You are here: Security > Application Security > Masking

Masking

A mask allows the configuror to hide all or part of a text field's value from view in OIPA. Here are the high level steps involved in setting up and applying a mask.

Define the mask security levels in AsCode. Open Admin Explorer | Administration | AsCode and scroll to AsCodeMaskSecurityLevel. Check out this file to add or revise mask security levels. These security levels must be defined before a mask can be created.
Create Mask in Mask editor. Open Admin Explorer | Administration | Masks. Right-click on the Masks folder and select New Mask Detail. Enter the mask details.
Create a transaction (or open an existing transaction). In the Fields pane, click on the text field to mask. The Field Properties Window will open. The last property listed is the mask property. Select a mask format. These formats are defined in the AsMaskDetail table and can be edited in the Mask editor in the Admin Explorer.
Add security to Mask. Open Admin Explorer | Security | Application Security | Security Groups. Open the Security Group folder and drill down to the Transaction Security folder. Open it and select the transaction. When it opens in the Configuration Area, scroll to the bottom of the screen to the Mask section and select a level of Mask security. These levels are saved in AsCodeMaskSecurityLevel and can be edited through the AsCode editor in the Admin Explorer.

Note: Math variables that hold the value of a secured field will not secure the value on the activity results Math tab.

Note: Any OnChange configured for secured fields that are disabled will not be able to enable the field. This overrides the security on the field. When security disables a field there is no way to enable that field via configuration.

Mask Formats

There are two parts to a mask. First an input format must be defined. This is used to validate what a user enters in OIPA. The input must be a regular expression. The regular expression will validate the type of characters and the number of characters entered in OIPA. The regular expression also defines how the input characters are grouped.

Next, an output format must be defined to tell OIPA how to display the input by the defined groups and supplied characters such as hyphens, parenthesis, etc.

Example: Phone number with masking

Input format: (\d{3})(\d{3})(\d{4})

Output format: ($1) $2-$3

Each input group is surrounded by a pair of paranthesis. In the example above there are three groups:

group one: (\d{3}) /d indicates numeric characters. {3} indicates the number of characters. (\d{3}) is one group and because it is first in the definition it is assigned to $1.
group two: (\d{3}) /d indicates numeric characters. {3} indicates the number of characters. (\d{3}) is one group and because it is second in the definition it is assigned to $2.
group three: (\d{4}) /d indicates numeric characters. {4} indicates the number of characters. (\d{4}) is one group and because it is third in the definition it is assigned to $3.

The output format shows that group one should be displayed inside a pair of parenthesis with a space before group two and a hyphen between group two and group three.

In total 10 digits are expected in the input with no additional format characters (hyphens, parenthesis, etc.) allowed in the entered data. A system error displays if any alpha character is entered or the incorrect number of characters is entered. The output format defines, by group, how to re-display the input. In this case they are displayed in the order they were input. That does not have to be so. The output format can mix up the groups as desired. The parenthesis, the hyphen and the space are added to create this format. With this definition the valid entry of 1234567890 becomes (123) 456-7890. If the output format was defined like this, $1-$2-$3, the re-display would be 123-456-7890 ($1.$2.$3 would be 123.456.7890).

Example: SSN with masking

Input format: (\d{3})(\d{2})(\d{4})

Output format: ***-**-$3

This demonstrates replacement of input characters. Entry of 123456789 becomes ***-**-6789.

Example: Entire value is hidden

Input format: (\d{3})(\d{2})(\d{4}

Output format: ***

This demonstrates replacement of all input characters. Entry of 123456789 becomes ***.