Administration Refreshing from Production When refreshing from production, there are a few caveats that need to be considered. This is my attempt to create a checklist of areas within your PeopleSoft system you may want to review after a refresh from production into your test, development and other environments. Integrations. If you have any messaging to any 3rd party systems, will these messages still be sent? You may need to disable or point your nodes/routings to an appropriate non-production environment. You'll also need to change your gateway settings. 3rd Party Systems. Does your system have any interfaces to 3rd party systems? What would happen if these were available in your non-production environments? Communications. Is it possible to send email messages from your non-production system? Will those go to real customers within your system? Better safe than sorry! Security. Roles and permissions will probably need to be changed for certain users (analysts, developers, testers, DBAs), while you might want to take security away from other users. For example, do you really want self-service users to be able to access a non-production system? Authentication. Do you want to continue using directory authentication in your non-production environments? Should this be turned off? What about two-tier access through tools such as Application Designer and Data Mover - can they be accessed or will users need to reset their PeopleSoft passwords? Passwords. You might want to reset system passwords (PeopleSoft accounts, database accounts, system accounts) so that users of the non-production system can do more without knowing production passwords. Or perhaps they need to know some of these passwords? Database Links. Do you have any database links? Do these need to be changed in non-production systems? Web Profile. You might want to change your timeout and cache settings. Reporting Nodes. You'll need to change your process scheduler reporting nodes to point to the appropriate reporting server for your non-production environment. Scheduled Jobs. Do you have any scheduled jobset definitions or recurrences running? Should they continue to run in your non-production environment? Process Requests. Do you want to keep existing process requests OR should you clear them out? Tracing. Are there any trace settings you want to turn on? Do you want to give your users more access to perform traces? Where will the output of these traces go?Default Stylesheet Before changing stylesheets you first need to know what your "primary" stylesheet is. This is set under: PeopleTools > Utilities > Administration > PeopleTools Options The default delivered stylesheet is PSSTYLEDEF. However if your environment has been rebranded then chances are another stylesheet is in use. This is also where the Branding Application Package and Branding Application Class are set. By default these are set to the PT_BRANDING application package and BrandingBase class.Web Profile Configuration he web profile look and feel settings are where custom pages can be defined for certain PeopleSoft pages that aren't internal page objects available in application designer. Examples of this include the PeopleSoft signon page, expiration/timeout page, logout page and password expiration/warning pages. Web Profile configuration is located under: PeopleTools > Web Profile > Web Profile Configuration Note that you will need to know which web profile is currently in use. You can find this from the web profile history: PeopleTools > Web Profile > Web Profile History This also gives you other useful information about the current web server configuration (click on the web server URL to view).Hide the Copy URL Link The Copy URL link is the little http icon and http text displayed on the right hand side of the page bar for components where the page bar is enabled. It is used to copy the URL of the current component you are in to the clipboard using JavaScript. The standard way to hide this link is to disable it in the component properties (Internet tab) on the page bar settings for each component. This works fine if you want to disable it for a few components. But what if you want to turn it off for all components? The traditional approach has involved manipulating PeopleTools tables. However, with PeopleTools 8.5x, there's a much simpler way. Use CSS to simply hide the icon. First, open the delivered freeform stylesheet, PSIFRAME. Scroll to the bottom and add the following CSS with appropriate customisation comments for your organisation /* DD/MM/YYYY Author -> */ /* Hide the Copy URL icon and text */ a#COPYURL { display: none !important; } /* DD/MM/YYYY Author <- */ Save the stylesheet and reload the pages to test. The !important rule enforces the change regardless of when this stylesheet is loaded - it is essentially a global override for the display property.PeopleSoft Servlet Directives PeopleSoft Servlet directives give you a number of useful functions. To use them, append the appropriate directive after your the URL e.g. /?cmd= http://{hostname}:{port}/psp/{site}/?cmd= The easiest way to get the correct URL is to visit the sign on page of the relevant environment and replace ?cmd=login with the appropriate directive. The directives typically also need a password, and the default password is dayoff. However if you get the message: You are not authorized to use this feature! It means the password has been changed in the web profile configuration. Navigate to: PeopleTools > Web Profile > Web Profile Configuration Browse through the list of web profiles (unless you know the one that's in use). In the custom properties tab there will be a property called auditPWD (type = string) and a value which is the profile password. Use this password, or if there is none set, add this property. NOTE: removing the property doesn't give full access, it takes away all access! Here's a list of directives (but there could be more): Directive What it Does ?cmd=viewconfig&pwd=dayoff View the current web profile ?cmd=reloadconfig&pwd=dayoff Reloads the web profile in use ?cmd=viewsprop&pwd=dayoff Displays session properties ?cmd=debugCache&pwd=dayoff Manage web cache - use IE ?cmd=purge&pwd=dayoff Purge the web server cache. If it doesn't work immediately, try issuing this command at least another 3-5 times in a row (simply hit the URL over and over, no need to wait). Sometimes stubborn caching isn't immediately purged the first time your run this. PSAdmin PSAdmin is used to administer PeopleSoft servers such as the application server, process scheduler and search server through a command line interface. The PSAdmin command lives in PS_HOME\appserv and allows for a number of very useful parameters. To get a full list with examples, type psadmin -h. The commands are broken down into the various servers: Process scheduler: psadmin -p -d Search server: psadmin -s -d Application server: psadmin -c -d I'm not sure why the application server command is -c instead of the more logical -a ? To get environment variables set by psadmin: psadmin -env Process Scheduler Administration Check the status of a process scheduler database (option 8): psadmin -p status -d YOURDB If you see a list of the servers great. If you see a message like: TMADMIN_CAT:111: ERROR: No such command This suggests the process scheduler is down. Start (option 1), stop (Option 2), kill a process scheduler server (Option 9) and clean IPC resources (option 10) on a process scheduler database: psadmin -p start -d YOURDB psadmin -p stop -d YOURDB psadmin -p kill -d YOURDB psadmin -p cleanipc -d YOURDB Application Server Administration Check the server status of the an application server domain (is it up or down): psadmin -c sstatus -d YOURDOMAIN If you see a list of the servers great. If you see a message like: TMADMIN_CAT:111: ERROR: No such command. This suggests the domain is down. Perform a boot (option 1), domain shutdown (option 2, 1), forced domain shutdown (option 2, 2), purge the cache without archiving and log some comments (option 8) and clean IPC resources (option 10) on the application server domain: psadmin -c boot -d YOURDOMAIN psadmin -c shutdown -d YOURDOMAIN psadmin -c shutdown! -d YOURDOMAIN psadmin -c purge -d YOURDOMAIN -noarch -log "Manual Cache Purge" psadmin -c cleanipc -d YOURDOMAIN Web Profiles Web profiles define the portal configuration for your PeopleSoft application. They are available through the following navigation: PeopleTools > Web Profile > Web Profile Configuration One of things you'll need to work out is which web profile configuration is actually in use! There are quite a few delivered options including: DEV TEST PROD KIOSK You typically choose the web profile configuration to be used when installing the PeopleSoft PIA. This is stored in a file called configuration.properties but contrary to what PeopleBooks might tell you, this file doesn't always live in PS_HOME\webserv. In fact if you're using Oracle Application Server (OAS) it will most likely be located somewhere like this (adjust your slashes accordingly): {OAS_HOME}\j2ee\{Application_Name}\applications\\PORTAL\WEB-INF\psftdocs\ps This may vary, and obviously will be different if you're not using OAS as the web server. {Application_Name} is typically PeopleSoft. The other option is to look at the web profile history using: PeopleTools > Web Profile > Web Profile History This also gives you detailed information about the web profile configuration and the web server. You can also try using the viewconfig servlet directive (if you have access and know the web profile password (by default it is dayoff). Also here are a list of relevant PeopleTools tables: Table Description PSWEBPROFILE Main record with general web profile properties PSWEBPROFBROW Web profile browser settings PSWEBPROFCOOK Web profile cookie settings PSWEBPROFDEF Web profile defaults PSWEBPROFHIST Web profile history PSWEBPROFNVP Web profile name value pairs PSWEBPROFPROP Web profile custom properties Default Menu Pagelet PeopleTools 8.5x introduces a new Menu pagelet (the left hand navigation menu), and refers to the old Menu pagelet as Menu - Classic. When you are on the homepage, you can personalize your content and select between these menu pagelets as shown: [![personalize-content-menu.png]/uploads/images/gallery/2019-08/scaled-1680-/personalize-content-menu.png)]/uploads/images/gallery/2019-08/personalize-content-menu.png) By default on a PeopleTools 8.5x demo environment, the new Menu pagelet will be used (and not Menu Classic). However, if you are upgrading your application, you may find the settings aren't what you expect. For example, instead of seeing the new menu, user's may see the older menu which has the title Menu - Classic as shown: There are two reasons why this might happen: The default menu pagelet is set to the older Menu - Classic pagelet The user's personalisation has been carried forward with the Menu - Classic option To check the default system-wide menu pagelet in use: PeopleTools > Portal > Structure and Content Navigate into the folders: Portal Objects > Homepage > Tabs Open (Edit link) the My Page content reference and switch to the Content Tab, tab. If you see Menu - Classic with the setting Opt-Dflt then that means the classic menu will be used as the default menu: The delivered default is to have all these set to Optional or if you want to be pedantic Menu set to Opt-Dflt: A user can also personalise their content, including their menu pagelet. When upgrading an application, the menu pagelet setting may be carried forward by default to use Menu - Classic. To check for users where this is the case, use the following SQL: select * from PSPRUHTABPGLT where PORTAL_OBJNAME_PGT = 'PT_84X_MENU'; If you want to script a fix for this, the value of the PORTAL_OBJNAME_PGT field should be changed from PT_84X_MENU to MENU to use the new PeopleTools 8.5x menu.Limit Control+J Information The browser shortcut key combination Control+J or Ctrl+J (which you sometimes need to press twice in browsers) provides some really useful information. However, in a production environment there is some sensitive information you might want to remove from the display such as: Database Name Database Type Application Server Optionally, you might also want to remove: Tools Release Application Release Service Pack You can bet that if you have organised any penetration testing this will be one of the first things to get picked up. The web profile settings allow you to turn Control+J on or off under: PeopleTools > Web Profile > Web Profile Configuration > [Open the relevant web profile, e.g. PROD] On the debugging tab, enable the Show Connection & Sys Info checkbox to enable Control + J. On changing this the web profile will need to be reloaded using servlet directives or a web server restart. However, turning off Control+J is an all or nothing setting and turning it off also takes away some of the valuable information it provides. A compromise is to limit the Control+J options through a simple customisation. In application designer, open the HTML definition, PT_INFOPAGECONNECT. This is the HTML displayed on the Control+J page. The labels for each element are stored in the message catalog. Here's how they map: Message Set Message Number Message Text 146 50 Browser 146 51 Operating System 146 52 Tools Release 146 53 Application Release 146 54 Service Pack 146 55 Page 146 56 Component 146 57 Menu 146 58 User ID 146 59 Database Name 146 60 Database Type 146 61 Application Server 209 831 Component Buffer Size (KB) To hide the information that is sensitive, simply use HTML comments to comment out the parts you don't want to show, e.g. for the Database Name, Database Type and Application Server (59,60,61) you could change the code in the HTML to this: This is how Control+J now looks with above information commented out: You would do a similar thing for Tools Release, Application Release and Service Pack (52,53,54) if you did not want to show that information either.Portal Registry The portal registry is collective term used to describe the online navigational structure of the PeopleSoft Internet Architecture (PIA) portal. The portal is made up of folders and content references (CREFs). This article provides some help around the portal registry. Portal registry entries don't appear after migration First, double check that the portal registry entries have been migrated successfully. PeopleTools > Portal > Structure and Content Navigate to whereever your portal entries should be and make sure they are there. Also check the database using the following query to ensure your content references/folders exist: select * from PSPRSMDEFN where PORTAL_OBJNAME like 'Your Portal Object Name'; If they are not there, go back to your project and check that: The necessary portal registry definitions are in your project The upgrade flag is set and the action is set to copy They might not appear since there is always a lot of caching when you migrate registry objects. Once quick way to test this is to add a dummy registry entry anywhere in the navigation (eg a content reference pointing to an external site and make sure you save it) and the database save forces a cache refresh and this will then show up the cached entry. Make sure you then delete your dummy entry you created. This is good for development when you are migrating between databases and do not want to bring down the web server to delete the cache. Registry Search Index This is the verity search engine's index which is used to find portal registry entries in PeopleSoft. The application engine used to build the registry search index is PORTAL_INDEX You can run this from: PeopleTools > Portal > Build Registry Search Index Portal Security Sync To run portal security sync, you need access to every single folder and content reference in the portal. NOTE: portal security is based on menu security for content references (CREFs) but folder security is set at the portal level. The two specially delivered roles that will give you this is: PeopleSoft Administrator Portal Administrator Be warned however that PeopleSoft Administrator is all powerful!. So it is safer to give someone portal administrator if their job involves running portal security sync. I've found that if you don't have a role that gives you access to the entire portal structure, the portal security sync application engine program (PORTAL_CSS) will run to no success (abend) with a message like this in the standard output (.stdout) file: First operand of . is NULL, so cannot access member ItemByName. (180,236) PORTAL_CSS.CREFPERM.GBL.default.1900-01-01.Step01.OnExecute Name:CheckParentFolder PCPC:2339 Statement:40 Called from:PORTAL_CSS.CREFPERM.GBL.default.1900-01-01.Step01.OnExecute Statement:202 Message Catalog The PeopleSoft message catalog (or catalogue) is used to store errors, warnings and information messages in a common repository. It is really a fantastic example of reuse - all messages are stored in the one location. You can access the message catalog using the following navigation: PeopleTools > Utilities > Administration > Message Catalog Behind the scenes, the message catalog uses the following PeopleTools records: PSMSGSETDEFN - Messages group by message set (a header record really) PSMSGSETLANG - Related language record for PSMSGSETDEFN PSMSGCATDEFN - Messages grouped by message set and number PSMSGCATLANG - Related language record for PSMSGCATDEFN Message Sets One way to allocate message sets is by a base unit of work (an Application Designer project for instance). However, you may find that you don't end up creating a lot of messages, so the other option is to use just one message set. Perhaps you might divide your message sets up by functional area. There are numerous options, but the key is to use a standard approach. PeopleSoft reserves all message sets up to 20,000 (1 to 19,999). So you should start custom message sets from 20,000 onwards. Messages There are three things you need to decide when you create a message: The severity (cancel, error, message, warning) The message text The explanation Message Severity Severity is important. For example, the MessageBox function treats message severity as follows (from PeopleBooks): Message: The message is displayed and processing continues Warning: The message is displayed and treated as a warning Error: The message is displayed and treated as an error Cancel: The message is displayed and forces a Cancel Based on the above scenarios you should be able to pick what type of message you are dealing with. Remember that an error stops processing while a warning does not. NOTE: do not use WinMessage anymore. It is a deprecated PeopleSoft function and you should be using MessageBox instead. Also be warned that WinMessage can causing very strange problems with your PeopleCode processing. Message Text I like to use message text as stating the error, warning or information as succinctly as possible. The message text is limited to a maximum of 100 characters. You can pass bind values (%1, %2, %3 ... %n) to the message text using PeopleCode functions like MsgGet, MsgGetText and MessageBox. However MsgGetExplainText is to pass bind values to the explain text and not the message text. NOTE: MsgGet will append the message set and number to the message while MsgGetText does not. Explain Text The explain text is a good place to tell the user further information or what to do to fix an error or why a warning is being given. Don't just repeat the message text. You can pass bind values (%1, %2, %3 ... %n) to the explain text but only using the MsgGetExplainText PeopleCode function.Password Controls If you are using internal PeopleSoft authentication (not 3rd party LDAP), then PeopleSoft provides some useful password controls to improve the security of your system. These can be found under: PeopleTools > Security > Password Configuration > Password Controls Behind the scenes this information is stored in the table PSSECOPTIONS. Password controls are enabled by Signon PeopleCode. This PeopleCode (as delivered) exists in Record PeopleCode on FUNCLIB_PWDCNTL.PWDCNTL.FieldChange within the function Password_Controls. So if you wanted to, you could modify this Signon PeopleCode to perform extra security checks. Some of the more useful things you might consider setting here are: Set a password expiry e.g. 180 days and warn for at least a week. Maximum logon attempts (e.g. 5) Don't allow the password to match the user ID. Minimum password length (at least 8 characters) Have at least one digit in the password RRemember password security is one of those compromises between convenience and security. You could also set the number of passwords to retain to stop people reusing their old passwords. If there's ever a breach in security, then this might be a good feature to enable. How does PeopleSoft check for the scenarios you've set? There are three places that have code to do this: Password_Controls function in FUNCLIB_PWDCNTL.PWDCNTL.FieldChange (Signon PeopleCode) Validate_Password function in FUNCLIB_PTSEC.OPERPSWD.FieldFormula (called when modifying users) Password_History function in FUNCLIB_PTSEC.OPRID.FieldFormula (called when modifying users and password history checking is enabled in the password control). Password_Controls peforms the following validation: Incrementing failed login attempts in PSOPRDEFN.FAILEDLOGINS when a user enters an invalid password. Checking the maximum logon attempts by using the failed logins stored in the operator definition table (PSOPRDEFN.FAILEDLOGINS). Note that if the failed logins reaches the maximum amount set, it will lock the account. Checking password expiry which is the difference in days between the system date and the last password change made by the operator (PSOPRDEFN.LASTPWDCHANGE). Validate_Password performs the following validation: Not allowing the operator ID to match the password is a compare between the operator ID and operator password fields in the operator definition table (PSOPRDEFN.OPRID <> PSOPRDEFN.OPERPSWD). Checking the length of the operator's password against the minimum password length settings. Checking that the password contains at least the required number of digits or special characters. PeopleSoft special characters consist of the following: !@#$%^&*()-_=+\|[]{};:/?.<>, as well as a blank space. Checking that if the password has expired, the user does not enter the same password - they need to change their password. Password_History peforms the following validation: If password history checking is enabled in the password control settings, it goes through the record, PSPSWDHISTORY, going back the relevant number of password changes and compares the encrypted password in the password history table against the encrypted password being entered by the user. If they match then it gives the appropriate error. Event Notification and Output to a Window With the help of Real time event notification server and notifyToWindow method in PeopleSoft we can configure the output to a window and publish the notifications to a new window. REN servers are used by PeopleSoft applications to push event notifications to users, such as reports to be printed to a separate browser window. This article explains how to: Configure the REN server Assign permission to run a report to window to the User id Test the REN server configuration Configuring the REN Server The REN server is configured via the application server domain (through PSAdmin). Launch psadmin from %PS_HOME\appserv. Select the application server domain, the Quick configuration menu is launched. Set the Event Notification feature to Yes (option 8) as shown: Then select option 14 to load the custom configuration. Go to PSRENSERV section and set the options accordingly: Once the REN server is configured on the application server domain check if it reflects on the PIA. Pinging the REN Server is a validation that everything went okay with your setup. Navigate to: PeopleTools > REN Server Configuration > REN Server Definition To check the application server domain name, port number and host name. Test the server configuration from PIA by navigating to: PeopleTools > REN Server Configuration > REN server Cluster The Buffer test and Ping test should give meaningful results. Example PeopleCode With a minimal code we can view the notifications and output in a window. Using the Notifytowindow method in the PT-PRCS application package, below is a sample code written on the Portal CSS application engine program. import PT_PRCS:API:*; Local PT_PRCS:API:PrcsApi &api = create PT_PRCS:API:PrcsApi(); &strl_WindowMsg = &strl_WindowMsg | "
step 1/5:Portal Security Sync Starting. ("; &strl_WindowMsg = &strl_WindowMsg | DateTimeToLocalizedString(%Datetime, "HH:mm:ss") | ")"; &nret = &api.notifyToWindow(AEPORTALCSS_AET.PROCESS_INSTANCE, &strl_WindowMsg); These are the results from this modification: As you can see, the REN Server aids to publish Real-time Event Notifications to users, saving the effort of repeatedly clicking on the Refresh button in Process Monitor. This is a guest article by Shilpa Reddy. Thanks for your contribution.Manage Users with a Component Interface Sometimes, you might need to work on a PeopleSoft instance that doesn't have a PIA. While you can still do a lot of things, one thing that is quite hard to do is managing users - create new users and modifying existing ones using the database alone. Fortunately, there's a workaround. If you have two-tier application designer access (i.e., database access), you can use the component interface tester and a few component interfaces to manager users. Clone a User If you want to create a new user, the easiest way is to clone an existing one. The component, USER_SAVEAS provides this functionality. There probably won't be a component interface for this so create a new component interface in application designer based on the USER_SAVEAS component, and accept the default properties. You'll need to save the component interface (e.g. USER_SAVEAS_CI) before you can work with it. Now, click on the right hand side of the screen (CI side), and choose: Tools > Test Component Interface. Once the tester has loaded, simply select the OPRID of an existing user, like VP1 or PS and click on Get Existing. Change the following properties: OPRID to your new username OPERPSWD to an appropriate password OPRDEFNDESC to an appropriate description for your user (e.g. their name) OPERPSWDCONF to the password you set (confirm password) COPY_IDTYPES to N (don't copy the ID information from the user like their Employee ID). Right click on the top of the CI tree (USER_SAVEAS_CI) and choose the Save method as shown: If it all works, you will get a Save() results return value of 1. Go check PSOPRDEFN to confirm, and of course try logging in as your new user. Slightly easier than trying to figure out all the relevant PeopleTools tables and writing a script hey? Modifying an Existing User To modify an existing user, you can use the delivered component interface, USER_PROFILE which is based off the component USERMAINT - the component you use to edit a user normally. Again, open the component interface and choose: Tools > Test Component Interface. You'll need to specify the UserID (OPRID) and press Get Existing. There are many things you could do from here: Change the PrimaryPermissionList Change the RowSecurityPermissionList Expand out EmailAddresses and modify the email address Expand out Roles and add another role Change the User's Password If you are adding a value to a collection, like Roles, right click on the collection and choose InsertItem. Use an index [Number] of the last index. For example, if your user has 6 roles, then the last entry will be Roles [6]. So use an index of 6. Note you'll need to do this twice for some strange reason. If you use an invalid index, the following message will appear: 001: Invoke - [InsertItem]. (Errors Pending) Invalid item number. {USER_PROFILE.Roles.InsertItem} (91,54) You'll know it has worked if you see another entry in Roles (and not the error above). Continuing with the example of 6 roles, there should now be a Roles [7] entry you can expand on and where you can specify the role name (e.g. PeopleSoft Administrator). Then go back to the top of the tree, right click on USER_PROFILE and press Save. You might be wondering how to change the password? Well, right click on the top, USER_PROFILE CI and click on the SetPassword method. Then specify your new password.