Prerequisites, Scope and Considerations Jan 2013 UI Field Level Security

©2012 SAP AG. All rights reserved.2 UI Field Level Security Pre-requisites  SAP BASIS 700 (SP 14)/ 702 (SP 09)  SAP_APPL 600 (SP 11)/ 605 (SP 05)  SAP_HR 600 (SP 22)/ 600 (SP 45) Feature Considerations  The data element is generated for character type fields, date and currency (with restrictions) fields but the field must not be/have a  Primary key  Foreign key relationship  Input help, search help or check table  Standard conversion exit  UI Masking solution supports single currency formatting in general. There are limited number of transactions and fields for which multiple currency formatting has been enabled (kindly refer SAP Note for more details).

©2012 SAP AG. All rights reserved.3 UI Field Level Security - Scope  In ALV data display, data is masked in ‘Display’ and ‘Edit’ mode for unauthorized users. However, the masked data column shall be changed into display mode for unauthorized users if the ALV is in ‘Edit’ mode.  In “Table Control” data display, data is masked in ‘Display’ mode for unauthorized users. However, the masked data column shall be hidden for unauthorized users if table control is in ‘Edit’ mode. Note: Table Control data masking needs to be analyzed as masking solution does not provide complete coverage.  The masking pattern can be set for character type fields. For e.g. Bank Account Number can be displayed as ‘**18**’ or ‘&&&&&&’ based on the configured masking pattern. The masking pattern for ‘date’ or ‘currency’ field will be taken as ‘*’ for the entire field length.  User Interface Field Security logs data when the user accesses the registered fields (masking configuration). The functionality is provided to archive the User Interface (UI) Logs from the UI Log table to the archive files.  Configure the ‘critical’ database table in the UI Masking Configuration which allows only authorized users to see the data in SAP Transactions SE11, SE12, SE16, SE16N, DB02 and ST04. Note: DB02/ ST04 functionality for customer’s on Oracle database only.

©2012 SAP AG. All rights reserved.4 UI Field Level Security - Scope  UI Masking configuration allows maintenance of role assignment for every table-fieldname to check the user authorization. A user assigned to this role is authorized to see the unmasked data. In case, someone tries to change the critical role(configuration) then an notifications will be triggered to a configured administrator. Note: Notification will be triggered using SAP standard configurations. Customer specific mail subject and mail content can be created through BADI implementation.  The unauthorized users must not be allowed to create the data in the ‘create’ transactions if it contains any masked field(for instance XD01, FK01, etc). For e.g. User can have an authorization to create new ‘Customer’ via SAP Transaction ‘XD01’ but user does not have authorization to access ‘Bank Account Number’ of the customer.  Specific masking scenarios delivered in the solution via standard program modifications will be covered in the next slides.

©2012 SAP AG. All rights reserved.5 UI Field Level Security – Special Consideration  1. Bank Account Number (BANKN)  The masking functionality is delivered for the Bank Account Number in the following scenarios:-  For Table- LFBK & KNBK; Field- BANKN, standard program modifications are delivered for SAP Transactions XD02, XD03, MK02, MK03, FK02, FK03, XK02, XK03, FD02 & FD03 to mask/ hide the number for unauthorized users.  For Table- LFBK, KNBK, TIBAN; Field- BANKN: The Bank Account Number is masked for unauthorized users in SAP Transactions SE11, SE12, SE16, SE16N.  The column IBAN and IBAN Value will be hidden in ‘Display’ and ‘Edit’ mode for unauthorized users in SAP Transactions XD02, XD03, MK02, MK03, FK02, FK03, XK02, XK03, FD02 & FD03. An authorization will be required for Bank Account Number in the specified transactions to access the unmasked IBAN value.

©2012 SAP AG. All rights reserved.6 UI Field Level Security – Special Consideration  Note: The data is masked in ‘Display’ mode for unauthorized users but data column will be hidden in ‘Edit’ mode for Bank Account Number. This is applicable for mentioned SAP Transactions except SE11, SE12, SE16, SE16N.

©2012 SAP AG. All rights reserved.7 UI Field Level Security – Special Consideration  2. Credit Card Number (CCNUM)  The masking functionality is delivered for the Credit Card Number in the following scenarios:-  For Table- VCNUM; Field- CCNUM: The Credit Card Number is masked for unauthorized users in SAP Transactions XD02 & XD03. In Edit mode, “Unmasked Card” button is hidden for unauthorized users.  For Table- VCNUM, VCKUN; Field- CCNUM : The credit card number is masked for unauthorized users in SAP Transactions SE11, SE12, SE16, SE16N. Note: The data is masked in ‘Display’ mode for unauthorized users but data column will be hidden in ‘Edit’ mode for Credit Card Number. This is applicable for mentioned SAP Transactions except SE11, SE12, SE16, SE16N.

©2012 SAP AG. All rights reserved.8 UI Field Level Security - Special Consideration  3. Korean Supplement (Tax Number STCD1)  In SAP Transactions XD02, XD03, MK02, MK03, FK02 & FK03, Tax Number (STCD1 within ‘Korean Supplement’) will be hidden for unauthorized users in ‘Display’ and ‘Edit’ mode.  In SAP Transactions BP & BUG2, Tax Number will be hidden in ‘Edit’ mode and masked in ‘Display’ mode for unauthorized users.  Note: Tax Number column is hidden for unauthorized users.

©2012 SAP AG. All rights reserved.9 UI Field Level Security - Special Consideration  4. Communication Data  In SAP Transactions XD02, XD03, MK02, MK03, FK02 & FK03, ‘Preview’ button will be disabled for unauthorized users in ‘Display’ and ‘Edit’ mode. The preview functionality will be disabled if any of the following characteristics are active for masking: o Name, City, Post Code, Street or Country.  In ‘Edit’ mode, communication data such as Telephone Number, and Fax number will be hidden for unauthorized users.

©2012 SAP AG. All rights reserved.10 UI Field Level Security - Conclusion  The customer’s masking field list MUST be analyzed to verify the technical feasibility of the solution. The customer fields not covered within the technical feasibility will be considered as separate development request for the customer.

Thank You