Working With the Tuxedo TM_CPAU Setting

For PeopleSoft systems, the Oracle ProcMGR service (tuxipc.exe) is responsible for starting Tuxedo domain processes on Windows. By default, domain processes run as the same user ID that the service is running as. In a default installation, the service is configured to log on to Windows as the Local System user. Microsoft does not support assigning network privileges to the Local System user for security reasons, but the Local System user otherwise has full administrative access to the local system.

In this configuration, PeopleTools domain processes also run as the Local System user, which presents several potential issues, including:

  • PeopleTools domain processes are unable to access network resources.

  • PeopleTools domain processes run with more privileges than are necessary. A compromised PeopleTools process will have full access to the local system and could potentially be used to gain unauthorized access to the local system.

  • All PeopleTools domain processes on the system run as the same user ID

These problems are not present on UNIX systems where domain processes are always started as the user that runs tmadmin (by way of PSADMIN for PeopleSoft installations) to boot the domain. UNIX systems therefore support multiple domains, each running under different user IDs, with only the desired local privileges, and with no undesirable restrictions to network resources.

For Windows platforms, you can use the Oracle Tuxedo TM_CPAU (Create Process As User) environment variable to achieve behavior similar to UNIX systems. If TM_CPAU is set to YES before tuxipc is started, tuxipc creates an Oracle Tuxedo process that belongs to the user who initiated tmboot. If tuxipc boots as a service, go to Start, Control Panel, System, Advanced, Environment Variables and set system variable TM_CPAU =YES on the dialog box and reboot the Oracle ProcMGR service. If the Oracle ProcMGR service (tuxipc.exe) is started with the TM_CPAU=YES environment variable set, then domain processes will run as the user ID used to run tmadmin (PSADMIN) to boot the domain.

Using the TM_CPAU environment variable enables a variety of configuration options, including:

  • The ProcMGR service can be run as the Local System user, but domain processes can be run using a minimally privileged user. This reduces the chance of a compromised PeopleTools process being used to gain unauthorized access to the system.

  • The ProcMGR service can be configured to log on to Windows using a minimally privileged user ID and PeopleTools processes can run as a user with more privileges than the Tuxedo user ID. For example, the Tuxedo user ID could have read-only access to PS_CFG_HOME, but the PeopleTools user could have read-write access. The Tuxedo user ID does not actually require read-access to PS_HOME. When CreateProcessAsUser runs, access to the executable to start is evaluated using the user ID that the process will run as.

  • A single Windows system can be used to host multiple PeopleTools installations that are each administered by a different user. A non-administrative user ID used to boot one domain will have no privileges to processes started with a different user ID.

  • Domain processes can be identified and managed in Windows Task Manager by a non-administrative user.

For more information, see Oracle Tuxedo documentation: "File Formats, Data Descriptions, MIBs, and System Processes Reference."