How to hide user id fetched from userapi in odata service request

[SaurabhN]

Hi,

I am using SAP BTP Portal service to display SAP UI5 applications on SAP Fiori launchpad sites.

External users (no access to SAP GUI) are accessing launchpad through P-user id (P00000) which comes from a custom IDP.

I fetch logged in external user's uid from userapi (/services/userapi/attributes).

External user (P-user ID) details are already loaded in a customizing table on SAP system.

Following is the OData service request parameters:

How do i hide the user id parameter for security reason in both Neo and Cloud foundry environment?

Kindly suggest a way to handle the above mentioned scenario.

Thank you.

[gregorw]

How is the destination to your backend system configured? Is it using Basic Auth with a technical user or is it using principal propagation?

[SaurabhN]

Hi Gregor,

It is Basic Authentication with a technical user.

[gregorw]

When you can't create the users also in the backend and use principal propagation you have to create a middleware on SAP BTP so that the filter based on the User ID is added there and hidden from the user.

With a basic auth destination acessible from a UI5 app you give every authenticated user the option to read all data because they can modify the filter options.

[SaurabhN]

Can SAP API management be used as middleware?