Preventing Unauthorized Access to Data

Define an authorization object to control access to the employee and department data based on the related department (suggested name: Z##DPMENT, where ## is your group number). Define the authorization object with two authorization fields: a new authorization field (suggested name: Z##DPMNT) that is based on your data element for the department ID (suggested name was: Z##_DEPARTMENT_ID), and the standard authorization field ACTVT with the default permitted activities.

1. Create an authorization field based on the data element for the department ID (suggested name: Z##DEPMENT).

   1. In the Project Explorer, right-click your package to open the context menu and choose New → Other ABAP Repository Object.

   2. In the filter field, enter au and choose Authorization Field from the suggestion list.

   3. Enter Z##DPMNT as Name and Z##_DEPARTMENT_ID as Data Element. Then choose Next.

   4. Confirm the transport request and choose Finish.

2. Set your database table for department data as check table (suggested name was: Z##DEPMENT) and save the authorization field.

   Note

   If your authorization field is based on the /LRN/DEPARTMENT_ID data element, you have to use the database table /LRN/DEPMENT_REL.

   1. Place the cursor in theCheck Table field, enter Z## and press Ctrl + Space to open a value help.

   2. From the value help, choose Z##DEPMENT.

   3. Press Ctrl + S to save the authorization field.

3. Create a new authorization object and assign the authorization field to it.

   1. In the definition of the authorization field, scroll down to the What's next? section and choose Create a new Authorization Object and assign the Authorization Field to it.

   2. Enter Z##DPMNT as Name and Authorization per department as Description, then choose Next.

   3. Confirm the transport request and choose Finish.

4. Confirm that the new authorization object contains the standard authorization field ACTVT and the default permitted activities.

   1. Inspect the Authorization Fields section which should contain your own authorization field and the default authorization field ACTVT.

   2. Inspect the Permitted Activities section which should contain the four default activities.

5. Save the authorization object.

   1. Press Ctrl + S to save the authorization object.

Define access controls for your base view entities, that is, the base view entity for department data (suggested name was: Z##_R_Department) and the base view entity for employee data (suggested name was: Z##_R_Employee). Use a template that allows you to control the access based on the authorization object you just created.

1. Open your base view entity for department data in the Data Preview tool.

   1. Open the definition of the view entity and press F8 to open the Data Preview tool.

2. For this view entity create a CDS access control that defines a CDS role with a PFCG condition.

   1. In the Project Explorer, locate your CDS data definition Z##_R_DEPARTMENT.

   2. Right-click the data definition to open the context menu and choose New Access Control.

   3. Copy the name from the Protected Entity field to the Name field.

   4. In the Description field, enter Department (Access Control), then choose Next.

   5. Confirm the transport request and choose Next.

   6. From the list of Templates, choose Define Role with PFCG Aspect, and choose Finish.

3. In the generated code, reference your authorization object.

   1. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      123456789101112
      
       define role Z##_R_DEPARTMENT 
      {
        grant select on Z##_R_Department
        where (entity_element_1, entity_element_2) 
            = aspect pfcg_auth(, 
                        authorization_field_1, 
                        authorization_field_2, 
                        filter_field_1 = 'filter_value_1'
                     );                        
      }
      

      Note

      We introduced additional line-breaks to increase readability in printed training material.

4. Replace the first placeholder for authorization fields with the name of your authorization field. Then remove the second placeholder.

   1. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      1234567891011
      
       define role Z##_R_DEPARTMENT
      {
        grant select on Z##_R_Department
        where (entity_element_1, entity_element_2) 
            = aspect pfcg_auth(
                        Z##DPMNT,, 
                        filter_field_1 = 'filter_value_1'
                     );                        
      }
      

5. Use the ACTVT authorization field as a filter field and supply it with the filter value for activity Display.

   1. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      1234567891011
      
       define role Z##_R_DEPARTMENT 
      {
        grant select on Z##_R_Department
        where (entity_element_1, entity_element_2) 
            = aspect pfcg_auth(
                        Z##DPMNT, 
                        Z##DPMNT, 
                     );                        
      }
      

6. Reference a suitable entity element to supply the first authorization field. Then remove the placeholder for a second view element.

   1. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      123456789101112
      
       define role Z##_R_DEPARTMENT 
      {
        grant select on Z##_R_Department
        where (  ) 
            = aspect pfcg_auth(
                        Z##DPMNT, 
                        Z##DPMNT, 
                        ACTVT = '03'
                     );                        
      }
      

7. Activate the access control and refresh the display in the Data Preview tool.

   1. Press Ctrl + F3 to activate the development object.

   2. Return to the Data Preview for the protected entity and choose Refresh.

   3. Alternatively, you can press F5 to refresh the displayed data.

8. To see at least some data, edit the CDS access control again and replace your own authorization object Z##DPMNT with the solution object /LRN/DPMNT and your own authorization field Z##DPMNT with the authorization field /LRN/DPMNT. For this authorization object your user already has some authorizations.

   1. Return to the source code of your CDS access control.

   2. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      12345678910
      
       define role Z##_R_DEPARTMENT 
      {
        grant select on Z##_R_Department
        where (  ) 
            = aspect pfcg_auth( 
                        ACTVT = '03'
                     );                        
      }
      

   3. Activate the access control and refresh the display in the Data Preview tool.

9. In the same way, create a CDS access control for your base view entity for employee data.

   1. In the project explorer, locate your CDS data definition Z##_R_EMPLOYEE.

   2. Right-click the data definition to open the context menu and choose New Access Control.

   3. Copy the name from the Protected Entity field to the Name field.

   4. In the Description field, enter Employee (Access Control), then choose Next.

   5. Confirm the transport request and choose Next.

   6. From the list of Templates, choose Define Role with PFCG Aspect, and choose Finish.

   7. Adjust the generated code as follows:

      Code snippet

      Copy code

      Expand

10. Activate the access control.

    1. Press Ctrl + F3 to activate the development object.

Define an access control for the view entity with which you query employee data based on two input parameters (suggested name was: Z##_C_EmployeeQueryP). In the same way, define an access control for your view entity with which you query and employee data per department (suggested name was: Z##_C_DepartmentQuery). In both cases, use a template that allows you to inherit the authorization rules from the underlying view entities.

1. Open the definition of your CDS view entity that queries employee data based on two input parameters.

   1. Press Ctrl + Shift + A.

   2. Enter the name of the CDS data definition that you want to open, that is Z##_C_EMPLOYEEQUERYP, and choose OK.

2. For the view entity with parameters, create a CDS access control that defines a CDS role with inherited conditions.

   1. In the Project Explorer, locate your CDS data definition Z##_C_EMPLOYEEQUERYP.

   2. Right-click the data definition to open the context menu and choose New Access Control.

   3. Copy the name from the Protected Entity field to the Name field.

   4. In the Description field, enter Employee Query (Access Control), then choose Next.

   5. Confirm the transport request and choose Next.

   6. From the list of Templates, choose Define Role with Inherited Conditions, and choose Finish.

3. In the generated code, reference the view entity the protected entity uses as data source, that is, Z##_R_Employee.

   1. Adjust the code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      1234567
      
       define role Z##_C_EMPLOYEEQUERYP {
        grant select on Z##_C_EmployeeQueryP
        where inheriting conditions 
         from entity ;
      }
      

4. Activate the access control.

   1. Press Ctrl + F3 to activate the development object.

5. Open the definition of your CDS view entity that aggregates employee data per department.

   1. Press Ctrl + Shift + A.

   2. Enter the name of the CDS data definition that you want to open, that is Z##_C_DEPARTMENTQUERY, and choose OK.

6. Define an access control that inherits the access conditions from the primary data source.

   1. In the Project Explorer, locate your CDS data definition Z##_C_DEPARTMENTQUERY.

   2. Right-click the data definition to open the context menu and choose New Access Control.

   3. Copy the name from the Protected Entity field to the Name field.

   4. In the Description field, enter Department Query (Access Control), then choose Next.

   5. Confirm the transport request and choose Next.

   6. From the list of Templates, choose Define Role with Inherited Conditions, and choose Finish.

   7. Adjust the generated code as follows:

      Code Snippet

      Copy code

      Copy code

      Switch to dark mode

      Switch to dark mode

      1234567
      
       define role Z##_C_DEPARTMENTQUERY {
        grant select on Z##_C_DepartmentQuery
        where inheriting conditions 
         from entity ;
      }
      

7. Activate the access control.

   1. Press Ctrl + F3 to activate the development object.