Understanding the Web Server Security Exit

Part of the integration technology PeopleSoft delivers is to ensure that our security or authentication system is open and flexible. Because the PeopleSoft applications are now designed for internet deployment, many sites must take advantage of the authentication services that exist at the web server level.

Note:

The exits described here are offered in addition to the Signon PeopleCode running on the application server, which itself provides integration. There are no PeopleSoft user ("psuser") exits on the application server; Signon PeopleCode replaces that functionality. On the client side, the functionality is the same as previous releases. You should use Signon PeopleCode when developing new signon integration. The topics in this section support previous implementations.

This section describes a procedure that enables you to configure your implementation so that PeopleTools authentication logic "trusts" the authentication performed at the web server level. The following list presents examples of some of the third-party authentication technologies with which you may want to integrate:

  • Web single signon or authorization or authentication solutions.

  • Client-side SSL/TLS authentication provided by web servers.

  • Public Key Infrastructures, either stand-alone or embedded as part of the network operating system environment.

Note:

The previous list is not a list of certified integration points, just examples of authentication technologies that exist in the industry.

For the web server exit configuration to work successfully, the following assumptions should be true:

  • You want to authenticate the user at the web server level only, not within the PeopleSoft application server.

    (The configuration discussed in this section enables you to authenticate users within the web server instead of the default configuration, where the application server controls the authentication logic.)

  • Your web server environment includes a mechanism to identify and authenticate a user.

    This may be through a sign in page with a user ID and password, through a digital certificate, or through one of several industry-standard authentication methods.

  • Your web server has the capability of passing the user ID to the application server through the HTTP request PeopleCode object.

    For this you can use an HTTP header variable, a cookie, or a form field.

Note:

Configuring the following authentication system is not a delivered feature. It requires development outside of your PeopleSoft application, and because of that, you should have the appropriate level of internet development expertise to make sure that you are passing the appropriate information to the PeopleSoft system.