<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Paul beat me to it, but I’ll add a couple of points:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The installation of Shibboleth is the installation, the fact that it’s in front of PeopleSoft is irrelevant (presuming you have the proxy for it to live in).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For configuration, you need ensure that one of the attributes you are sending from the IdP maps to the user OPRIDs in PeopleSoft, that your Shibboleth SP configuration maps that attribute and sends it to PeopleSoft
(I think this is always done via headers). You also need some sign-on PeopleCode to extract the value from the web request to determine the ID of the user, which is on the page Paul linked near the bottom. In particular, it shows:
<o:p></o:p></span></p>
<pre><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></pre>
<pre><span style="font-family:"Calibri","sans-serif";color:#1F497D"> </span>&userID = %Request.GetHeader("PS_SSO_UID");<o:p></o:p></pre>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">to extract the user ID from the http header. Just change this to be the header you’re configuring the Shib SP to populate.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Note that once the sign-on PeopleCode runs, PeopleSoft generates its own, normal session cookie. So after the login process is complete, the PeopleSoft application is pretty much completely oblivious to the fact
that the Shibboleth SP is there. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">--- Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Caskey, Paul<br>
<b>Sent:</b> Thursday, March 05, 2015 8:35 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> RE: Shibboleth 2.53 with Peoplesoft<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">The general approach to using any SSO with PS is to put an SSO-enabled proxy in front of PS and handle the authentication there. Then you write a little module in your login PeopleCode to map the SSO principal
to a PS principal.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">If PS is being served by weblogic, then there’s a weblogic->apache connector (and also a weblogic->IIS connector if you prefer).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">And, you may have to write a custom logout page since you have to kill both the PS session and the SSO session.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">This doc from Oracle should help (just think ‘Shibboleth’ where the docs says OAM).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/e10356/people.htm#CHDJAJAA">http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/e10356/people.htm#CHDJAJAA</a><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Rene Jager<br>
<b>Sent:</b> Thursday, March 05, 2015 10:16 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> Shibboleth 2.53 with Peoplesoft<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="NL">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">We want to install Shibboleth for Single Sign On with Apqache 2.2 on our linux server in combination with Peoplesoft with a external IDP (not from Shibboleth)
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">Is this possible? Or do you have to use an Shibboleth IDP ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">My second question: Is there is a documentation available for the installation on Peoplesoft ? <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">This would be very helpfull! <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">Rene Jager<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:10.0pt;mso-fareast-language:NL">--</span><span lang="NL" style="mso-fareast-language:NL"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>