Search Framework Security Audit

Audits PeopleSoft Search Framework security: deployed search definitions with no security, sensitive fields in the search index, search administrators, and the search callback user.
Categories:
New to psLens? This page documents one specific report. To see how it runs in the product, what the output looks like, and how teams use it in practice, start with a live walkthrough.
Book a Demo Browse Reports
Tailored Operational Context
  • Target Database: —
  • Context Type: —
  • Alert Severity: —
  • Triggered Time: —
  • Firing Context: —
  • Contextual SQL: 
    —

Search Framework Security Audit Report

Report ID: ptsf-security-audit Category: Security

Purpose

This report audits the security of the PeopleSoft Search Framework from four tables: the search definitions (PSPTSF_SD), their deployments (PTSF_DEPLOY_OBJ), their indexed fields (PSPTSF_SD_ATTR), and the search instances (PTSF_SRCH_ENGN).

A search index is a copy of application data that sits outside the PeopleSoft database. Row-level security does not follow the data there unless the search definition is set up to apply it, and the search engine holds a PeopleSoft sign-on of its own.

Sections

SectionFindingSeverityReads
UNSECUREDDeployed search definition has no securityinfoPSPTSF_SD, PTSF_DEPLOY_OBJ, PSPTSF_SD_PNLGP
SENSITIVESensitive field is indexedwarningPSPTSF_SD_ATTR, PSQRYFIELD, PSPTSF_SRCHATTR
ADMINUser holds a search administration permission listinfoPSROLECLASS, PSROLEUSER, PSOPRDEFN
CALLBACKSearch callback user holds an administrator rolewarningPTSF_SRCH_ENGN, PSROLEUSER

UNSECURED

Lists every search definition that is deployed to a search instance and has neither document-level security (PTSF_ISDOCACL) nor source-level security (PTSF_ISSRCACL). The Search Framework does not filter the results of such a definition by user.

Delivered definitions over public data are deployed this way on purpose: the PeopleTools 8.62 Campus Solutions demo database reports six, including the class search and course catalog definitions. The finding is raised to warning when the definition also indexes a sensitive field. When the definition is mapped to a component for keyword search, the component is shown.

SENSITIVE

Lists every indexed field whose field name is on the sensitive-field list. For a query-based definition the query field is resolved to its record field through PSQRYFIELD. For a record-based definition the field comes from PSPTSF_SRCHATTR. The finding says whether the field is faceted or displayed in results, and is critical when the definition is deployed with no security.

The sensitive-field list is the mcp.maskedFields setting, the same list that masks values in MCP query results. The default is NATIONAL_ID, BIRTHDATE, BANK_ACCOUNT_NUM, ACCOUNT_EC_ID, SSN, TAX_ID, CREDIT_CARD_NBR, CVV, and DRIVERS_LIC_NBR. Fields are matched by exact name, and the report prints the list it used.

ADMIN

Lists the active users who hold PTPT3100 (Search Administrator), PTPT3300 (Search Server), or PTPT5700 (Insights Administrator), with the role that grants it or a note that it is the user’s primary permission list. Locked accounts are counted but not listed.

CALLBACK

The search engine signs in to PeopleSoft as the callback user of each search instance. The section lists every role each callback user holds, and reports a finding when one of them is PeopleSoft Administrator or Security Administrator.

This section reads PTSF_SRCH_ENGN, which also stores the search engine, proxy, and callback passwords. psLens excludes those three columns from the request and never displays them. The table is optional: without it the section is skipped.

Skipped Sections

A section runs only when every table it reads was read in full. When a table is not whitelisted or its query fails, the section is marked Skipped in the summary with the table name and the reason. It is never reported as clean.

Report Output

  • Header with the database, the generation timestamp, and the number of search definitions, deployed definitions, and search instances.
  • Warning block naming any table whose query failed.
  • Summary table with one row per section: Clean, the number found, or Skipped with the reason.
  • One section per finding type, with links to the search definition or user detail page.

Parameters

This report has no configurable parameters. The sensitive-field list comes from mcp.maskedFields in the configuration.

Change Tracking

The report is diffable. Findings are keyed by section and object, for example UNSECURED|SSR_CLASS_SEARCH_LFF or ADMIN|VP1|PTPT3100. A scheduled run with notify mode On change reports a newly deployed unsecured definition, a newly indexed sensitive field, or a user added to a search administration role.