Dynamic data mask configurations

A mask is the format-string representation set up against the fields in a table. A mask configuration allows you to establish how to hide the data from unauthorized users. You can define the following available mask configurations:

• D—The Default mask is provided by the clients.
• N—The Null mask can be used for any data type.
• L—The Literal mask can be used for any data type except the RAW and LOGICAL data types if the defined mask is compatible with the underlying data type.
• P—The Partial mask allows data to be partially masked, leaving other parts unmasked. This mask supports only character data type.
  Note: The mask transformation must always result in the same datatype of value as the original. For example, a numeric value, such as 1234, cannot be converted to a non-numerical value, such as XXXX.

You can set up mask configurations using the methods available through the IDataAdminService interface. As long as the tables are in the PUB schema, these configurations apply to all fields of those tables, regardless of whether they are created with the ABL virtual machine (AVM) or SQL interfaces. However, for tables created using SQL interfaces, you can apply mask configurations to only those fields that have a corresponding ABL datatype, as shown in the following table:

ABL data type	OpenEdge SQL data type
CHARACTER	VARCHAR
DATE	DATE
DECIMAL	DECIMAL or NUMERIC
INTEGER	INTEGER
INT64	BIGINT
LOGICAL	BIT
RAW	VARBINARY
RECID	INTEGER
DATE-TIME	TIMESTAMP

Furthermore, tables created using SQL interfaces that are not part of the PUB schema are not visible to AVM. Therefore, creating masking configuration for fields in such tables is not possible. Similarly, you cannot mask the columns in the schema tables.