Peoplesoft & Shibboleth

[MacDonald, Michael J.]

We were doing something very similar in our production PeopleSoft environment to other universities.    When we originally implemented it I reached out to a bunch of other universities and they all confirmed they were pretty much doing the same thing for their PeopleSoft and Shibboleth implementation. Apache + Shibboleth SP + Oracle WebLogic Server Proxy Plug-In.  Apache was setup with Shibboleth authentication and proxied traffic to WebLogic backend via Oracle WebLogic Plugin and the Signon PeopleCode would read the Shibboleth headers.   It has worked pretty well for last 3 years or so but we had the same security concerns. We firewalled off all WebLogic traffic to only local host only forced everyone to go through Apache but still were not super happy with that solution.  We also had this setup in front of F5 load balancer and a security policy that wiped/sanitized any headers (if someone needed to connect directly to the Weblogic backend and not go through Shibboleth).
 
The current way we are implementing Shibboleth SSO + PeopleSoft is a completely different animal.  One of our developers wrote a Node.JS app with the Passport SAML library.  NodeJS functions as the SAML SP instead of using native Shibboleth SP.  Instead of passing headers that could get spoofed an encrypted JSON token is created with the attributes we need.  The encrypted JSON token is then decrypted / read by the Signon Peoplecode.         It's a bit more custom then using Apache + Shibboleth but doing it this way we don't have to proxy the entire Weblogic session over Apache or worry about header spoofing.  

-Mike

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, August 9, 2019 3:52 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Peoplesoft & Shibboleth

On 8/9/19, 3:33 PM, "users on behalf of Ryan Suarez" <users-bounces at shibboleth.net on behalf of ryan.suarez at sheridancollege.ca> wrote:

> The concern from Management and Peoplesoft admins is that this method 
> may be a bit 'hackish'.

Hackish and web are synonyms, but that's how web applications are supposed to work; web servers are designed to do authentication and applications are not.
 
Oracle's SAML support is also garbage like most is, so if one were to do something else, that something shouldn't be SAML. I don't know what other non-native options exist, since most of the others would look a lot like using Shibboleth and probably involve Apache.
 
> Could you kindly let me know if you run an IdP and have this setup in production?

For many years.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net