PeopleTools 8.55 Features: How to Deploy Homepages, Tiles and Branding

During the latter half of this year, we were given the opportunity to upgrade our PeopleSoft Interaction Hub to PeopleTools 8.55.05.


I would like to share what was learned from this process.  This upgrade is the first time we took advantage of a number of things: from the Fluid Portal Registry to Branding and I would like to go into detail about each.  It is important to note, PeopleSoft Interaction hub is on the same Operating System as other PeopleSoft Environments: a lot of functionality discussed here can be used with any Tools 8.55 system.

PeopleSoft Interaction Hub 8.55 Discussion Sections:

• Setup and Integration Broker
• Tiles and HomePages
• Branding and Migration
• 8.55 Security
• Recommendations and Backwards Compatibility
• Comprehensive Testing
• Other Resources

Section One - Setup and Integration Broker

Properly configuring integration broker is one of the most challenging aspects of deploying PeopleSoft Interaction Hub.  I will you refer you to my how-to article here to get the basics of this setup with stock functionality and troubleshooting tips.  This article goes on to configure unified navigation, and will show how combined homepages and tabs work.  If you are following along ~ it would be a good place to start with a working sandbox system.

Section Two - Tiles and HomePages

With Tools 8.55 you are given a new canvas to design from.  It is relatively easy to see how these are setup using the PeopleSoft Image 2 PUM demo data.  

The two directories in the portal registry: (Nav Bar > Navigator > PeopleTools > Portal > Structure and Content) that you will need to pay the most attention to lie in the Fluid Structure And Content directory: 

The two directories you will be mostly working in during an 8.55 implementation for Interaction Hub

Fluid Homepages Directory

Corresponds to the Homepages a user has access to when they login.   If you setup Integration Broker correctly, you will notice that all Homepages in each PeopleSoft Environment will merge together: for example, the Manager Self Service Homepage doesn't exist on Interaction Hub, but rather Human Resources, yet it will be accessible as a Homepage in IH.

If you are familiar with PeopleSoft Classic technology, Homepages most closely resemble Homepage Tabs ~ although they are not 100% the same.  See the chart below explaining the differences:

	Fluid Homepages	Homepage Tabs
Contain Fluid Tiles	Yes	No
Contain Pagelets	No	Yes
Able to split the ratio as 1-2 or 1-1-1	No	Yes
Able  to show free text (html) content	Yes	Yes
Able to adjust accordingly to screen size	Yes	Sort of
Able to show based on Users permissions	Yes	Yes
Can be arranged in priority	Yes	Yes
User has ability to create their own	Yes	No
Support for tile based integration with other systems	Yes	No
Able to show different content for different homepages	Yes	Yes

Fluid Pages Directory

This folder contains all Tiles found on the local Portal.  Once these are created they can be linked to the Fluid Homepages.  We will go into detail about the different options later in this section.  

Understand How Homepages Combine Tiles Before Designing

In our previous Interaction Hub setup, a lot of the content we linked to resided locally on the Portal.  We would create navigation collections in the Portal Registry, and assign roles based on dynamic security, then show them in homepage tabs.

In tools 8.55, if you setup Integration Broker correctly, you will notice that based on Home Page name (for example "Employee Self Service"), content will be pulled in and combined from other systems on the Interaction Hub.  There is no need to worry about security, as it is all imported based on the remote security.  This is a very neat feature, and when controlled properly can provide a great User Experience with little overhead.

Company News comes from Interaction Hub and the rest of the tiles come from HR.  The system did this automatically.

The caveat all boils down to control: when we used to host all content only in Interaction Hub, we could fully control where each tile appeared.  This new system allows more cooks in the kitchen, so to speak so it is important to have a central repository, as some Tiles may take screen priority over others. We used a google sheet (click here for a sample) and shared it among all BSAs and security staff. This way when we deliver a tile, we can filter the sheet and have a good idea of which tiles are available and where they should reside.  Using this sheet also allows you to consider all fields that should be filled in when creating a tile.


Tiles as Links

The easiest type of tile would be a link to a classic or fluid component.  Probably the most noticeable feature of any tile would be the icon you chose to represent the functionality.  Fluid Tiles support SVG vector graphics: this means it doesn't matter which form factor you display the image on: an old iPhone or a 4K 32 inch monitor, it will be smooth on both devices.  We found icons8.com to have a very good repository of SVG images that match the stock images oracle delivers with their existing tiles.  You have to pay a one time fee, but we have found this to be worth the money.

SVG Images can be added a few ways:

• Via the PIA: Nav Bar > Navigator > PeopleTools > Portal > Branding > Branding Objects ~ Click the Image tab and and Upload Image Object (need the Portal Administrator Role for this)
• Via App Designer: New > Image, Select the SVG Image and save.

SVG Images can also be added to a project in App Designer, and Migrated between tools environments, using Tools > Copy project to File in the source environment, and Tools >  Copy Project from File in the destination environment. 

EXAMPLE

Example Creating a Tile on Interaction Hub for the Student Center on Campus Solutions.  This example will show how to create a tile linking to a classic component in PeopleSoft

1. We selected the Blackboard SVG icon from icons8.com: (the size that works best for us was 80x80 pixels) and uploaded it via: Nav Bar > Navigator > PeopleTools > Portal > Branding > Branding Objects ~ Click the Image tab and and Upload Image Object.  The Image was called CUST_BLACKBOARD

2. We then navigated to the portal registry where tabs are stored: Nav Bar > Navigator > PeopleTools > Portal > Structure and Content... Fluid Structure and Content - Fluid Pages

In this directory, we create a new folder
Name: CUST_ACADEMICS
Label: Academics
Sequence: where ever logical based on your organizational needs
Folder Security: Public

3. In the Academics Folder we create a new CREF:

Here are screen caps of each of the 3 tabs of the CREF:

General:

Note:

• We used PeopleSoft generic URLs here ~ this was done so that we include this tile to display on Small Form Factor ~ if you choose PeopleSoft Component, you don't seem to have control of this.  We found we had to convert a lot of our components to generic URLs else the tiles wouldn't appear on mobile devices ~ which really defeats the purpose of fluid adoption.

Security:

• The CUST_ROLES we have here are being dynamically generated in the Campus Solutions source system then copied across using an asynchronous service operation.  More details on how to do that can be found in this article.

Fluid Attributes:

• These attributes are relatively straightforward.  There are a number of things you can do with Dynamic Tile Content that I will discuss later in this article.

4) Assigning this Tile to a homepage.

Return to Nav Bar > Navigator > Peopletools > Portal > Structure and Content - Fluid Structure and Content - Fluid Homepages

At this stage you can use a delivered Homepage, or create your own.  We found that Employee Self Service, and Manager Self Service seem to be common delivered Homepages between PeopleSoft Systems.  We find that Student Functionality doesn't fit well in the delivered home pages: we created a Custom Home Page:

• The lower the sequence number, the higher priority your homepage will have: if it is first, it will appear first when logging in. Again it makes sense to keep all of these homepages and sequence numbers tracked in a single spot among all your streams: so you can determine which users will see what homepages.

You would need the same security added to this home page that all tiles within it have. And finally, in the Tile Content tab, add Check the Student Center tile you created and select how you want it to behave on the home screen ~ Req-Fix ~  prevents users from being able to remove the tile.

If you want to force a particular homepage to appear first, you also have the option of setting in in Assign Branding Themes: Nav Bar > Navigator > PeopleTools > Portal > Branding > Assign Themes

Further Consideration ~ there is an easier way to do this!

Because of the way PeopleSoft  8.55 works, the Custom Home Home Page will combine Tiles from other systems.  Our Campus Solutions system is on Tools 8.53, and this wasn't possible, but instead of the Dynamic Role solution, you could setup the tile locally on your 8.55 Campus Solutions system, and the Interaction Hub should pull the content and combine it, provided the Homepages have the same name.

Free Text Tiles

We used a lot of free text pagelets to push some more exciting content through our homepages ~ I found the can still be used in tiles and at the time of writing this article, 8.55.05 it is impossible to assign security to the free text tile iscript, so we got Free Text Pagelets working with tiles.  Below is an example of creating a youtube video tile:

EXAMPLE

We have to start with creating a free text Pagelet:

Navigate to Nav Bar > Navigator > Peopletools > Portal > Pagelet Wizard > Pagelet Wizard

Add a New Value: CUST_YOUTUBE, give it a title, and select Data Type: Free Text

Use the following code:


<div style="position: relative; padding-bottom: 56.25%; padding-top: 25px; height: 0;" >
    <iframe frameborder="0" allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src="https://www.youtube.com/embed/cUYSGojUuAU">no iframe support</iframe>
</div>

Make sure you use "Embed" code from youtube videos here.

Click Save, and Next till the step 6.

You can click HomePage Pagelet, select a folder (Organizers) and set any level of security here.

To make this a tile:


Navigate to the portal registry where tabs are stored: Nav Bar > Navigator > PeopleTools > Portal > Structure and Content... Fluid Structure and Content - Fluid Pages - News

In the News Folder we create a new CREF:

Here are screen caps of each of the 3 tabs of the CREF:

General:

Security:

Fluid Attributes:

• Ensure this iScript_PageletBuilder is added to your Permission Lists that would access this.  

Assigning this Tile to a homepage:

Return to Nav Bar > Navigator > Peopletools > Portal > Structure and Content - Fluid Structure and Content - Fluid Homepages - Employee Self Service, Click the Tile Content Tab, and Add the Youtube video:

The Result:

We are actually pretty excited about tiles: beyond iScripts, you can like to a number of different content types: PeopleSoft Generic URL is an option which opens the door to pretty much any type of content, provided it scales well!  Providing analytic information in queries or pivot grids will be a great way to present data and statics aesthetically to your user base.



Other Useful Examples

Based on the two previous examples, other tiles we have had success with:

Edit Favorites ~ this functionality seems to be absent from the nav bar at the time of writing this post, logically we placed it under the Favorites Tile in the Nav Bar:
PeopleSoft Generic URL: c/PORTAL_COMPONENTS.EPPSC_EDIT_MYSC.GBL


Application Start Page ~ similar to a classic workcenter: but optimized for fluid:
PeopleSoft Generic URL: c/NUI_FRAMEWORK.PT_AGSTARTPAGE_NUI.GBL?CONTEXTIDPARAMS=TEMPLATE_ID:PTPPNAVCOL&scname=CUST_NAVCOLL&PanelCollapsible=Y

*where CUST_NAVCOLL can be any nav collection (non-fluid components work best for now).




Tile Migration

It is absolutely possible to add tiles content to a project to Migrate: ensure you have your images and the Portal Registry Structures to a project:

Via App Designer:

Insert > Definitions into Project > Portal Registry Structures

Portal Name: Employe
Object Names:

PORTAL_LP_TAB
PORTAL_GROUPLETS

When migrating portal registry structures you always need to have import the root object.  From here you can also ensure all the related definitions are selected (and any folders in between):

You can then save the rest of your Custom Folders and Crefs... I would strive to use a common naming convention here something like CUST_TILE, so that it will be easy to add these into a Project.

Migration between tools environments, using App Designer: Tools > Copy project to File in the source environment, and Tools >  Copy Project from File in the destination environment will get these moved across.   Phire is a great tool to do this in a controlled manner: just ensure you are using the latest version to get the fluid stuff moved across.

Beyond Caching: Tiles and Homepages

I like to say the Homepage preferences on Tools 8.55 in some cases, work like a baby duck.  That is, the first thing a baby duck sees it will imprint and believe it is their mother (even incorrectly).  In 8.55 when you first login, a few things will get saved, making it difficult to change later.

8.55 holds a lot of information about tiles in the following tables:

select * from  PSPRUHDEFN;
select * from  PSPRUHTAB;
select *  from PSPRUHTABPGLT;

From our observations, these initially get created from the portal registry upon the first login, but some things tend to linger around.  For example, we have found it difficult to re-name Homepages once somebody has already logged in.  Also removing tiles from the home page in the portal registry may force them to linger around as optional tiles.  One way to clear these out would be to delete / recreate the account. It has also been suggested that deleting information from these does the trick: I await for a function like "Clear Users's Preferences" that would do this cleanly.  Until then, be careful about Homepage names: they  can be tricky to change. Hiding and showing unwanted tiles can ultimately be controlled by security.

Section Three - Branding and Migration

Branding in Interaction Hub, Image 2 on Tools 8.55 also has some nice new features particularly with themes:

Theme Builder - Nav Bar > Navigator > Portal Administration > Theme Builder > Theme Builder

Theme Builder Advanced Setting - Nav Bar > Navigator > Portal Administration > Theme Builder > Theme Builder Advanced Setting

The new Theme Builder which looks exclusive to Interaction Hub in 8.55 employs a fluid activity guide to quickly create a branded theme.  You can assign security, publish and even create a migration project from this Activity guide: it provides some very nice functionality here.

We learned that some of the fine tuning needs a second component: Theme Builder Advanced Setting ~ this will allow you to adjust branding on additional Portal navigation features, such as the background colour of the Nav Bar.

EXAMPLE

Example: Custom Fluid branding in PeopleSoft Interaction Hub 8.55:

You can upload an SVG directly in theme builder, but it is also possible to upload a file in the branding objects.  Make sure the SVG you use has a readable height at around 28 pixels, as this will scale properly with your header.

Nav Bar > Navigator > PeopleTools > Portal > Branding > Branding Objects ~ Click the Image tab and and Upload Image Object

and upload it as CUST_LOGO

now, lets create and deploy a new theme:

Navigate To Theme Builder - Nav Bar > Navigator > Portal Administration > Theme Builder > Theme Builder

Click Clone on the PAPPBR_THEME_FLUID row

Set the name / description as CUST_THEME / Custom Theme and Save

Click Edit beside CUST_THEME

• You can also upload an image from here

• Click Save and Next

• We set the default theme to Yes and Added a Role under Assign Theme to Attributes.
• Save and click next.

Click Publish and that should deploy your new theme.


 ... right under the publish button, you will see a 'Create Data Migration Project'... this will be useful if you wish to export this theme.  You could do it at this stage, but I recommend you first browse to Theme Builder Advanced Setting as it gives you more granular control over things like the Nav Bar background color.


This is the final result:

Data Migration Workbench

It is no coincidence that Oracle has included a link to export your theme using Data Migration Workbench.  You will find as you navigate between Interaction Hub and remote fluid components, such as Pay on PeopleSoft Human Resources, that component will no longer have any of the Branding you have set.  This feels like a step backwards, as a key benefit to Interaction Hub in the classic world is that you only need to do branding in one place: Interaction Hub.

Thankfully you can copy themes created from Interaction Hub via Data Migration workbench to other environments relatively easily.  The bonus here is we have found the theme gets automatically applied when you visit a remote fluid component via Interaction Hub: with no further configuration needed on the remote system: here is the use case:

-IH Admin creates CUST_THEME
-IH Admin exports CUST_THEME and imports it using Data Migration Workbench to HCM system
-When user logs directly into HCM system, theme setting remains as the default (dark blue)
-When user logs into IH, and via IH visits the Pay Fluid Component, the theme settings CUST_THEME exported into HCM will apply to the user's session as long as they are logged in.

EXAMPLE

Each environment is different, but I have written up a set of steps to migrate a theme from IH to HR using PUM images.

Export Theme

• Navigate to your IH PUM VM Virtual Box Console
  • Login as root
  • Browse to:  cd /opt/oracle/psft/ptdb/custhome/ (I had to create the last 2, using mkdir)
  • Run: mkdir ads_out
  • Run: chown -R pasdm2:oracle ads_out/
• Sign into the PIA as a PeopleSoft Administrator
  • Navigate to: Nav bar -> PeopleTools -> Lifecycle Tools -> Migrate Data -> Manage File Locations
  • Add a new value: 
    • Location Name: CUST_FILE_LOCATIONS
    • Path: /opt/oracle/psft/ptdb/custhome
    • Save, the Area Name should be ads_out
  • Navigate to Theme Builder: Nav bar-> Portal Administration -> Theme Builder
  • Click edit on a custom theme
  • Click the Review and Publish link in the activity guide
  • Click: Create Data Migration Project
    • Project Name: CUST_CUSTOM_THEME
    • Description: Custom Branding Theme
    • Save (and goto Project same as first two steps below)
  • Navigate to: Nav bar -> PeopleTools -> Lifecycle Tools -> Migrate Data -> Data Migration Workbench
    • Search CUST_CUSTOM_THEME
    • Click Copy To File
    • Click Run
  • Load up Win SCP as Root
    • Navigate to: /opt/oracle/psft/ptdb/custhome/ads_out
    • Verify directory is there: CUST_CUSTOM_THEME
    • Copy these files to a shared location that your HR PUM Image can access.
  
  

Import Theme:

• Perform Steps above on the ads_out directory and setup manage file locations on the target system.
• Copy the folder: CUST_CUSTOM_THEME to : /opt/oracle/psft/ptdb/custhome/ads_out
•  Navigate to: Nav bar -> PeopleTools -> Lifecycle Tools -> Migrate Data -> Data Migration Workbench
  • Click: Load Project from File
  • Select the CUST_CUSTOM_THEME
  • Click Submit for Copy
  • Click Run to run the process

Again, the theme should be applied in your Target Remote system, but only should appear when you come through the Interaction Hub.

Section Four - 8.55 Security Changes

There are a lot of security Objects that get delivered with tools 8.55 ~ Oracle recommends that you clone all permission lists in these roles:

PAPP_USER

EOPP_USER

PeoopleSoft User

and apply to a General User role.  From there you would work towards removing functionality not needed. We found when you need to remove functionality,  very good place to start would be seeing the difference between the Guest Roles:

PAPP_GUEST

EOPP_GUEST

PeopleSoft Guest

Things like the Search Bar, removing items from the Action List, The Notification Flag all are controlled by security, and the guest roles don't have them.  

Here are some of the particular security changes that helped remove certain functionality:

Function: 
Disable Personalize Homepage Link from Action List
Menu:
PORTAL_PERS_HOMEPAGE
Component:
PORTAL_HOMEPAGE
Page:
ALL

Function:
Hide Alerts Flag in Header
Menu:
PTPNEVENTS
Component:
PTPN_POPUP_WINDOW
Page:
Notification Window

Function:
Hide Search in Header
Menu:
PORTAL_ADMIN
Component:
PTSF_GBLSRCH_FLUID
Page:
Search Results

Function:
Disable Add To Links from Action List
Web Library:
WEBLIB_PTNUI
Function:
PT_BUTTON_PIN.FieldFormula.IScript_SavePin

Function:
Hide Sign Out Link
Web Library:
WEBLIB_PORTAL
Ensure the following is set to No Access
PT_PORTAL_HDR_LINK.FieldFormula.IScript_HideSignOutLink

Section Five - Further Recommendations and Backwards Compatibility 

In my previous post, I took the opportunity to get two Pum Images: Interaction Hub Image 2 and Human Capital Management Image 18 working with Unified Navigation on a laptop.  Not everyone will be so fortunate to work in such a stock environment.  As we upgraded our PeopleSoft Interaction Hub to Tool 8.55 we found out a few things.

Fluid Unified Navigation is only supported between 8.55 and 8.54 environments, and really you should only link 8.55 environments up.

In tools 8.55 the intention is to move away from the old way of navigating, and to create your own home pages.  By default, the old Main Menu has been hidden, and the recommended only way to navigate is through the Nav Bar.  This came as a surprise to us as Unified Navigation with our 8.53 systems didn't work.  In order for Unified Nav to work in the new fluid mode, you must be on tools 8.54 or greater.  We encountered a few issues with 8.54, so it would be ideal to have all streams in your environment at PeopleTools 8.55 for a unified experience.

Idealism is sometimes far from reality, as it is difficult to upgrade all systems at once.    As part of our upgrade plan, have chosen to update our Interaction Hub and HR system to 8.55 first, followed by our Finance System, EPM then finally Campus Solutions.  We have established some workarounds and tricks to allow us to take advantage of the new Fluid Features while bridging to the older systems as we upgrade throughout the year.  Check the Tiles and Homepages Section below for an example on how to create a classic tile in a fluid environment: also check the Security section on how to granularly disable some of the fluid functionality (like add to homepage).

8.55 Isn't for Everyone

You will need to be careful to ensure all your users are using certified web browsers.  For example this link here relays the fact that as of this blog posting, Chrome is only officially supported with Windows.

You will find that fluid pages aren't supported by older versions of IE, or users who use different flavours of the Linux OS: and these systems will be directed to the Classic Homepage Tabs.  Ensure your classic pages still work if there is no way to get around this.

Performance and Caching

Pay attention to your caching settings in your web profile: (Nav Bar > Navigator > PeopleTools > Web Profile > Web Profile Configuration).   The stock configuration as seen in Interaction Hub Image 2 seems to perform well for us in a highly integrated environment.  This was not the case for our Classic Homepage Pagelets ~ so we had to revert to the stock settings.  Fixes in 8.55 allow the system to only render tiles that are requested on the homepage ~ this has large performance improvements over 8.54 where all the tiles were loaded at login.

With these settings enabled. some troubleshooting tips for users having issues (for example the Nav bar not refreshing) would be to hit Ctrl-Shit-Delete on their browser (firefox and chrome) and clear their cookies, and other cache settings.  

Section Six - Comprehensive Testing

With a tools 8.55 fluid roll out, we find that the system now has two personalities: Classic and Fluid.  When designing and testing content in PeopleSoft Interaction hub, it isn't enough just to test one case before you can safely say something is working: a lot of new criteria need to be looked at.

The list below runs through some of the test cases to help troubleshoot specific issues or functionality.

Troubleshooting / Problem Solving Steps for Portal Registry Structures.

• When the user logs into the system for the very first time, do they see different results from a user who has been using the system for a while? (this tests personalization settings).
• Does a Content Reference for what you are trying to access exists on the Interaction Hub, or on the remote system? (CREF found via Nav bar > Navigator > PeopleTools > Portal > Structure and Content)
• Does the issue only happen for fluid CREFS or classic CREFS?
• Can you add your content as a favorite?
• Can you add your content as a tile to a home page?
• Can you can you add your content to the nav bar?
• If you skip the Interaction Hub and go directly to the remote system (for example People Soft Human Resources) does the same issue happen, or is the issue Integration based?
• Does the Issue Happen when you use delivered security roles (PeopleSoft User, EOPP_USER, PAPP_USER) or super user accounts like VP1 on all systems?
• Does the issue happen between different versions of Peopletools? (we have seen much better results when all PeoleSoft systems are at the same tools version).
• Are your IB Settings Configured Correctly? Do your nodes have the correct number of routings? 
• Can you reproduce the problem in vanilla environments like the PUM images?

I usually run through all of these scenarios before creating an SR with oracle support: if they don't solve the issue, at least they would provide some valuable insight.

Section Seven - Other Resources

This article, while still relevant finds itself a few years old.  In terms of additional training, the best fluid course I have taken thus far is Fluid 1 & Fluid 2 with Jim Marion (my inspiration for writing this blog) at JSMPROS.  The course was a informative and funny: you can find out what it takes to become a "Group Box Hero".  I highly recommend!!

Useful Queries for PeopleSoft IH

I have gathered and written a number of queries for the PeopleSoft Interaction Hub.  They help with aspects such as troubleshooting and getting additional information to help with system administration.

These queries require that you have at least read access to your IH Database via SQL Developer.  As I come across more useful queries, I'll keep this page up to date.

Usage: look for the parameter 'CUST', short for CUSTOM ~ this usually refers to a custom role in these series of queries, and can be changed to customize the query to your needs.




Get a list of a users Favorites: (peopletools uses: PSPRUFDEFN, however IH has much more comprehensive favorites (able to save favorites from different content providers).
=============================
select * from SYSADM.PS_EPPSC_MYSHRTCTS where OPRID like 'AAA';


Find out difference of roles between user AAA and user BBB:
=============================
SELECT ROLENAME FROM PSROLEUSER WHERE roleuser = 'AAA'
MINUS
SELECT ROLENAME FROM PSROLEUSER WHERE roleuser = 'BBB';


Get a count of a all users with two specific roles:
=============================
select count(*) from
(select Roleuser from sysadm.PSROLEUSER where rolename= 'CUST_AAA'
intersect
select Roleuser from sysadm.PSROLEUSER where rolename= 'CUST_BBB');


Find out users that have one role but not another.
===================================================
SELECT ROLEUSER FROM PSROLEUSER WHERE ROLENAME = 'CUST_AAA'
MINUS
SELECT ROLEUSER FROM PSROLEUSER WHERE ROLENAME = 'CUST_BBB';


Create DMS to insert records into PSROLEUSER based on Delta of 2 Roles
============================================
SELECT  DISTINCT 'INSERT INTO PSROLEUSER VALUES (' || '''' || ROLEUSER || ''''|| ',' ||''''|| 'CUST_CCC' ||''''||',' || ''''||'N'||''''||');' FROM PSROLEUSER
WHERE ROLEUSER IN (SELECT ROLEUSER FROM PSROLEUSER WHERE ROLENAME = 'CUST_DDD'
MINUS
SELECT ROLEUSER FROM PSROLEUSER WHERE ROLENAME = 'CUST_EEE');


Create DMS to delete a role based on a class definition
==============================================
select 'delete from psroleclass where rolename = '||''''||rolename||''''||' and classid = '||''''||classid||''''||';' from psroleclass a where not exists (select 'X' from psclassdefn b where a.classid = b.classid);


Find out how many users have accessed portal as signed in as CUST_ROLEX
====================================================================
select count(*) from sysadm.PSOPRDEFN a join sysadm.PSROLEUSER_VW ba on a.oprid = ba.oprid where a.lastsignondttm is not null and ba.rolename = 'CUST_ROLEX';


Failed Logins:
===============
select * from sysadm.PSOPRDEFN a join sysadm.PSROLEUSER_VW ba on a.oprid = ba.oprid where a.failedlogins > 0 and ba.rolename = 'CUST_ROLEX';

Structure and content view what has what:
==========================================
SELECT a.PORTAL_REFTYPE, a.portal_label, a.portal_cntprv_nam, a.portal_cref_usgt, a.portal_expire_dt, a.portal_ispublic, a.portal_linkobjname, a.portal_link_portal,  a.descr254,  a.portal_objname, a.portal_prntobjname, a.portal_seq_num, a.lastupddttm, a.portal_ispublic
FROM sysadm.PSPRSMDEFN a JOIN sysadm.PSPRSMPERM b ON  a.PORTAL_OBJNAME = b.portal_objname where b.portal_permname like 'CUST_ROLE%' and a.portal_name = 'EMPLOYEE' order by a.portal_objname;


Find a oprid based on emplid
============================
select OPRID from SYSADM.PSOPRDEFN where EMPLID = '0000000000';


List all custom roles in the system, specify how many References they have, and if the role is dynamic
=============================
select x.PORTAL_PERMNAME, x.counted, y.DYNAMIC_SW from
(SELECT b.portal_permname, count(b.portal_permname) as counted
FROM sysadm.PSPRSMDEFN a JOIN sysadm.PSPRSMPERM b ON  a.PORTAL_OBJNAME = b.portal_objname
where b.portal_permname like 'CUST%' and a.portal_name = 'EMPLOYEE' and b.PORTAL_PERMTYPE = 'R'
group by b.portal_permname
) x LEFT OUTER JOIN
(select  distinct ROLENAME, DYNAMIC_SW from sysadm.PSROLEUSER where DYNAMIC_SW = 'Y') y on
x.PORTAL_PERMNAME = y.ROLENAME
order by x.COUNTED desc;


Find out who is tagging information (peoplesoft IH news)
===================================
select a.EPPTG_PRIV_FLAG, a.OPRID, a.EPPTG_TAG_NAME, EPPTG_ADDTIME, b.EPPTG_ID from sysadm.PS_EPPTG_TAG_DATA a join sysadm.PS_EPPTG_TAG_KEYS b on a.EPPTG_UUID = b.epptg_uuid order by EPPTG_ADDTIME desc;


Summarize Role Counts by beginning with a CUST name
===================================
select rolename, count(rolename) as counted from sysadm.PSROLEUSER where rolename like 'CUST%' group by rolename order by Rolename;


Summarize IB URI Text (Between IH/EP/HR/LS/PF to see if there is an out of place URL)
===================================
select * from PSNODEURITEXT where
MSGNODENAME = 'EMPL' or
msgnodename = 'PSFT_PA' or
msgnodename = 'ERP' or
msgnodename = 'PSFT_EP' or
msgnodename = 'HRMS' or
msgnodename = 'PSFT_HR' or
msgnodename = 'HRMS_LS' or
msgnodename = 'PSFT_LS' or
msgnodename = 'MCM_PSFT_BO' or
msgnodename = 'EPM' or
msgnodename = 'PSFT_PF';

Security Architecture for the Peoplesoft Interaction Hub

The PeopleSoft Interaction Hub, cannot be useful without a comprehensive security strategy.  This strategy first and foremost requires you understand your organization, and the capabilities of the system.  Secondly you will need to ensure you have  done the groundwork for laying a technical foundation of Integration Broker Node Configuration and Single Sign-On.  These will need to be done before you accomplish some of the more technical challenges such as moving messages between the PUB/SUB servers.

In the red paper: Setting up PeopleSoft Interaction Hub with PeopleSoft Applications we are introduced to various methodologies to ensure User Profiles and Roles are synced between systems.  This article has good pointers in terms of technical considerations, but it falls short in some of the design details we came across.  In this blog post we will cover:

• Technologies you can use to synchronize Roles and User Profiles
• Design architectures we considered  (what worked and what didn't)
• The implementation after all things considered.

The Technology

Within the Interaction Hub, a number of delivered roles exist to grant users certain portal specific privileges some of the more common ones are: 

• PeopleSoft Administrator ~ keys to the Castle (aka the VP1 account)
• Portal Administrator ~ administer news / portal registry (structure and content) and other portal features
• Security Administrator ~ administer user profiles / roles and permission lists
• Integrations Administrator ~ administer Integration Broker related configuration

A better source for the assignment of roles lies in the Remote Content Providers, such as your PeopleSoft Human Resources system.  The HCM system should already know which users are Managers, and which users collect a pay slip.  The IH system can use these roles from the HCM system to make new Tabs or Navigation Collections for these two types of users.  So the question becomes how do move the roles from HCM to IH?

Initial Import

Perhaps the easiest way to do this would be to create all the accounts on IH that exist on all of your other servers, manually create the same roles and assign them.  This would be pretty simple to do, but would require a lot of manual work.  Working hard isn't necessarily working smart, and this process can be automated via scripts.

Before getting into scripting, it would be good to understand what you are copying.  PeopleSoft security is composed of a number of tables:

For the User Profile tables:

Attributes such as username, password, and roles are stored in the PSOPRDEFN and PSROLEUSER tables.  

Lesser known functionality is workflow notification and delegation, may not be as important, but should always be considered going forward.

For the Role tables:

Attributes such as role name, permission lists are here.   Additionally, Query Names can be stored here too.

For both Roles and User Profiles, it is important to note some of these tables, as we will be writing queries against these in the future.  

You can script the import of the User Profile tables by running USEREXPORT.DMS and USERIMPORT.DMS.  This would be done along side with adding all the Roles in HCM into a Project and Importing the Project into IH.   

After these two steps are run, we really could leave it here, but there would be a lot of work for the Security team. New accounts would need to be created in two systems, as well as any role assignments will tediously need to be manually synchronized.

Maintaining Security Through Service Operations


PeopleSoft Integration Broker uses Service Operations to move messages from a Publishing Server to a Subscribing Server.  There are 3 Service operations we have used to move roles and role assignments between PeopleSoft Servers.

Via Main Menu > People Tools > Integration Broker > Integration Setup > Service Operations you can find the following:

• USER_PROFILE ~ associated with the User Profile Tables (see above).  This service operation is triggered after particular events, such as when User Profile information is saved.  It can be useful for the following things:
• Create an account on the publishing (PUB) server, it will create it on the subscribing (SUB) server
• Adding / deleting role assignments to one account on the PUB server, will reflect the changes on a SUB server.
• Locking accounts on the PUB server will lock them on the SUB server.
• Changing attributes on Main Menu > My System Profile will publish to a subscribing server: interestingly these are also on User Profile settings.  FYI We ran into some trouble with this feature, as certain servers may need different settings: for example Email Notification and Delegation settings could not be different between our Financials and Human Capital Management Servers.
• ROLESYNCHEXT_MSG ~ associated with Dynamic Role Assignment (uses temp tables, but related to PSROLEUSER table above).  As delivered, I don't believe this process is triggered, but needs to be added as a process via Main Menu > PeopleTools > Security > Permissions & Roles > Roles > [Search for a role] > Dynamic Members on the PUB server. Dynamic Role assignment is useful as long as both Roles exist on both Servers, it will sync both servers every time, no need to do any initial syncing.
• ROLE_MAINT ~ associated with Roles, see Roles Tables (see above).  Syncing from a PUB server to a SUB server is triggered for the following:
• Create a New Role on the Pub server, broadcast to the SUB server
• Modify a role's permission list on the PUB server, broadcast to the SUB server
• Modify a role's Dynamic Queries will also be broadcast: FYI we ran into some trouble with this feature, as the dynamic query should only exist on the PUB servers.  If you point to a dynamic query that doesn't exist this will prevent the batch process from completing, and assigning dynamic queries to other systems.

What we Considered

It is important to realize the magnitude of any large change to an existing system requires rigorous discussion, design, planning and testing.

As we evolved, we went through a few configurations of this instance.  Here is our current configuration and where we would like to be:

Current Setup

Pros

• PUB Servers NOT touched, ie no implications to remote content providers.  
• No need to update service operation messages so that certain attributes will not get over written
• This method DOES work... via dynamic roles and user profiles.  Dynamic Roles don't over-write each other, as long as each role name is unique.

Cons

• No Role sync (ROLE_MAINT), the security team has to manually create roles in each environment.
• The Interaction Hub (PSFT_PA) has all the roles assignments, but the other remote content providers do not.
• Creating and modifying accounts across all servers is tedious work for the security team.

Alternative Setup

Pros:

• One system (in our Case, HCM) is the source for all USER_PROFILE and ROLE_MAINT message publishing.
• Updating / creating a user in one place: IE locking their account can be done in one place, and the message will be broadcast to all other servers.  Adding accounts is accommodated via the careers portion of HCM
• Updating / creating a role in one place will broadcast to all other servers
• Dynamic Roles still originate from remote content providers (based on query) and are assigned to the IH server to be used to drive key content.

Cons:

• This method is more complex and has a larger impact to servers other than the Interaction Hub.  We ran into the issues with the USER_PROFILE and ROLE_MAINT service operation messages copying content that wasn't relevant for each system.  See the two RED FYI's above.

Other Considerations:

Role syncing works because we are only copying role assignments between the servers.  We are not copying the permission lists.  Thus the role PSCUST_VIEW_PAYCHECK can exist on all of your PeopleSoft Environments.  The HCM Environment would have permission lists in the role that assigns access to the view Pay Slip page, but all the other environments would just have the role assignments. Again this is useful for the PeopleSoft Interaction Hub to make short cuts based on this role information, and if utilized correctly, can be a good comprehensive security strategy for your entire PeopleSoft environment.

• Roles with different functionality must not share the same names between environments. Role assignments will not be correct if a role with the same name has a different purpose.
• Accounts need to all have same psoprdefn passwords. This is key for some of your delivered accounts, that could have a certain password hard coded for example: PTWEBSERVER 

Implementation

The steps below describe how we enabled service operation security to sync user profiles and roles.

Syncing Roles / User Profiles / and Dynamic Role Assignments between systems.
-Ensure your Default Local Nodes are correctly set up
-Ensure your PUB/SUB servers are running
-Ensure you have read the steps for the USEREXPORT/USERIMPORT.dms scripts to get environments initially synced.

-Maintaining role synchronization;

• For each server in your environment, GoTo: Peopletools - IB - Integration Setup - Service Operations, search for USER_PROFILE
• Click View Message
• Disable the following table records from syncing: 

• PSOPRDEFN
• EMAILID
• DEFAULTNAVHP 
• PRCSPRFLCLS 
• OPRCLASS 
• ROWSECCLASS 

• PSROLEXLATOPRVW (this fixes the first RED FYI above)
• WORKLIST_USER_SW
• EMAIL_USER_SW
• FORMS_USER_SW
• EMPLID
• ROLEUSER_ALT
• ROLEUSER_SUPR
• EFFDT_FROM
• EFFDT_TO

Save

Do the same steps for: ROLE_MAINT Service Operation:

• PSROLEDEFN  (this fixes the second RED FYI above)
• QRYNAME
• QRYNAME_SEC
• ROLE_PCODE_RULE_ON
• ROLE_QUERY_RULE_ON
• LDAP_RULE_ON

Save

Setup Service Operation
For each of the 3 service operations: {ROLE_MAINT, ROLESYNCHEXT_MSG, USER_PROFILE}:

For PUB Servers:
GoTo: Main Menu  - PeopleTools - Integration Broker - Integration Setup - Service Operations
Search For Service Operation: {ROLE_MAINT, ROLESYNCHEXT_MSG, USER_PROFILE}

Under General

• Ensure Default Service Operation Version is Active
• Ensure Service Operation Security has been set ~ this is important for the ROLESYNCEXT_MSG service operation as it needs to be triggered by a batch process.

Under Routings

• Add a new routing
• Under Routing Definitions
• Set a name and Description
• Set Sender Node as Default Local PUB node (ie for USER_PROFILE set  PSFT_HR), and Receiver Nodes as Default Local SUB Nodes (ie for USER_PROFILE set PSFT_PA and PSFT_EP and PSFT_LS and PSFT_PF)

Return and Ensure all other routings are inactive

For SUB Servers:
GoTo Main Menu - PeopleTools - Integration Broker - Integration Setup - Service Operations

Search For Service Operation: {ROLE_MAINT, ROLESYNCHEXT_MSG, USER_PROFILE}

Under General

• Ensure Default Service Operation Version is Active
• Ensure Service Operation Security has been set  ~  this is important for the ROLESYNCEXT_MSG service operation as it needs to be triggered by a batch process.
• Ensure Generate Any to Local has been checked

Under Routings

• Ensure all other routings are inactive (except the PUB routings you created).

Set Security Override ~ when the USER_PROFILE process is triggered by a regular user saving their my system profile (this sometimes happens and blocks further messages from processing):

• Sign on into the sending system's PIA
• Navigate PeopleTools > Integration Broker > Configuration > Service Configuration
• Switch to Exclude PSFT Auth Token tab
• In the Operation field enter USER_PROFILE and ROLE_MAINT
• Click the Search button
• In the search results, notice checkbox of the leftmost column of the USER_PROFILE and ROLE_MAINT row.
• If the setup is not done, it would be UNchecked, if so click it to check and once it is checked, save the changes.

Integration Broker and Single Sign On

Our first goal is to go from a vanilla installation of PeopleSoft IH to one which allows a multitude of users with different roles to access different PeopleSoft content.

As I mentioned in the previous article, it is important to become familiar with the Setting up PeopleSoft Interaction Hub with PeopleSoft Applications red paper.

Basically this document describes the steps needed to configure Integration Broker (IB) and Single Sign On (SSO).  I would suggest meticulously following this article, with the assistance of your PS Admin.  A lot of things can go awry in these early steps (we came across a lot of issues with typos in the Node URIs).

When these steps are complete you should be able to do the following:

TESTING SSO (troubleshooting steps are below)

a) Create user TESTPORTAL in IH and one of your remote content providers, say HR.
b) Assign the 3 delivered roles to TESTPORTAL in both environments:

• PAPP_USER
• EOPP_USER
• PeopleSoft User

Via Main Menu -> PeopleTools -> Security -> User Profiles -> Add New Value: TESTPORTAL

minimum settings General Tab

minimum settings ID Tab

minimum settings Roles tab

these 3 roles have the minimum permission lists needed to see content when connecting to two servers.

c) Login to HR as TESTPORTAL and copy the URL for Main Menu -> My System Profile

d) Log out of HR and Login to IH as TESTPORTAL and Pate the URL you copied into the address bar.  If the URL opens, without asking you to Sign In again, we confirm that SSO is working, and we are off to the races!

 TESTING IB NODE CONFIG (troubleshooting steps are below)

Once SSO has been confirmed as working, we need to test that we setup our Nodes Correctly.  It is important to understand the naming conventions of your Nodes.  

Building off the example above, with the same account created above.

a) Login to IH as TESTPORTAL
b) Navigate to Main Menu -> My System Profile

Let's take a closer look at the URL on your IH server:

yours should look similar to this:

https://ENVIRONMENT/psp/SITENAME/EMPLOYEE/EMPL/c/MAINTAIN_SECURITY.USERMAINT_SELF.GBL?CONTENT_PARAMETERS

Take note of EMPL ~ this should be the Employee Portal Host name for the Interaction Hub Environment.

c) To test the default Local Node, change EMPL to PSFT_PA: the page should load exactly the same as it did before.  Testing the default local node, will ensure Integration Broker is setup correctly: We'll get into why this is important later.
d) To test the HR Employee Portal Host name, change PSFT_PA to HRMS: the page should load exactly the same as it did before, with one important caveat: we are not viewing My System Profile on the HR server.

Let's say the user TESTPORTAL doesn't want Email User Selected for their Workflow Attributes

e) Uncheck Workflow Attributes: Email User on your HR environment My System Profile and Save.
f) You should now be able to tell the difference when you toggle between HRMS and EMPL,

SUMMARY
After configuring ~ SSO and IB Nodes, in our Hypothetical Environment the Portal Administrator should be aware of the following Node configurations:

Node Type	IH	HR
Employee Portal Host Name	EMPL	HRMS
Default Local Node	PSFT_PA	PSFT_HR

It is important to know the names of these going forward.  We will examine the structure of the Peoplesoft URL in more detail, as it gives us a lot of information that is very useful.

TROUBLESHOOTING
Again there are a lot of things that can go wrong when you are configuring SSO and Nodes on IH and your Remote Content Providers.  Here is a list that I use to troubleshoot any issues.

a) Confirm the User Account Exists on all Required PeopleSoft Servers:

• The username on the account must be identical on the two servers
• Ensure it's not locked out
• Ensure it has the 3 core Security Roles: PAPP_USER, EOPP_USER, PeopleSoft User: your Security Admin will likely want to make a customized Role that has a Combination of these 3 roles within it.

b) Ensure your Integration Broker Nodes are correctly configured

• Carefully check the addresses of your default Local and Employee Portal Host Name nodes.  Via Main Menu -> People Tools -> Integration Broker -> Integration Setup -> Nodes: Select the one in question, and via the Portal tab, ensure the URL is correct.  (even note the trailing slash here).
• There are likely Default User ID / Node Password permissions issues (in the Node Definitions Tab)  that can occur: ensure whoever is configuring these (ie your PS ADMIN) has a strategy for setting these properly. (Especially if accounts like VP1 / PS will be disabled).