Understanding User Authentication

Access to invoke service operations is enforced at the user level.

When integrating with other PeopleSoft systems, user authentication determines the user ID to set on outbound integrations. The receiving system extracts this information and uses the user ID to validate against the permission list to which a service operation is assigned. If the user ID is assigned to the permission list, the sender can invoke the service operation.

When using Integration Broker for integrations among PeopleSoft systems, you must implement single signon and set up remote/target nodes as trusted nodes for user authentication to be validated. See Security Administration: Implementing PeopleSoft-Only Single Signon for more information about implementing single signon and defining trusted nodes in the database.

Note:

User authentication can be implemented on PeopleTools 8.48 and later systems only.

User IDs

The PeopleSoft system can use the following methods to set the user ID in an outbound transaction:

Term	Definition
Authentication Token	When the node is a PeopleSoft (PIA) node type, the PeopleSoft system automatically generates an authentication token and includes the token in the outbound transaction. The authentication token sets the user ID in the outbound transaction to the user ID that created the service operation.
Default User ID	The Node Definition page contains a Default User ID field. This is the user ID to which the node defaults, when no other user ID described in this section is set.
External Name/External Password	You can programmatically set an external name and external password in the outbound SOAP message header or query string.
External User ID/Password	The Node Definitions page contains an External User ID and an External Password field. These fields are used in conjunction with WS-Security and are used for user authentication and to set the UsernameToken credentials for WS-Security processing. The External Password value is optional.

On inbound integrations from a PeopleSoft node, the PeopleSoft system looks for a user ID to associate with the permission list set for a service operation in the following order.

1. Authentication token.

2. Default User ID.

On inbound integrations not from a PeopleSoft node (External nodes and third-party systems), the PeopleSoft system looks for a user ID to associate with the permission list set for a service operation in the following order.

1. External Name/External Password.

2. External User ID/External Password.

3. Default User ID.