Application Blocking – How to block SAPUI and Fiori Applications from Starting using Application Blocking Configuration

[AmitKrSingh]

Introduction

In this blog, we will learn how to prevent SAPUI5 and Fiori Applications from starting. When unauthorized users attempt to start a program, they will be shown a message that the Application blocked by UI data protection masking.

From the perspective of an end user, application blocking behaves in the same way as traditional authorization checks. However, it has the advantage that you can configure it more flexibly using a policy that can contain different environment variables like IP address, User Terminal etc.

Attribute based authorizations are dynamic determination mechanism which determines whether a user is authorized to access specific data sets which can be based on the context attributes of the user and data (for example, price of certain sensitive materials are masked).

We will configure SAPUI5 and Fiori Application blocking through UI Data Protection Masking for SAP S/4HANA 2011 solution based on Attribute Based Authorization Control (ABAC) concept.

Prerequisite

UI Data Protection Masking for SAP S/4HANA is a solution that allows you to protect restricted and sensitive data values at field level by masking, clearing, or disabling fields for those users who are not authorized to view or edit this data.

The product is a cross-application product which can be used to mask/protect any field in SAP GUI, SAPUI5/SAP Fiori, CRM Web Client UI, and Web Dynpro ABAP.

Requirement

Here, we want to configure SAPUI5 and Fiori Application blocking for Manage Business Partner Master Data Application to prevent unauthorized users from starting the application based on IP address using Attribute-based authorization concept.

Product “UI data protection masking for SAP S/4HANA 2011” is used in this scenario to prevent unauthorized users from starting the transaction and must be installed in the S/4HANA system.

Let’s begin

Configuration to achieve SAPUI5 Application Blocking

Before beginning with this Application Blocking Configuration, one policy of the type of application blocking must be created.

Configure Value Range

Value Ranges are a set of pre-populated values which can be used to derive the context under which an action should be executed.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Maintain Metadata Configuration -> Maintain Attributes and Ranges for Policy -> List of Values Definition – Follow below mentioned steps:

Blacklisted IP List

• Click on “New Entries” button


• Enter “List of Values” as “VR_BLACKLIST_IP”


• Enter “Description” as “Blacklisted IP Address”


• Click on “Save” button

Enter following entries in “VR_BLACKLIST_IP” Value Range

Follow below mentioned steps:

• Execute Transaction Code “/UISM/V_RANGE”


• Click on “VR_BLACKLIST_IP” Value Range


• Click on “Display<- -> Change” button


• Click on “Add New Entry” button

Add following entries under “Include Value” tab and click on “Save” button

Policy Configuration

A Policy is a combination of rules and actions which are defined in one or more blocks. The actions are executed on a sensitive entity (field to be protected) which must be assigned to a Policy. The conditions are based on contextual attributes which help derive the context.

Context Attributes are logical attributes which are used in designing the rules of a policy. They are mapped to fields which are used to derive the context under which an action is to be executed on a sensitive entity.

Sensitive Entities are logical attributes which are sensitive and need to be protected from unauthorized access.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Masking and Blocking Configuration -> Maintain Policy Details for Attribute based Authorizations – Follow below mentioned steps:

• Click on “New Entries” button


• Enter “Policy Name” as “SAPUI5_APP_BLOCK”


• Select “Type” as “Application Blocking”


• Enter “Description” as “Policy to Block SAPUI5 Applications”


• Click on “Save” button

Write following logic into Policy

Maintain Application Blocking Configuration

Here, we will configure groups of applications for Application Blocking.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Masking and Blocking Configuration -> Maintain Application Blocking Configuration

Follow below mentioned steps:

• Click on “New Entries” button


• Enter “Application Group” as “BLOCK_SAPUI5_APPLICATON"


• Check “Enable” checkbox


• Enter “Policy Name” as “SAPUI5_APP_BLOCK”


• Enter “Referenced Application” as “Block SAPUI5 Application”


• Click on “Save” button

Now, select the above created entry and double-click on “SAPUI5 Application Mapping”.

• Click on “New Entries” button


• Enter “Service Name” as “MD_BUSINESSPARTNER_SRV”


• Enter “Referenced Application” as “Business Partner Master Data app”


• Click on “Save” button

Blocking Manage Business Partner Master Data application

• Login to Fiori Launchpad and click on “Manage Business Partner Master Data” app

• The user will be shown a message “Application blocked by UI data protection masking” when the user tries to start the app from an unauthorized IP Address.

Conclusion

In this blog post, we have learnt how to prevent SAPUI5 and Fiori applications from starting when the user tries to start the application from an unauthorized IP address using Application Blocking Configuration.