implementing-a-read-protection-2a5524a.md

Implementing a Read Protection

Prevent unauthorized read access to the data exposed by your service using access control. For this purpose, you create an access control and then implement it for the CDS view on which your service is based.

Defining the Use of Access Control in the Data Definition

Context

For the data definitions that you want to protect, you need to define the use of access control.

Note:

If you’re using additional data definitions of type projection view, you need to define the use of an access control in them.

Procedure

1. Add the following line to the data definition of the interface:

   @AccessControl.authorizationCheck: #CHECK

   For more information, see Access Control Annotations in the documentation of the ABAP RESTful Application Programming Model.

2. If you’re using additional data definitions of type projection view, you also need to define the use of an access control in them.

Creating an Access Control

Context

Even if you have modeled necessary authorizations for your service by creating a new authorization object, the authorization object itself doesn’t protect your service from being accessed by a business user in the ABAP environment. Therefore, as a next step, you implement a read protection for your service. In our example, this means that business users should only be allowed to view bonus calculations whose bonus variant matches with the users' authorization. You implement a read protection using access control, which uses the authorization object that you created.

Procedure

1. Go to the core data service (CDS) view on which your service is based.

   You can find this CDS view under the data definitions of the core data services of your package.

2. To create an access control for the CDS view, follow the instructions of the ABAP CDS Development User Guide: Creating Access Controls and use the template Define Role with PFCG Aspect.

3. If you’re using additional data definitions of type projection view, you also need to create additional access controls for them using the template Define Role with Inherited Conditions.

Implementing the Access Control

Context

You must edit the access control code to implement access control for the CDS view on which your service is based. Access control is based on the authorization object that you created before.

Procedure

1. Choose the access control that you’ve created, which currently looks like the following:

   Sample Code:

   @EndUserText.label: '<your access control description>'
   @MappingRole: true
   define role <your access control name> {
       grant
           select
               on
                   ${cds_entity}
                       where
                           (${entity_element_1}, ${entity_element_2}) = aspect pfcg_auth(${authorization_object}, ${authorization_field_1}, ${authorization_field_2}, ${filter_field_1} = '${filter_value_1}');
   }

2. Adapt the code so that it grants access if the requesting business user has authorizations that contain authorization object ZBNSCLC_AO (Bonus Calculation) with allowed activity (ACTVT) 03 Display and bonus variant (ZBNS_VARNT) values that match the bonus variant (bonusvariant) of the existing bonus calculation:

   Sample Code:

   @EndUserText.label: 'Access Control for CDS Z_I_BONUS_CALCULATION'
   @MappingRole: true
   define role Z_I_BONUS_CALCULATION {
       grant 
           select
               on
                   z_i_bonus_calculation
                       where
                           (bonusvariant) = aspect pfcg_auth(ZBNSCLC_AO, ZBNS_VARNT, ACTVT = '03');
                           
   }

   In our example, cds_entity is the z_i_bonus_calculation CDS view.

3. If you’re using additional data definitions of type projection view, enhance the coding as follows:

   Sample Code:

   @EndUserText.label: '<your access control description>'
   @MappingRole: true
   define role <your access control name> {
       grant
           select
               on
                   <your projection view name>
                       where
                           inheriting conditions from entity z_i_bonus_calculation;
   }
   

Results

As a result, only business users with the corresponding authorizations get bonus calculations from the service, and they only get bonus calculations with allowed bonus variant values.