Security on psLens

Full Access Permission Lists

Mon, 01 Jan 0001 00:00:00 +0000

Full Access Permission Lists Report

Report ID: security-full-access-permlists Category: Security Default Parameter: minMenuCount = 50

Nodes with No Password

Mon, 01 Jan 0001 00:00:00 +0000

Nodes with No Password Report

Report ID: security-nodes-no-password Category: Security

psLens for Security Administrators

Mon, 01 Jan 0001 00:00:00 +0000

The Challenge

PeopleSoft security is complex. Users are assigned to roles. Roles contain permission lists. Permission lists grant access to components, pages, and web services. Understanding who has access to what means tracing through multiple layers, often across dozens of screens or with custom SQL queries.

An overly-broad permission list can expose sensitive data; a forgotten role assignment can give someone access they should not have. Manual review misses both because there is too much to check.

Locked OPRID Scheduled Processes

Mon, 01 Jan 0001 00:00:00 +0000

Locked OPRID Scheduled Processes Alert

Alert ID: locked_oprid_processes Category: Process Scheduler

Stale Password Audit

Mon, 01 Jan 0001 00:00:00 +0000

Stale Password Audit Report

Report ID: security-stale-passwords Category: Security

User Full Access Report

Mon, 01 Jan 0001 00:00:00 +0000

User Full Access Report

Report ID: security-user-access Category: Security Parameters: oprid (required) — the PeopleSoft User ID to audit

Reducing App Designer Access

Mon, 01 Jan 0001 00:00:00 +0000

The Problem

Someone on the team needs to look something up in PeopleSoft. Maybe a business analyst is writing requirements and needs to see what fields are on a record. Maybe an auditor needs to understand how security is configured. Maybe a functional consultant needs to trace a component’s menu path.

The default answer is: give them App Designer.

This happens because App Designer is the only tool that lets you browse PeopleSoft object definitions. There is no read-only alternative built into PeopleSoft. So people who only need to look things up end up with the same tool that developers use to build and modify the application.

Dangerous Permissions Audit

Mon, 01 Jan 0001 00:00:00 +0000

Dangerous Permissions Audit Report

Report ID: security-dangerous-permissions Category: Security

Failed Logins

Mon, 01 Jan 0001 00:00:00 +0000

Failed Logins Alert

Alert ID: failed_logins Category: Security Default threshold: 5 failed attempts

Permission Lists

Mon, 01 Jan 0001 00:00:00 +0000

Permission Lists

URL: /permissionlists

Permission lists (PSCLASSDEFN, sometimes called classes) are the lowest-level grantable security object. Every menu, component, page, and function authorization attaches to one.

What You Can Do

View Full Definitions: See description, last modified information, and general settings.
View Authorizations: See which menus and components the permission list authorizes.
View Assigned Roles: See which roles include this permission list.
Sign-on Settings: View allowed sign-on times and other access constraints.

When It’s Useful

Auditing what access a particular permission list grants before assigning it.
Incident response: what could a compromised permission list have touched.
Finding permission lists that are overly broad (see also the Full Access Permission Lists report).

Roles

Mon, 01 Jan 0001 00:00:00 +0000

Roles

URL: /roles

Roles (PSROLEDEFN) are named bundles of permission lists. Users get roles, not permission lists directly.

What You Can Do

View Included Permission Lists: See the list of permission lists assigned to the role.
View Assigned Users: See which users are assigned this role.
Metadata Inspection: See the role’s description and last modified information.

When It’s Useful

Understanding what an unfamiliar role grants.
Checking whether a role contains permission lists that are unexpectedly broad.
Finding all users who have a particular role.

Users

Mon, 01 Jan 0001 00:00:00 +0000

Users

URL: /users

Users (PSOPRDEFN, historically called operators) are login accounts. Each carries a set of roles, a primary permission list, a row-security permission list, and a process profile. Search supports both OPRID and name.

What You Can Do

View Assigned Roles: See the roles assigned to a user.
Core Security Attributes: See primary permission list, row security permission list, and process profile.
Account Metadata: View account status (active/inactive), last login, and email address.
Password Settings: See password-related settings (whether a password is set, when it expires).

When It’s Useful

Checking what access a specific user has.
Reviewing user accounts during security audits.
Finding accounts that are inactive but still have broad role assignments.
Investigating who has access to a sensitive area of the system.