Wednesday, July 31, 2019

User Profile Emulation in PeopleSoft

We used to simulate the user issue in non prod by changing the password for respective username and login to replicate the issue.Its always a security concern and there is no track of it.

I have seen other ERP application does gives this emulate  as different user functionality without touching their security. But peoplesoft does not give such feature for user emulation.

i have created an Idea in oracle community to get this future in peopletools. hope this will be accommodated in future release. Please do vote .

https://community.oracle.com/ideas/23725

In the interim i came up with below idea.with this approach you do not need to change end user password and also it keeps the track of individual user who is emulating as other user.

So below blog will explain you on how you will emulate as different user.

1. Create new site called simulate in existing weblogic domain.

for example : 

Existing Site Name : PSDEV
New Site Name  : SIMULATE

2. Add below html in your original site signin.html. (PSDEV)


<a href="https://velu.peoplesoft.com/psp/simulate/?cmd=login">Impersonate User</a>

3. Add below html in your new site signin.html (SIMULATE)









<div>
               <span class="ps_label-show" id="ptLabelUserid"><label for="imuserid"><%=1333%></label></span>
             </div>
             <div class="ps_box-control">
               <input type="text" id="imuserid" name="imuserid" value="<%=IMUSERID%>" title="<%=1333%>">
           </div>

4. Open your FUNCLIB_LDAP record and goto LDAPAUTH field peoplecode.

Create new function called IMPERSONATE as below.









Function impersonate();
   &signonusername = %SignonUserId;
   &userName = %Request.GetParameter("IMUSERID");
   &ipaddress = %Request.GetHeader("X-FORWARDED-FOR");
   SQLExec("select roleuser from psroleuser where rolename='PeopleSoft Administrator' and roleuser=:1", &signonusername, &roleuser);
   If &userName = "" Then
      SetAuthenticationResult( True, Upper(&signonusername), "", False);
   Else
      If &roleuser = "" Or
            &userName = "PSADMIN" Or
            &userName = "PSAPPS" Or
            &userName = "PTWEBSERVER" Then
         SetAuthenticationResult( False, &userID, "You are not authorized to do Impersonation");
      Else
         SQLExec("INSERT INTO PS_IMPERSONATE VALUES (:1,:2,:3,:4)", &signonusername, &userName, &ipaddress, %Datetime);
         SetAuthenticationResult( True, Upper(&userName), "", False);
      End-If;
   End-If;
   
End-Function;

5. Create a new record with below field to keep a track of who is logging in.






Make sure you build the record

6.Add LDAP_AUTH peoplecode in signon peoplecode as below.










Bounce your app server by clearing cache.

Tetsing:

1. Open your exiting PIA. You will see a Hyperlink called Impersonate User.














2. Click on impersonate user. It will take you to your newly created SITE called simulate.

















Now provide your username/password and the username you want to login as.(in Impersonate user as)


















You can see it logged in as user id which you put in.















3.You can query the table select * from PS_IMPERSONATE to check if the values are captured. this will help you for audit purpose.

Points to note:

1. I have hardcoded Peoplesoft Administrator role in peoplcode. So if you any user want to use this functionality they should have Peoplesoft Administrator Role else it will throw below error.










2. Also you may need to use peoplesoft password to login , if you use LDAP password it may fail. I will update the post once i enhance my peoplecode to make it work with LDAP password

Peopletools 8.56.18
DB 12C


NOTE: I would recommend only to use it in NON-PROD .. never move this code to production .

I just did this as for learning purpose. Implement this on your sole responsibility.

4 comments:

  1. This is really nice. Good Job sir.

    ReplyDelete
  2. What method was used to create the second PIA site in the existing weblogic domain?

    ReplyDelete
  3. By calling SetAuthenticationResult(True, %SignonUserId, ...) you are logging in the %SignonUserId and establishing a session for them without checking any further authentication. That means that anyone can get logged in as that user, no matter what password. Other than that, this is a great idea. Wish there was an easier way to authenticate using PSOPRDEFN.

    ReplyDelete
    Replies
    1. Edit: Using %PSAuthResult in the if statements appear to authenticate the user correctly.
      If &userName = "" And
      %PSAuthResult Then...

      %PSAuthResult - This system variable returns the result (True of False) of PeopleSoft ID and password authentication for the user signing on.

      Thanks again for the post!

      Delete

User Profile Emulation in PeopleSoft

We used to simulate the user issue in non prod by changing the password for respective username and login to replicate the issue.Its always...