Sensitive data leaked during approval

[#1]

Hi everyone,

We have some sensitive data in the task description(user decision step) that should only be allowed to see by approvers, and based on this, approvers can approve / reject workflow.

But today I found use GOS (Generic Object Services) function, all users can easily click this item and sensitive description will popup.

GOS function is needed for them to monitor approval status, so it can't be banned.

Could you please give me some suggestions about this? Thanks.

[pokrakam · Accepted solution]

Hello,

You are not the first one to encounter this requirement. I believe the most reliable way is to completely separate it from your task, which can be done in a user-friendly manner: Create an object that displays the relevant data, which you can add as a link.

If needed write some blurb in the description: "For confidentiality reasons, please use the link to display...". Makes the user feel privileged and it's sensible, generally a very agreeable solution.

Regards,

Mike

[Former Member · Accepted solution]

Thanks Mike.

That's good idea.

The object link can also be clicked from GOS, how to do authority check?

And we have a forward mail program for this decision step to our outlook, I'm afraid this object link will disappear

in the outlook.

Best regards.

Zhuang

[pokrakam · Accepted solution]

Hello Zhuang,

Rob was referring to the "Details" tab, second in your screenshot. Here you can hide the step from the user log, also a valid solution.

An attached object will not be part of the mail. I assume you're referring to Extended Notifications. This is why it is important to include an explanation - it helps a lot to make an inconvenience acceptable.

Your choice of solution really depends on your level of sensitivity. Hiding it from the log is OK, but some context will be lost as the log will not show the approval decision. But it will be part of the mail. Note it will be possible for users to switch to the technical log, which will show it. So you would need to restrict authorisation for this.

Using a custom object means you can implement your own authority check in the default method - ideally using proper authorisation roles (AUTHORITY CHECK statement). So if a work item is forwarded, or the user sets up a substitution incorrectly, the object will still fail an auth check if the recipient is not authorised.

There is always a tradeoff between security and convenience, your answer depends on the level of protection over the data.

Regards,

Mike

[Former Member · Accepted solution]

Thanks Mike, if an attached object will not be part of the mail(Extended Notifications). I need to provide a web link for them to click inside this mail. it's unacceptable if there is two separate mails. Can this link be directed to custom object?

You are absolutely right about tradeoff.

Best regards.

Zhuang

[pokrakam · Accepted solution]

The easy option is to remove the decision form the mail and get them to open the inbox item. Then the link will be there.

Alternatively it's a bit of development effort, but you can add your own links to extended notifications. You would need to subclass/replace the message generator class(es) and add a link to launch a custom transaction. Class CL_SWN_NOTIF_WORKFLOW generates the links.

On the plus side, you could turn this into a nice web-based app if you want, so the link opens up a webpage with all the info on it. The whole thing will be some effort but could be fun if you have the time. 

Regards,

Mike

[Former Member · Accepted solution]

Thanks Mike, your explanation helps a lot!

Best regards,

Zhuang

[Former Member]

Hi,

You can change the log behaviour of all of your steps in the workflow builder, tab details.

Does this help?

Kind regards, Rob Dielemans

[Former Member]

Thanks Rob. It's easiest way if SAP provide a setting place to "hidden" description in the GOS, and at the meantime approvers are not affected.

But I didn't find that place, can you please explain a little bit more?

Sorry, I should see "Tab details" early, now I know what you mean, thanks and I will have a try.

Message was edited by: MF Z

[Former Member]

Approval and sensitive data should be combined together(in one step), it's unacceptable to split as two mails or two steps.

Best regards.

Zhuang