Understanding Service Security

PeopleSoft Related Content Framework uses the basic PeopleTools security model, which secures local and remote PeopleSoft transaction pages and the application data that underlies these pages based on the user's assigned permission lists and roles.

For services that provide access to non-PeopleSoft content, the framework enables you to use the security model of the content provider. You should consult the content provider and your security administrator to determine the best course of action.

PeopleSoft Security Authorization Web Service

The PeopleSoft security authorization web service runs on PeopleSoft systems and certain service consumer systems such as Oracle WebCenter. The service examines the basic PeopleTools security on the providing system and can respond to a web service call from another PeopleSoft system.

The PeopleSoft Related Content Framework uses the authorization service in these two ways:

• To show and hide related content links that access PeopleSoft content.

• To grant access to third-party systems, such as Oracle WebCenter that contain PeopleSoft content.

The authorization service can check for basic PeopleTools security at the definition level and at the data, or row, level.

At the definition level, the authorization service response determines whether related content or related actions links to PeopleSoft content appear for the user. This level of authorization is automatically engaged for any PeopleSoft content, and no other configuration is required beyond basic PeopleTools security setup.

However, row-level, or data permission, security is not automatic. Use the Authorization Configuration component to configure the authorization service to implement row-level security on remote systems. When the user has the appropriate permissions to view the content, then the authorization service determines whether data, or row-level security has been configured. If any such configurations exist, then the appropriate data is returned when the user clicks the related content or related actions link to access the data. Procedures for configuration of the security authorization service are covered elsewhere.

See Security Administration: Understanding Developing and Invoking the Security Authorization Service.

Service Definition Security Options

At design time, you select which security options will be available when the service is assigned and configured for an application page. You can select one or more options to make available to the subject matter expert who assigns the service to a content reference. During the service configuration process, he or she selects the security option to be in effect when the service is accessed from a specific application page; therefore, a different security could be selected for use with a different application page. Before you allow a security option for a service, you should understand the service’s security model.

Important:

If you allow a security option for a service definition that isn't applicable or hasn’t actually been implemented by the service itself, unexpected results can occur.

The framework offers four security options.

• Public access.

• Related content provider security.

• Related content consumer security.

• App class required.

Important:

The security authorization web service is called for all PeopleSoft content regardless of the option that you select; however, the service is not called for non-PeopleSoft content.

Public Access

The Public Access security option provides access to the service based on the permissions of the public user that you specify in the web profile. The Public Access option is intended for use with services that require few parameters, such as a generic help policy or an internet search engine.

Components that use basic PeopleTools security, which provides authorization and access through permission lists and roles, are not public. If you select the Public Access option for a PeopleSoft component service definition, users must have access to the PeopleSoft component associated with the service.

See “Public Users” in Configuring Portal Security.

See Security Administration: Setting Page Permissions.

Related Content Provider Security

Some content providers offer complex and industry-specific security models and mechanisms that are native to the service. The Related Content Provider Security option is intended for use with services that implement security that is specific to their data model or the content that they provide.

As an example, consider the Compensation Details component in Payroll as the producer and the Employee component in an HCM environment as the consumer. If you select Related Content Provider Security, then the provider system (Compensation Details/Payroll) must provide the security.

As another example, the Related Discussion service of PeopleSoft Interaction Hub implements both provider security and consumer security. When provider security is selected, then the security model of the PeopleSoft Interaction Hub discussion forums is used, which means that the forum moderator is responsible for adding members and privileges for access to the forum.

Related Content Consumer Security

PeopleSoft applications use basic PeopleTools security, which provides authorization and access to the many elements of your PeopleSoft application through the assignment of permission lists and roles to users. The Related Content Consumer Security option is intended for use with services that rely on the basic PeopleTools for authorizing access to the service content, for example:

• PeopleSoft component, embeddable pagelet, OBIEE pagelet, PeopleSoft query, and PeopleSoft iScript services that access remote PeopleSoft nodes.

• Oracle WebCenter services that create group spaces linked to PeopleSoft transaction pages. The WebCenter maintains the group space security, but authorization and access are based on the permissions of the PeopleSoft transaction page.

For example, consider the Compensation Details component in Payroll as the producer and the Employee component in HCM as the consumer. If you select Related Content Consumer Security, then the consumer system (Employee/HCM) must provide the security. Therefore, the provider system (Compensation/Payroll) creates an authorization request to the consumer (Employee/HCM), which responds with the authorization details for that user.

App Class Required

Important:

Service filters are desupported and this option is retained for backward compatibility only. Do not select this option for new service definitions.

When selected, this option indicates that a service filter is required when this service is assigned to an application page.