Configuring Portal Security

Access the Web Profile Configuration page. (Select PeopleTools, and then Web Profile, and then Web Profile Configuration. Select the Security tab.)

This example illustrates the fields and controls on the Web Profile Configuration - Security page. You can find definitions for the fields and controls later on this page.

Field or Control	Description
Days to Autofill User ID	If this field is populated, the system caches the user ID and automatically inserts it on the sign-in page. This a convenience for users. This feature is implemented through the use of a stored cookie on the browser. The default value is 7 days. Specify a value of 0 to disable this feature. Use 0 in a public area or kiosk situation, or if your security policy doesn't allow cookies stored on the browser.
View File Time to Live	Specify, in seconds, how long the portal should wait after sending a file attachment to a user's browser before removing that file from the web server storage. If this value is 0, then the amount of time that the file remains on the web server is always greater than or equal to one minute. The specific amount of time beyond one minute depends on the size of the file. If the value is greater than 0, then the amount of time that the file remains on the web server depends, approximately, only on the value of that property in seconds. The default value is 0.
PIA use HTTP Same Server (PeopleSoft Pure Internet Architecture use HTTP same server)	Select to specify that the portal should use the HTTP protocol instead of HTTPS for requests that are issued by the portal for content that is hosted on the same server as the portal servlet. Setting this property is necessary when the portal web server is behind an SSL accelerator or when SSL is terminated on a device in front of the portal web server, such as a reverse proxy server, or between different sites that are on the same web server. You can also use this property to improve the performance of homepage pagelets that are provided by the PeopleSoft Pure Internet Architecture servlet that run on the same web server as the portal, and from which the web server receives SSL requests. That is, SSL has not been terminated by a device in front of the web server. You must also specify the default addressing protocol and port on the Web Profile Configuration - Virtual Addressing page. See Using SSL Accelerators.
Allow Unregistered Content	Select to instruct the portal to serve both registered and unregistered content. The portal generally allows any external content links to be wrapped with the portal header and navigation frames. Deselecting this option prevents content references from being displayed in the portal unless they are explicitly registered. This check box is not selected by default. Note: If Allow Unregistered Content is not selected, the portal won't wrap a content link if it is not registered in the portal registry or if it isn't coming from a registered node. The portal checks whether the content link is from a registered node by checking whether the content link starts with the URI specified in the Content URI Text or the Portal URI Text in the Node Definition page, on the Portal tab. For security purposes, the portal checks only against the Content URI Text and Portal URI Text if it contains text that is longer than 12 characters.

SSL (Secure Sockets Layer)

Field or Control	Description
Secured Access Only	Select to enforce SSL if the entire website requires the SSL protocol. This prevents users from using non-SSL protocols to access any link within this website or application. If only some pages require SSL access, deselect this check box (the default setting).
Secure Cookie with SSL	Select to prevent the single sign on token from traveling over an insecure network. If you select this check box and the scheme of the current request is HTTPS (an SSL server), the system sets the secure attribute of the single sign on cookie (PS_TOKEN) to True. PeopleSoft single sign on functionality also applies at the web server level. For example, suppose that you have two web servers: server X and server Y. Web server X is an SSL site, and web server Y is not. In these situations, many sites want server Y to trust the authentication token, PS_TOKEN, issued by server X. This requires that you set the PS_TOKEN to be secure. If the PS_TOKEN is not secure, when a user signs in through server Y, the browser sends PS_TOKEN to server Y over the unencrypted, non-SSL link. This is typical behavior for browsers when dealing with cookies that aren't secure. Potentially, in this situation, a hacker could obtain this token from the clear network and use it to sign in to the SSL-secure server X. Another important use of this property relates specifically to the PeopleSoft portal. When the portal uses a proxy server to relay content with an HTML template, it should forward only PS_TOKEN cookies that are marked secure over SSL connections. Note: By selecting this check box, you effectively disable single sign on functionality with any non-SSL servers. If, at your site, you want users to sign in to an HTTPS server, and then want to use single signon functionality with HTTP servers, deselect this check box to enable single signon functionality between HTTPS and HTTP servers. Note: Before you deselect this check box, make sure that you are aware of all the security implications, such as the security of the HTTPS server being compromised. This check box is selected by default.

Field or Control

Description

Secured Access Only

Select to enforce SSL if the entire website requires the SSL protocol. This prevents users from using non-SSL protocols to access any link within this website or application.

If only some pages require SSL access, deselect this check box (the default setting).

Secure Cookie with SSL

Select to prevent the single sign on token from traveling over an insecure network. If you select this check box and the scheme of the current request is HTTPS (an SSL server), the system sets the secure attribute of the single sign on cookie (PS_TOKEN) to True.

PeopleSoft single sign on functionality also applies at the web server level. For example, suppose that you have two web servers: server X and server Y. Web server X is an SSL site, and web server Y is not. In these situations, many sites want server Y to trust the authentication token, PS_TOKEN, issued by server X. This requires that you set the PS_TOKEN to be secure.

If the PS_TOKEN is not secure, when a user signs in through server Y, the browser sends PS_TOKEN to server Y over the unencrypted, non-SSL link. This is typical behavior for browsers when dealing with cookies that aren't secure. Potentially, in this situation, a hacker could obtain this token from the clear network and use it to sign in to the SSL-secure server X.

Another important use of this property relates specifically to the PeopleSoft portal. When the portal uses a proxy server to relay content with an HTML template, it should forward only PS_TOKEN cookies that are marked secure over SSL connections.

Note: By selecting this check box, you effectively disable single sign on functionality with any non-SSL servers.

If, at your site, you want users to sign in to an HTTPS server, and then want to use single signon functionality with HTTP servers, deselect this check box to enable single signon functionality between HTTPS and HTTP servers.

Note: Before you deselect this check box, make sure that you are aware of all the security implications, such as the security of the HTTPS server being compromised.

This check box is selected by default.

Authenticated Users

When single signon has been set up, the portal web server and any content provider web servers should have the same values for the following fields:

Inactivity Warning
Inactivity Logout
HTTP Session Inactivity

Field or Control	Description
Inactivity Warning	Specify the number of seconds that the portal should wait before warning users that the browser session will expire. Users can continue with the current session by clicking the OK button in the warning message, which resets the inactivity timer. If a user doesn't respond within the inactivity logout interval, the session ends and the expired connection page appears. The default value is 1080 seconds (18 minutes).
HTTP Session Inactivity	Specify the number of seconds of inactivity after which the HTTP session times out for authenticated users. When the interval passes with no user activity, the web server discards all session information, including cached page states. The next time the user submits a request, the web server creates a new HTTP session. From the user experience, the user may be put in a search page or home page because the previous session state is lost at this point. This property is unaffected by any permission list setting. When this property isn't specified, the HTTP session time-out interval is the same value as the authenticated user inactivity logout property that is specified on this page. This property is similar to the public users HTTP Session Inactivity property that is specified on this page. Use this property with caution. Don't use this property if you don't understand its usage.
Inactivity Logout	Specify the value in seconds of the inactivity time-out interval that applies to PeopleSoft applications to which a user is signed in. When the interval passes with no user activity, the user's browser displays the page that is specified by the Expire Page - Page field on the Web Profile Configuration - Look and Feel page. The web server applies this value in JavaScript. Note: The inactivity logout can be overridden by a permission list inactivity time-out setting. The default value is 1200 seconds. Note: Depending on the application implementation, authenticated users might also experience an HTTP session inactivity time-out, which by default is the same as the inactivity logout value that you specify here. However, you can override this behavior by using the HTTP Session Inactivity property on this page. This property independently controls the HTTP session inactivity time-out. The HTTP Session Inactivity property is unaffected by any permission list setting.
Timeout Warning Script	Displays the name of the time-out warning script that is currently in effect. The default value is WEBLIB_TIMEOUT.PT_TIMEOUTWARNING.FieldFormula.IScript_TIMEOUTWARNING.
Override	Click to change the time-out warning script. The Override Timeout Warning Script page appears, with these fields: Record (Table) Name: The default value is WEBLIB_TIMEOUT. Field Name: The default value is PT_TIMEOUTWARNING. PeopleCode Event Name: The default value is FieldFormula. PeopleCode Function Name: The default value is IScript_TIMEOUTWARNING. The values of these fields are concatenated to produce the value in the Timeout Warning Script field.

See Security Administration: Setting General Permissions.

Public Users

Public users are PeopleSoft application users who are not required to go through a PeopleSoft sign in page. As a result, public users are neither identified nor authenticated by their own user ID and password. Public users also are not forwarded to the sign in page after any period of inactivity.

Because they access sites without credentials, public users should be limited to informational websites where sensitive data is not accessible.

You should enable public user access under these conditions:

When you provide users with direct links to pages that are not secured.

Note:

If a user clicks a direct link that accesses a page for which the public user ID is not authorized, the system displays the sign-in page prompting the user to supply her PeopleSoft credentials.
When you use an external authentication method.

Important:

If you are using an external authentication method in conjunction with the PeopleCode SwitchUser function, then the Inactivity Warning and Inactivity Logout values specified for authenticated users are restored.

See PeopleCode Language Reference: SwitchUser function.
When you want crawlers to search your PeopleSoft site and need to provide access to the portal.

Field or Control	Description
Allow Public Access	Select so that the system bypasses the user sign-in page when users click a direct link to a page. The system uses the values that you specify in the User ID and Password fields for authentication. This check box is deselected by default. When you select this check box, the system enables the User ID, Password, and HTTP Session Inactivity fields.
User ID	Enter the account that the system uses to authenticate public users. This field is enabled when you select the Allow Public Access check box. Note: This is not the same as the WebUserId property in the configuration.properties file, which you specify during the PeopleSoft Pure Internet Architecture installation for accessing the web profile.
Password	Enter the password for the account that you entered in the User ID field. This field is enabled when you select the Allow Public Access check box Passwords can include up to 64 characters. Note: This is not the same as the WebPassword property in the configuration.properties file, which you specified during the PeopleSoft Pure Internet Architecture installation for accessing the web profile.
HTTP Session Inactivity	Specify the value in seconds of the inactivity period that applies to public users. When the period passes with no user activity, the web server discards all session information, including cached page states. The next time the user submits a request, the web server creates a new HTTP session. This field is enabled when you select the Allow Public Access check box. Note: If you are using an external authentication method in conjunction with the SetAuthenticationResult function in Signon PeopleCode or the SwitchUser() function in Non-Signon PeopleCode, you are logged out if you are inactive. The default value is 1200 seconds. See PeopleCode Language Reference: SwitchUser function.

Web Server Jolt Settings

Field or Control	Description
Disconnect Timeout	Specify the amount of time to wait while disconnecting the Oracle Jolt connection. A value of 0 means no limit. The default value is 0 seconds.
Send Timeout	Specify the maximum number of seconds that the servlet allows for a request to be sent to the application server. This setting does not indicate a maximum amount of time for the service to finish; it indicates only the maximum amount of time to send the request to the application server. The default value is 50 seconds.
Receive Timeout	Specify the maximum number of seconds that the servlet should wait for a response from the application server. Make sure that the value of this field is greater than your application server service time-outs, such as the Service Timeout setting for PSAPPSRV that appears in the psappsrv.cfg configuration file on the application server. The default value is 600 seconds.

Field or Control

Description

Disconnect Timeout

Specify the amount of time to wait while disconnecting the Oracle Jolt connection. A value of 0 means no limit.

The default value is 0 seconds.

Send Timeout

Specify the maximum number of seconds that the servlet allows for a request to be sent to the application server. This setting does not indicate a maximum amount of time for the service to finish; it indicates only the maximum amount of time to send the request to the application server.

The default value is 50 seconds.

Receive Timeout

Specify the maximum number of seconds that the servlet should wait for a response from the application server.

Make sure that the value of this field is greater than your application server service time-outs, such as the Service Timeout setting for PSAPPSRV that appears in the psappsrv.cfg configuration file on the application server.

The default value is 600 seconds.

XML Link

Field or Control	Description
User ID	Enter the user account that the system uses to authenticate users for XML Link technology.
Password	Enter the password for the account name that you entered in the User ID field.
XML Link Use HTTP Same Server	Select to indicate that the portal should use the HTTP protocol instead of HTTPS for requests that are issued by the xmllink servlet for content that is hosted on the same server as the xmllink servlet. This check box is selected by default.

Field or Control

Description

User ID

Enter the user account that the system uses to authenticate users for XML Link technology.

Password

Enter the password for the account name that you entered in the User ID field.

XML Link Use HTTP Same Server

Select to indicate that the portal should use the HTTP protocol instead of HTTPS for requests that are issued by the xmllink servlet for content that is hosted on the same server as the xmllink servlet.

This check box is selected by default.

Related Topics