  • Enable masking.
  • Select Attribute Based authorization concept.
  • Click on “Add” icon next to “Policy” edit box

1087.png

  • Enter Policy Name as “POL_MASK_CDPOS“.
  • Enter Description as “Mask Sensitive fields in CDPOS table“.
  • Click on “Create” button

1088.png

  • Policy will get created.
  • Click on “Save” button.

1089.png

  • Click on “Mask Sensitive fields in CDPOS table (POL_MASK_CDPOS)” link. You will be navigated to “Manage ABAC Policies” app

1090.png

1091.png

  • Choose “Edit” under “Rule” section of Policy

1092.png

  • ABAC Policy Cockpit will be opened

1093.png

Write following logic into Policy

1094.png

Note: Using the above steps, configure masking for LA_OLDVALUE Sensitive Attribute.

1095.png

Conclusion

In this blog post, we have learnt how Masking is achieved in Change Log (CDPOS table) in SE16 transaction based on contextual information.


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK