Financial Management Blogs by SAP
Get financial management insights from blog posts by SAP experts. Find and share tips on how to increase efficiency, reduce risk, and optimize working capital.
cancel
Showing results for 
Search instead for 
Did you mean: 
AmitKrSingh
Product and Topic Expert
Product and Topic Expert
1,252

Introduction


In this blog, we will learn how to prevent SAPUI5 and Fiori Applications from starting. When unauthorized users attempt to start a program, they will be shown a message that the Application blocked by UI data protection masking.

From the perspective of an end user, application blocking behaves in the same way as traditional authorization checks. However, it has the advantage that you can configure it more flexibly using a policy that can contain different environment variables like IP addressUser Terminal etc.

Attribute based authorizations are dynamic determination mechanism which determines whether a user is authorized to access specific data sets which can be based on the context attributes of the user and data (for example, price of certain sensitive materials are masked).

We will configure SAPUI5 and Fiori Application blocking through UI Data Protection Masking for SAP S/4HANA 2011 solution based on Attribute Based Authorization Control (ABAC) concept.

Prerequisite


UI Data Protection Masking for SAP S/4HANA is a solution that allows you to protect restricted and sensitive data values at field level by masking, clearing, or disabling fields for those users who are not authorized to view or edit this data.

The product is a cross-application product which can be used to mask/protect any field in SAP GUI, SAPUI5/SAP Fiori, CRM Web Client UI, and Web Dynpro ABAP.

Requirement


Here, we want to configure SAPUI5 and Fiori Application blocking for Manage Business Partner Master Data Application to prevent unauthorized users from starting the application based on IP address using Attribute-based authorization concept.

Product “UI data protection masking for SAP S/4HANA 2011” is used in this scenario to prevent unauthorized users from starting the transaction and must be installed in the S/4HANA system.

Let’s begin


Configuration to achieve SAPUI5 Application Blocking


Before beginning with this Application Blocking Configuration, one policy of the type of application blocking must be created.

Configure Value Range


Value Ranges are a set of pre-populated values which can be used to derive the context under which an action should be executed.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Maintain Metadata Configuration -> Maintain Attributes and Ranges for Policy -> List of Values Definition – Follow below mentioned steps:

Blacklisted IP List



  • Click on “New Entries” button

  • Enter “List of Values” as “VR_BLACKLIST_IP

  • Enter “Description” as “Blacklisted IP Address

  • Click on “Save” button



Enter following entries in “VR_BLACKLIST_IP” Value Range

Follow below mentioned steps:

  • Execute Transaction Code “/UISM/V_RANGE

  • Click on “VR_BLACKLIST_IP” Value Range

  • Click on “Display<- -> Change” button

  • Click on “Add New Entry” button


Add following entries under “Include Value” tab and click on “Save” button







Policy Configuration


Policy is a combination of rules and actions which are defined in one or more blocks. The actions are executed on a sensitive entity (field to be protected) which must be assigned to a Policy. The conditions are based on contextual attributes which help derive the context.

Context Attributes are logical attributes which are used in designing the rules of a policy. They are mapped to fields which are used to derive the context under which an action is to be executed on a sensitive entity.

Sensitive Entities are logical attributes which are sensitive and need to be protected from unauthorized access.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Masking and Blocking Configuration -> Maintain Policy Details for Attribute based Authorizations – Follow below mentioned steps:

  • Click on “New Entries” button

  • Enter “Policy Name” as “SAPUI5_APP_BLOCK

  • Select “Type” as “Application Blocking

  • Enter “Description” as “Policy to Block SAPUI5 Applications

  • Click on “Save” button




Write following logic into Policy




Maintain Application Blocking Configuration


Here, we will configure groups of applications for Application Blocking.

Follow the given path:

SPRO -> SAP NetWeaver -> UI Data Protection Masking for SAP S/4HANA -> Sensitive Attribute Configuration -> Masking and Blocking Configuration -> Maintain Application Blocking Configuration

Follow below mentioned steps:

  • Click on “New Entries” button

  • Enter “Application Group” as “BLOCK_SAPUI5_APPLICATON"

  • Check “Enable” checkbox

  • Enter “Policy Name” as “SAPUI5_APP_BLOCK

  • Enter “Referenced Application” as “Block SAPUI5 Application

  • Click on “Save” button



Now, select the above created entry and double-click on “SAPUI5 Application Mapping”.




  • Click on “New Entries” button

  • Enter “Service Name” as “MD_BUSINESSPARTNER_SRV

  • Enter “Referenced Application” as “Business Partner Master Data app

  • Click on “Save” button




Blocking Manage Business Partner Master Data application



  • Login to Fiori Launchpad and click on “Manage Business Partner Master Data” app





  • The user will be shown a message “Application blocked by UI data protection masking” when the user tries to start the app from an unauthorized IP Address.




Conclusion


In this blog post, we have learnt how to prevent SAPUI5 and Fiori applications from starting when the user tries to start the application from an unauthorized IP address using Application Blocking Configuration.