Understanding Signon PeopleCode Permissions

Signon PeopleCode scripts run with full permissions of the user they’re invoked as. This includes access to the database using Structured Query Language (SQL), access to the file system, business interlinks, component interfaces application messaging, and so on. A developer could conceivably write a Signon PeopleCode program that exposed or corrupted sensitive information. To minimize this risk, you should follow these guidelines:

• You should limit access to the Signon PeopleCode setup page to trusted administrators only.

  This will prevent people from configuring un-trusted PeopleCode programs to run at sign-on time.

• If you aren’t implementing external authentication at your site (all your users are authenticated based on an existing user ID and password with the PeopleSoft database), you should not have the “Exec Auth Fail” column selected for any Signon PeopleCode scripts.

• After a trusted administrator configures the list of functions that should run at sign-on time, you should use Object Security to restrict access to the record objects that contain the programs.

  Only trusted developers should be allowed to modify the PeopleCode on these records.

• Even for trusted developers, it is a good idea to have a second person review the code before testing and moving to production.

• No developer or administrator should have access to the Signon PeopleCode setup page, or the records that contain the Signon PeopleCode functions in a production system.

Note:

The password that the user types on the signon page is never visible to the Signon PeopleCode developer. It is impossible to write a script that captures a password entered by a user, and store it in a file or database table.