Setting Up the PeopleSoft Environment to Use SAML 2.0

This section includes the tasks required to set up the PeopleSoft environment for using SAML 2.0 for Single Sign-on.

This section assumes that the PeopleSoft environment includes running application server, web server (PIA), and Process Scheduler.

In addition to the configuration steps described here, you must obtain certificates and private keys.

Copying the Application Package (Optional)

If you want to design functionality around returned parameters within the SAML 2.0 response, you can customize the delivered application package.

  1. Sign in to Application Designer.
  2. Copy the delivered package PT_SAML_TEMPLATE.
  3. Save the package with a different name that includes SAML.

Deriving the Required URLs

Locate the PORTAL and NODE values in the PeopleSoft environment URLs. The values are used to compose the URLs for the SAML ACS and SAML Request.

To locate the information:

  1. Sign into your PeopleSoft environment.
  2. Copy the URL from the browser address bar.

    For example, in this URL, the PORTAL is EMPLOYEE and the NODE is PSFT_HR.

    http://server.example.com:8000/psp/ps/EMPLOYEE/PSFT_HR/c/MAINTAIN_SECURITY.USERMAINT.GBL

  3. To construct the SAML ACS URL, use this format, substituting the values for PORTAL and NODE from the previous step.

    http://<Server>:<Port>/psc/ps/<PORTAL>/<NODE>/s/WEBLIB_PT_SAML.ISCRIPT1.FieldFormula.IScript_ACS.IScript

  4. To construct the SAML Request (SP-Init) URL, use this format, substituting the values for PORTAL and NODE from step 2.

    http://<Server>:<Port>/psc/ps/<PORTAL>/<NODE>/s/WEBLIB_PT_SAML.ISCRIPT1.FieldFormula.IScript_GenerateRequest.IScript

See Portal Technology: Portal URL Formats.

Configuring User Profiles, Signon PeopleCode, and Web Profile

  1. Sign into PIA using an OPRID with Security Administrator permissions.
  2. Select PeopleTools, then Security, then User Profiles, and then User Profiles.
  3. Add a user ID to be used as the Web Profile Access ID.

    The User ID Must begin with SAML_ or contain _SAML.

    Traces may be produced under this ID.

  4. Set these attributes for the user ID and then save.
    • Enter a Symbolic ID.
    • Enter a password.
    • On the ID tab, select None for ID Type.
    • On the Role tab, add SAML Guest.
  5. Select PeopleTools, then Security, then User Profiles, and then User Profiles.
  6. Choose an OPRID for the user that you want to ultimately sign on as when the SAML signon process is complete.

    On the General tab, select Edit Email Addresses. Ensure that the Primary Email Id matches the email ID that will be registered on the IdP user account.

  7. Select PeopleTools, then Security, then Security Objects, and then Signon PeopleCode.
  8. For all existing Signon PeopleCode, clear the option for Exec Auth Fail.
  9. Add a new row for record PT_FUNCLIB_SAML (PT_FUNCLIB_SAML.PT_SAMLAUTH.FieldDefault Signon_SAML).
  10. Select the option for Exec Auth Fail for PT_FUNCLIB_SAML.
  11. Select PeopleTools, then Web Profile, then Web Profile, and then Web Profile Configuration, and choose your web profile.
  12. Select the Security tab.
  13. Select Enable Public Access.
  14. Set the OPRID password for the SAML guest user from step 4.

See Implementing PeopleSoft-Only Single Signon

.

Adding Encryption Algorithm Keyset

  1. Select PeopleTools, then Security, and then Encryption Algorithm Keysets.
  2. Modify aes_ks256_cbc_encrypt.
  3. Add a Keyset ID containing SAML in the name.
  4. Select Use Entered Value, and provide a hex encoded key (0x + 64 HEX(0-9,A-Z,a-z) chars).

    You will get guidance errors if the value, format, or length is incorrect.

  5. Modify aes_ks256_cbc_decrypt.
  6. Select Use Entered Value, and add a Keyset ID using the same name as that given for aes_ks256_cbc_encrypt.
  7. Add exactly the same hex encoded key value as that given for aes_ks256_cbc_encrypt.

See Understanding the Supported Algorithms and Defining Algorithm Keysets.