PeopleSoft PIA Web Instance Security/Configuration

I believe with release of PeopleTools 8.44, they introduced a new feature that requires a user id for internal web server communication to load web profile information from the database and also performance agent information.

By default PeopleSoft delivered the product with the default userid PTWEBSERVER.  Which uses a default delivered role of “PeopleTools Web Server”, which links to the delivered permission list “PTPT1500”.

When you build your PIA (PeopleSoft Internet Architecture) you will be asked to enter a userid and password for this internal web server communication.  If the information is incorrect you will often see the error: “CHECK APPSERVER LOGS. THE SITE BOOTED WITH INTERNAL DEFAULT SETTINGS, BECAUSE OF: bea.jolt.ApplicationException: TPESVCFAIL – application level service failure”.

This user information is stored in the configuration.properties file, which is located in the:

<webserv root>/applications/peoplesoft/PORTAL.war/WEB-INF/psftdocs/<piasite>/ folder (for weblogic)

You will notice that the userid/password are encrypted.  This encryption is done using the PSCipher utility that is delivered with the pia.  I haven’t verified this but in past releases you could enter the userid and password unencrypted and it worked fine, however, I always encrypt them now, so I have tested this against 8.5x.  It should also be noted that the userid and password are both case-sensitive.

To encrypt the password use the PSCipher script located at <webserv root>/bin. PeopleTools 8.51 moved utility files to the folder <webserv root>/piabin. I usually run the setENV first (however, it usually does it for you now) and then run PSCipher <newpasstoencrypt>.  It will return an Encrypted password in the form:   {V1.1}xxxxxxxxxxx= copy this password and place it into the configuration.properties file.

If you are still experiencing a problem, make sure that the user you are trying to connect with has the correct password entered into the user security screens, and that the account is unlocked.

With the release of the 8.51 Tools they also introduced a password for the domain.  You set this password in the configuration of the application server, and you have to enter it for things like integration broker and also in the PIA web configuration.  This password is encrypted the same way in the configuration.properties file.

Happy Configuring!

 

Unix – chmod – File Permissions

Every now and then I find that I am battling permission issues in the unix environment and it usually turns out to be the permissions that are set on the directory or file.  Unix has an interesting way of handling permissions.  If you do a list command “ls -l” you will see a box of information on the left that looks like:

———- (10 dashes) If you see this, the file has NO rights (pretty rare).

The first position you will commonly see a “d” or “l”, the “d” is for directory, and “l” is for a link.

Position 2 to 4 are the owner permissions “rwx”, where “r” is read, “w” is write, “x” is execute

Position 5 to 7 are the group permissions “rwx”, where “r” is read, “w” is write, “x” is execute

Position 8 to 10 are the world permissions “rwx”, where “r” is read, “w” is write, “x” is execute

You can change the permissions using the command: “chmod”

To grant the read permission you give a value of 4, write permission is 2, and execute is 1.  So if you want to grant read+write, you would do 4+2 = 6.  And when you issue the chmod you give it a number for each permission (owner, group and world), so if you wanted to give the owner, group and world read and write access to a file you would issue the command:

chmod 666 filenametochangepermissionsto

Another useful function is the chown function, which changes the owner and/or group permission.

chown user:group filenametochangeownershipto
chown -R user:group directorytochangeownershiptorecursivelyto


Report Repository – Using Scheduler Transfer

When configuring the Report Repository using the Scheduler Transfer tool you will want to configure the node using the http/https settings:

Home > PeopleTools > Process Scheduler > Report Nodes

The URL will be the same as it always is, this variable is primarily used for the link in process monitor to view the reports/logs.  The URI host is usually set to the web server name, however, if you are using a load balancer you might wish to use one web server to handle the traffic or configure it to go to an internal site that can handle the balancing.  URI Port will be the port of the webserver, typically the regular access port, but if you are using a balancer and it is redirecting the port may need to setup with the internal port number.  URI Resource is the class that handles the transfers, it should be:

SchedulerTransfer/<piasite>

Be very careful of case here.  See picture as an example.  Lastly, you will want to make sure that the user that is handling the process scheduler in question has the Role: ProcessSchedulerAdmin, and that the default Local Node has been configured to have a password associated with it (Home>PeopleTools>Integration Broker>Nodes).

Cobol Server Express – License Manager

When doing the initial installation for most PeopleSoft environemnts you need to do several installations one of them being Cobol Server Express if you are running Cobol on a Unix environment.  Most PeopleSoft 9.1 applications support using version 5.1.

After you get the license installed, you need to ensure that the license manager is running.  Three commands will come in handy here:

1. Stopping License Manager, you need to be root to do this:

cd $COBDIR/lmf
lmfgetpv k

2. Show Status of License Manager: (If running it will return the version, if stopped it will report it is stopped)

cd $COBDIR/lmf
lmfgetpv

3. Staring License Manager, you need to be root to do this:

cd $COBDIR/lmf
sh ./mflmman

You can change the directory to {COBDIR}/aslmf and then run ./apptrack If this is the first time it will ask you to set a password or enter in 6 blank spaces to set the password to null. Once the password is set, you can select from the list of options to show a license summary. This should show your license you have installed, and if it doesn’t you can install your license from this menu.

If you are using a LMF Development License, you can install it by going to {COBDIR} and running the command:

sh mflmcmd

Enter I to install a license, enter in your Serial and License numbers you received from Oracle. You should now be able to go back into apptrack and see the installed license.

PeopleSoft – Redhat (RHEL5.7) – sysctl parameters

Just to drive the system administrator nuts, for some reason Redhat sysctl parameters by default are not robust enough to handle starting up even a small application server. There are several cases on My Oracle Support that explain how to set the variables but at a minimum I found this to a good starting point:

fs.file-max = 65536
kernel.msgmni = 512
kernel.msgmax = 1048576
kernel.msgmnb = 1048576
kernel.shmmni = 4096
kernel.shmmax = 33554432
kernel.sem = 250 256000 64 1024

You can add/modify these entries in the sysctl.conf file (/etc/sysctl.conf). Once they are modified you can put them into effect by issuing sysctl -p. If you want to do a change temporarily you can issue: sysctl -w parameter=value.