Obfuscation on SAP User Interfaces

[Former Member]

Can anyone provide me with information on how to implement display-only obfuscation for both SAP GUI for Windows and SAP Enterprise Portal? For example, when a SSN is displayed, on an ESS screen in the portal, display it as "XXX-XX-9999".

[Former Member]

In ABAP you can simply use:

screen-invisible = 1

... or use a global constant typed to the field(s) with a value set to '************' which will then always be displayed.

If you want a part to be visible then just concatenate that part with the invisible part or use a subsequent field.

Not sure how the JAVA folks do it, but the search term "MASK" should be helpfull in the SDN Java or portal forums.

In the ABAP and Java programmers security guides on service.sap.com/securityguides there are some code snippets as well. They relate to passwords if I remember correctly but would work generally for UI programming.

Cheers,

Julius

[Former Member]

As far as I know this is an application feature that you cannot retrofit. So if you control the application, you should be fine; otherwise I suspect you have a problem. (You might get away with implicit enhancements, but feasibility would have to be evaluated for each individual screen/transaction.)

A good starting point might be for you to look at the payment card encryption solution in SAP. The solution consists of two steps, one part is the encryption, which it sounds you're not looking for. However, another part is to utilize authorization checks for figuring out what the user actually sees (masked value or full data). This is a nice approach if some users actually need to see the full data.