Shibboleth 2.53 with Peoplesoft

[Eric Goodman]

Paul beat me to it, but I'll add a couple of points:

The installation of Shibboleth is the installation, the fact that it's in front of PeopleSoft is irrelevant (presuming you have the proxy for it to live in).

For configuration, you need ensure that one of the attributes you are sending from the IdP maps to the user OPRIDs in PeopleSoft, that your Shibboleth SP configuration maps that attribute and sends it to PeopleSoft (I think this is always done via headers). You also need some sign-on PeopleCode to extract the value from the web request to determine the ID of the user, which is on the page Paul linked near the bottom. In particular, it shows:



                     &userID = %Request.GetHeader("PS_SSO_UID");

to extract the user ID from the http header. Just change this to be the header you're configuring the Shib SP to populate.


Note that once the sign-on PeopleCode runs, PeopleSoft generates its own, normal session cookie. So after the login process is complete, the PeopleSoft application is pretty much completely oblivious to the fact that the Shibboleth SP is there.

--- Eric




From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey, Paul
Sent: Thursday, March 05, 2015 8:35 AM
To: users at shibboleth.net
Subject: RE: Shibboleth 2.53 with Peoplesoft

The general approach to using any SSO with PS is to put an SSO-enabled proxy in front of PS and handle the authentication there.   Then you write a little module in your login PeopleCode to map the SSO principal to a PS principal.

If PS is being served by weblogic, then there's a weblogic->apache connector (and also a weblogic->IIS connector if you prefer).

And, you may have to write a custom logout page since you have to kill both the PS session and the SSO session.

This doc from Oracle should help (just think 'Shibboleth' where the docs says OAM).

http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/e10356/people.htm#CHDJAJAA




From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of Rene Jager
Sent: Thursday, March 05, 2015 10:16 AM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Shibboleth 2.53 with Peoplesoft

Hello,

We want to install Shibboleth for Single Sign On with Apqache 2.2 on our linux server in combination with Peoplesoft with a external IDP (not from Shibboleth)
Is this possible? Or do you have to use an Shibboleth IDP ?

My second question: Is there is a documentation available for the installation on Peoplesoft ?
This would be very helpfull!

Regards
Rene Jager
--

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/127d976d/attachment.html