PeopleSoft Web Portal Security

When performing a PeopleSoft security audit, Integrigy reviews in detail the PeopleSoft Web Portal security settings to ensure they are set per best practice recommendations.  To do this yourself, use the table below to review your settings.

These settings should also be regularly reviewed to ensure against configuration drift.

Field

Description

Recommended Value

Allow Public Access

User sign on bypassed when direct link to a page are used – PUBLIC user access.

NULL/Disabled

Days to Autofill User ID

Convenience for users. Caches user Id for x days.

7

View File Time to Live

Number of seconds to wait after sending a file attachment to a user's browser before removing that file from the web server.

Default is 0. Set to 0 (zero) for public area/kiosk

PIA use HTTP Same Server

Use the HTTP protocol instead of HTTPS for requests that are issued by the portal for content hosted on same server.

N

Allow Unregistered Content

Whether both registered and unregistered content is served. Turning this option off will prevent explicitly registered content references from being displayed in the portal.

Y

SSL Secured Access Only

Forces use of SSL. Prevents users from using non-SSL protocols to access any link within this website or application.

Y

Secure Cookie with SSL

Prevents single signon token from traveling over an insecure network. If selected the system sets the secure attribute of the single signon cookie (PS_TOKEN) to True.

Y

Inactivity Warning

Number of seconds that the portal waits before warning users that browser sessions will expire. 

1080

HTTP Session Inactivity

Number of seconds of inactivity after which the HTTP session times out for authenticated users. 

1200

Inactivity Logout

Number of seconds of the inactivity timeout interval that applies to PeopleSoft applications to which a user is signed in. 

1200

Show Connection Information

Generates system information page when a user presses Ctrl+J. Shows:

browser, OS, PeopleTools release, application release, service pack, page definition name, component definition name, menu definition name, user ID, database name, database type, and application server address

Off/Null

Show Trace Link at Signon

Displays URL link at sign-in for setting trace parameters.

FALSE

 

If you have questions, please contact us at info@integrigy.com

Michael A. Miller, CISSP-ISSMP, CCSP

References

PeopleSoft Database Security

PeopleSoft Security Quick Reference

 Share this post