Understanding the Delivered External Authentication Solutions

PeopleSoft delivers the most common authentication solutions and packages them with our application for you to use. This saves you the trouble of developing your own solutions and saves you time with your security implementation.

Note:

The traditional method, where the user submits signon credentials that the system compares to a row in the PSOPRDEFN table, is a valid means of authentication; however, it is not a recommended method for increased scalability and manageability as you deploy applications to the internet.

The authentication solutions are delivered PeopleCode programs that you can include in your Signon PeopleCode. The following table describes each function that appears on the Signon PeopleCode page:

Function Exec Auth Fail Description

WWW_Authentication

Not Required

Applies when you want the browser to pass the client certificate to the web server for authentication by mutual authentication Secure Sockets Layer/Transport Layer Security (SSL/TLS) at the web server level (also known as client authentication). In this situation, you configure PeopleSoft to "trust" the authentication performed by a third-party system at the web server.

The function performs the following:

  1. Extracts the user’s distinguished name (DN) from the client certificate passed to the application server by the HTTP server.

  2. Sets a global variable to the DN for a subsequent call to the LDAP_ProfileSynch function.

  3. Converts the DN to a PeopleSoft user ID and sets the current user context.

LDAP_Authentication

Required

Applies when you want the user to submit signon credentials at the signon page, and then the system passes the credentials to the directory to perform authentication.

This function performs the following:

  1. Searches the directory for all entries that match the entered user name.

  2. Attempts to bind to the directory for each found DN using the entered password.

  3. Sets a global variable to the bound DN for a subsequent call to LDAP_ProfileSynch.

  4. Converts the DN to the appropriate PeopleSoft Username and sets the current user context.

SSO_Authentication

Not Required

Applies in situations where you have single signon configured. The system authenticates the user's single signon token, which has already been issued by another database (node).

This function performs the following:

  1. Converts the PeopleSoft User ID to a DN.

  2. Sets a global variable for a subsequent call to LDAP_ProfileSynch.

LDAP_ProfileSynch

Not Required

Applies in situations where PeopleSoft user profiles need to be created or updated with data stored in an LDAP directory. The function requires that the global variable &global_DN has been initialized by one of the previous authentication functions.

Remember that regardless of how a user is authenticated, each user populates a row in PSOPRDEFN to which applications can refer during transactions (if necessary). The LDAP_ProfileSynch updates that row in PSOPRDEFN (or user profile cache) with the most current information.

As delivered, this function performs the following:

  1. Retrieves the LDAP entry specified by &global_DN.

  2. Either creates or updates the corresponding PeopleSoft user profile.

Note: One of the XXX_Authentication functions needs to be carried out prior to running LDAP_ProfileSynch. PeopleSoft provides disabled example Signon PeopleCode with this function. If you work with the NDS, Active Planet, or iPlanet directories, you can use this Signon PeopleCode to assign roles dynamically at sign-on time.

See LDAP_ProfileSynch Considerations.

When using any of the delivered external authentication solutions, the following items apply:

  • All functions get the LDAP server configuration from specifications in PeopleTools, and then Security, and then Directory, and then Configure LDAP Directories.

  • All functions support a single database—multiple databases are not required.

This section discusses:

  • WWW_Authentication considerations.

  • LDAP_Authentication considerations.

  • SSO_Authentication considerations.

  • LDAP_ProfileSynch considerations.