UI Field Level Security

Prerequisites, Scope and Considerations

Jan 2013

UI Field Level Security

Pre-requisites
SAP

BASIS 700 (SP 14)/ 702 (SP 09)

SAP_APPL 600 (SP 11)/ 605 (SP 05)
SAP_HR 600 (SP 22)/ 600 (SP 45)

Feature Considerations
The data element is generated for character type fields, date and currency (with restrictions) fields but the
field must not be/have a
Primary key
Foreign key relationship
Input help, search help or check table
Standard conversion exit
UI Masking solution supports single currency formatting in general. There are limited number of
transactions and fields for which multiple currency formatting has been enabled (kindly refer SAP
Note 1971032 for more details).

2012 SAP AG. All rights reserved.

UI Field Level Security - Scope

In

ALV data display, data is masked in Display and Edit mode for unauthorized users. However, the
masked data column shall be changed into display mode for unauthorized users if the ALV is in Edit mode.
In Table Control data display, data is masked in Display mode for unauthorized users. However, the
masked data column shall be hidden for unauthorized users if table control is in Edit mode.
Note: Table Control data masking needs to be analyzed as masking solution does not provide complete
coverage.
The masking pattern can be set for character type fields. For e.g. Bank Account Number can be displayed
as **18** or &&&&&& based on the configured masking pattern. The masking pattern for date or
currency field will be taken as * for the entire field length.
User Interface Field Security logs data when the user accesses the registered fields (masking
configuration). The functionality is provided to archive the User Interface (UI) Logs from the UI Log table to
the archive files.
Configure the critical database table in the UI Masking Configuration which allows only authorized users to
see the data in SAP Transactions SE11, SE12, SE16, SE16N, DB02 and ST04.
Note: DB02/ ST04 functionality for customers on Oracle database only.

2012 SAP AG. All rights reserved.

UI Field Level Security - Scope

UI

Masking configuration allows maintenance of role assignment for every table-fieldname to check the
user authorization. A user assigned to this role is authorized to see the unmasked data. In case, someone
tries to change the critical role(configuration) then an email notifications will be triggered to a configured
administrator.
Note: Email Notification will be triggered using SAP standard email configurations. Customer specific mail
subject and mail content can be created through BADI implementation.
The unauthorized users must not be allowed to create the data in the create transactions if it contains any
masked field(for instance XD01, FK01, etc). For e.g. User can have an authorization to create new
Customer via SAP Transaction XD01 but user does not have authorization to access Bank Account
Number of the customer.
Specific masking scenarios delivered in the solution via standard program modifications will be covered in
the next slides.

2012 SAP AG. All rights reserved.

UI Field Level Security Special Consideration

1.

Bank Account Number (BANKN)

The

masking functionality is delivered for the Bank Account Number in the following scenarios:For Table- LFBK & KNBK; Field- BANKN, standard program modifications are delivered for SAP
Transactions XD02, XD03, MK02, MK03, FK02, FK03, XK02, XK03, FD02 & FD03 to mask/ hide the number
for unauthorized users.
For Table- LFBK, KNBK, TIBAN; Field- BANKN: The Bank Account Number is masked for unauthorized
users in SAP Transactions SE11, SE12, SE16, SE16N.
The column IBAN and IBAN Value will be hidden in Display and Edit mode for unauthorized users in SAP
Transactions XD02, XD03, MK02, MK03, FK02, FK03, XK02, XK03, FD02 & FD03.
An authorization will be required for Bank Account Number in the specified transactions to access the
unmasked IBAN value.

2012 SAP AG. All rights reserved.

UI Field Level Security Special Consideration

Note:

The data is masked in Display mode for unauthorized users but data column will be hidden in Edit
mode for Bank Account Number. This is applicable for mentioned SAP Transactions except SE11, SE12,
2012 SAPSE16N.
AG. All rights reserved.
SE16,

UI Field Level Security Special Consideration

2.

Credit Card Number (CCNUM)

The

masking functionality is delivered for the Credit Card Number in the following scenarios:For Table- VCNUM; Field- CCNUM: The Credit Card Number is masked for unauthorized users in SAP
Transactions XD02 & XD03. In Edit mode, Unmasked Card button is hidden for unauthorized users.
For Table- VCNUM, VCKUN; Field- CCNUM : The credit card number is masked for unauthorized users in
SAP Transactions SE11, SE12, SE16, SE16N.

Note: The data is masked in Display mode for unauthorized users but data column will be hidden in Edit
mode for Credit Card Number. This is applicable for mentioned SAP Transactions except SE11, SE12,
SE16, SE16N.
2012 SAP AG. All rights reserved.

UI Field Level Security - Special Consideration

3.

Korean Supplement (Tax Number STCD1)

In

SAP Transactions XD02, XD03, MK02, MK03, FK02 & FK03, Tax Number (STCD1 within Korean
Supplement) will be hidden for unauthorized users in Display and Edit mode.
In SAP Transactions BP & BUG2, Tax Number will be hidden in Edit mode and masked in Display mode
for unauthorized users.

2012 SAPTax
AG. AllNumber
rights reserved.
Note:
column

is hidden for unauthorized users.

UI Field Level Security - Special Consideration

4.

Communication Data

In

SAP Transactions XD02, XD03, MK02, MK03, FK02 & FK03, Preview button will be disabled for
unauthorized users in Display and Edit mode. The preview functionality will be disabled if any of the
following characteristics are active for masking:
o Name, City, Post Code, Street or Country.
In Edit mode, communication data such as Telephone Number, Email and Fax number will be hidden for
unauthorized users.

2012 SAP AG. All rights reserved.

UI Field Level Security - Conclusion

The customers masking field list MUST be analyzed to verify the technical feasibility of the solution. The
customer fields not covered within the technical feasibility will be considered as separate development
request for the customer.

2012 SAP AG. All rights reserved.

10

Thank You