Before you can call secured EWS operations like retrieving a student’s study list or processing enrollments, you need to authenticate the user of your application. This article covers how authentication works with the REST-based Enrollment Web Services.
In the default PeopleSoft security model, the PeopleTools user table handles user IDs and passwords itself. Many schools instead use custom SSO solutions, and there isn’t a single standard for SSO.
These articles will cover standard PeopleSoft authentication where there is a user id (OPRID) and password managed by PeopleTools (PSOPRDEFN). If your institution uses sign-on PeopleCode to integrate with LDAP or another method, this approach may still apply.
PeopleSoft can authenticate a user with a native PeopleSoft password. After authentication, PeopleSoft always controls authorization for which web services the user can access.
When designing web service in PeopleSoft or any server there are two basic security models that can be designed.
Since most of the EWS operations involve student-specific data, authenticated access is the primary security model used. The external application must provide valid user credentials (typically via Basic Authentication) with each request to access these secured operations.
The first step is to ensure the users who will be accessing the EWS have access to the necessary web services in PeopleSoft.
First we will assume that the user has a valid PeopleSoft user ID and password. The external application will need to collect these credentials from the user (e.g., via a login form) and include them in the HTTP Authorization header of each request.
For these examples, we will assume the OPRID is JDOE and the password is CLAPPING5mullet6hackers*miracle.
The EWS servicee have a few different operations that can be used for authentication.
Looking at the SCC_USERREG_R service, you have three authentication-related operations:
| Operation | HTTP Method | Purpose |
|---|---|---|
| SCC_CHECK_AUTH_R_POST | POST | Validates credentials only - returns a simple yes/no on whether the username/password combination is valid |
| SCC_USERREG_AUTHORIZE_POST | POST | Authenticates AND authorizes - validates credentials and returns user details like EMPLID, along with authorization information |
| SCC_USERREG_AUTH_GET | GET | Retrieves authentication/session status for an already authenticated user |
This is the most simple authentication operation. It simply validates the provided credentials and returns a session token (PS_TOKEN) that can be used in subsequent requests to act on behalf of the authenticated user.
This service operation is delivered as In-Active, so you have to activate it in PeopleSoft Integration Broker configuration before using it and ensure your target user group has access to it.
GET http://34.125.87.32:8000/PSIGW/RESTListeningConnector/PSFT_CS/SCC_USERREG_AUTH.v1/authenticate HTTP/1.1
accept: */*
authorization: Basic JDOE:CLAPPING5mullet6hackers*miracleA successful response will resemble this the following.
HTTP/1.1 200 OK
connection: close
content-encoding: gzip
content-length: 20
content-type: application/xml; encoding=UTF-8
date: Sat, 06 Dec 2025 20:48:06 GMT
set-cookie: PS_TOKEN=oQAAAAQDAgEBAAAAvAIAAAAAAAAsAAAABABTaGRyAk4AaQg4AC4AMQAwABSmtkQfBXsxJRqRCWpV58Fub+8HEGEAAAAFAFNkYXRhVXicLYnNDkAwGASnJeLkTSpV/2dK4oCEu7N39HA+jT3szGZvII60UsJHE5IujGx4Es/KTLZzMHFyMYhVDoujxlAIjazm95yKTtrK+3lJSx/ICzZ6CsY=
x-oracle-dms-ecid: b518fc96-a79f-43d0-b527-6312383b1ace-0000003e
x-oracle-dms-rid: 0If the authentication fails, you will get a 401 Unauthorized response like this:
HTTP/1.1 401 Unauthorized
cache-control: no-store, must-revalidate, private
connection: close
content-length: 0
date: Sat, 06 Dec 2025 20:51:59 GMT
www-authenticate: BASIC realm="PeopleSoft Enterprise PeopleTools"
x-oracle-dms-ecid: b518fc96-a79f-43d0-b527-6312383b1ace-0000003f
x-oracle-dms-rid: 0This web service does not give you much information other than whether the credentials are valid or not and gives you a token. You will use this token in subsequent requests to act on behalf of the user.
Chris Malek is a PeopleTools® Technical Consultant with over two decades of experience. He is available for consulting engagements.
Work with ChrisSWS turns SQL into production REST APIs — ready for AI, modern apps, and partner integrations. One install, unlimited potential.
A powerful PeopleSoft bolt-on that makes REST web services easy. You bring the SQL, SWS handles the rest.
Traditional PeopleSoft web services cost $3,600–$13,000 each to develop. SWS deploys production REST APIs in under 5 minutes through configuration alone.
Turn PeopleSoft data into clean REST APIs for AI integrations, modern applications, and vendor data feeds. Configuration-driven — no PeopleCode required.
Look up any record, field, page, or component, audit security, and monitor Integration Broker across every database — in seconds.
A web console built for the PeopleSoft community — operational monitoring, security auditing, and metadata browsing in one tool.
On-demand security and operational reports for your PeopleSoft environment — no client install required.
Research any PeopleSoft object and monitor system health from a single browser tab — no App Designer, no SQL.