QAS Security Flow

This diagram illustrates the QAS request inbound flow from a third-party system in the Integration Broker

QAS request from a third-party security flow

When any transaction arrives at the integration gateway, the PeopleSoft system checks for the existence of a WS-Security SOAP header. If it exists, the integration gateway validates the digital signature if it exists, and decrypts the UsernameToken and optional password to restore the user ID information to clear text format. The integration gateway then passes the user ID information, and UsernameToken password if provided by the sender, to the application server, where additional security processing is performed.

If a user name and password are supplied in the SOAP header, the user is validated in the PeopleSoft system.

If no user ID and password are supplied, the request is rejected.

The PeopleSoft system then validates whether the user's permission list grants access to the QAS service operation.

If the user is authorized to the service operation, then Query Access security is used and the request is processed.