By default, service operations include the current user’s authentication cookie (PS_TOKEN) with the message. This means the subscribing system processes the message as the user who triggered the event. There are significant security and operational reasons to consider excluding this token.
Consider this scenario with three PeopleSoft systems:
When user JDOE changes their password in HCM:
If JDOE doesn’t exist in the Portal database or doesn’t have the right web service security, the publication contract errors out:
User JDOE not authorized to invoke service operation USER_PROFILE
When you exclude the PeopleSoft Authentication Token for a service operation:
Running service operations with tokens excluded is more secure in most situations and simplifies your security because you grant fewer web service security grants.
Consider the USER_PROFILE service operation: if you give all users web service security to invoke it, you have many more vectors for attack. A bad actor who takes control of an account with USER_PROFILE web service security could submit XML to change user profiles, grant roles, or lock out accounts. The delivered subscription code trusts whatever comes over the wire and commits it with straight SQL.
The default user ID on your nodes should follow these guidelines:
IB_NODE_HCM_USER, IB_NODE_PORTAL_USER
Chris Malek is a PeopleTools® Technical Consultant with over two decades of experience. He is available for consulting engagements.
Work with ChrisSWS turns SQL into production REST APIs — ready for AI, modern apps, and partner integrations. One install, unlimited potential.
A powerful PeopleSoft bolt-on that makes REST web services easy. You bring the SQL, SWS handles the rest.
Traditional PeopleSoft web services cost $3,600–$13,000 each to develop. SWS deploys production REST APIs in under 5 minutes through configuration alone.
Turn PeopleSoft data into clean REST APIs for AI integrations, modern applications, and vendor data feeds. Configuration-driven — no PeopleCode required.
Look up any record, field, page, or component, audit security, and monitor Integration Broker across every database — in seconds.
A web console built for the PeopleSoft community — operational monitoring, security auditing, and metadata browsing in one tool.
On-demand security and operational reports for your PeopleSoft environment — no client install required.
Research any PeopleSoft object and monitor system health from a single browser tab — no App Designer, no SQL.