Skip to main content

Enable Okta SSO and MFA to Oracle PeopleSoft via Datawiza

About 2 min


This tutorial shows how to enable Okta Single Sign-On (SSO) and Okta Multi-Factor Authentication (MFA) for an Oracle PeopleSoft application using Datawiza Access Proxy.

Benefits of integrating applications with Okta using Datawiza Access Proxy include:

  • Proactive security with Zero Trust through Okta.
  • Use of web applications such as: Oracle JDE, Oracle E-Business Suite, Oracle Sibel, Oracle Peoplesoft, and home-grown apps.
  • Use the Datawiza Cloud Management Consoleopen in new window to manage access to applications in public clouds and on-premises.


This document focuses on Oracle PeopleSoft application integration using HTTP authorization headers to manage access to protected content.

For legacy applications, due to the absence of modern protocol support, a direct integration with Okta SSO is difficult. Datawiza Access Proxy bridges the gap between the legacy application and the modern ID control plane, through protocol transitioning. Datawiza Access Proxy lowers integration overhead, saves engineering time, and improves application security.


The solution has the following components:

  • Okta : The Okta cloud-based identity and access management service, which helps users sign in and access external and internal resources.
  • Datawiza Access Proxy (DAP): A lightweight container-based reverse-proxy that implements OpenID Connect (OIDC), OAuth, or Security Assertion Markup Language (SAML) for user sign-in flow. It transparently passes identity to applications through HTTP headers.
  • Datawiza Cloud Management Console (DCMC): A centralized console to manage DAP. DCMC has UI and RESTful APIs for administrators to configure Datawiza Access Proxy and access control policies.
  • Oracle Peoplesoft application : Legacy application going to be protected by Okta and DAP.


Ensure the following prerequisites are met:

Getting started with DAP

To integrate Oracle Peoplesoft with Azure AD:

  1. Sign in to Datawiza Cloud Management Consoleopen in new window.

  2. The Welcome page appears.

  3. Select the orange Getting started button. getting-start

  4. In the Name and Description fields, enter the relevant information.

  5. Select Next. create-deployment

  6. On the Add Application dialog, use the following values:

    App NameEnter a unique application name.
    Public DomainFor example: For testing, you can use localhost DNS. If you aren't deploying DAP behind a load balancer, use the Public Domain with the port.
    Listen PortThe port that DAP listens on.
    Upstream ServersThe Oracle PeopleSoft implementation URL and port to be protected.
  7. Select Next. create-application

  8. On the Configure IdP dialog, enter the relevant information.

  9. Input the IdP name. Select OIDC as Protocol and Okta as Identity Provider. Populate the fields of the form with the keys/values obtained from IdP Configuration Guide: Okta. Choose Okta IdP

  10. Select Create.

  11. The DAP deployment page appears.

  12. Make a note of the deployment Docker Compose file. The file includes the DAP image, also the Provisioning Key and Provision Secret, which pulls the latest configuration and policies from DCMC. dap-yaml

SSO and HTTP headers

The DAP gets user attributes from IdP and passes them to the upstream application via header or cookie.

For the Oracle PeopleSoft application to recognize the user correctly, there's another configuration step. Using a certain name, it instructs DAP to pass the values from the IdP to the application through the HTTP header.

Such configuration will be done in the Applications tab on the left panel and go to Attribute Pass sub-tab. For Oracle PeopleSoft, please refer to the screenshot below to configure the attribute pass:




This configuration uses the user principal name as the sign in username used by Oracle Peoplesoft. To use another user identity, go to the Mappings tab.


SSL Configuration

  1. Select the Advanced tab. enable-ssl

  2. Select Enable SSL.

  3. From the Cert Type dropdown, select a type.

  4. For testing purposes, we'll be providing a self-signed certificate. self-cert


    You have the option to upload a certificate from a file.

  5. Select Save.

(Optional) Enable Okta Multi-Factor Authentication

To provide an extra level of security for sign-ins, enforce multifactor authentication (MFA) for user sign-in. One way to achieve this is to Enable MFA on the Okta portalopen in new window.

Enable SSO in the Oracle Peoplesoft Console

To enable SSO in the Oracle Peoplesoft environment:

  1. Log into to Peoplesoft Console http://{your-peoplesoft-fqdn}:8000/psp/ps/?cmd=start using Admin credentials (Example: PS/PS). ps-console

Add a default public access user to Peoplesoft

  1. From the main menu, navigate to PeopleTools > Security > User Profiles > User Profiles > Add a New Value.
  2. Select Add a new value.
  3. Create user: PSPUBUSER and enter the password ps-create-pspubuser
  4. Select the ID tab and choose the type as none ps-select-id-type

Configure the web profile

  1. Navigate to PeopleTools > Web Profile > Web Profile Configuration > Search > PROD > Security to configure the user profile.
  2. Check the Allow Public Access box and then enter the user id PSPUBUSER and password.
  3. Click Save. ps-allow-public-access

Enable SSO

  1. Navigate to PeopleTools > Security > Security Objects > Signon PeopleCode
  2. Select the Signon PeopleCode page.
  3. Enable the OAMSSO_AUTHENTICATION and then click Save. ps-signon-code.png

Configure PeopleCode using the PeopleTools application designer

  1. Navigate to File > Open > Definition: Record > Name: FUNCLIB_LDAP.
  2. Open FUNCLIB_LDAP. ps-open-def
  3. Double click on this record.
  4. Right-click LDAPAUTH > View PeopleCode.
  5. Search for the getWWWAuthConfig() function. Change &defaultUserId = ""; or &defaultUserId = "IDCSPSFT" to &defaultUserId = "PSPUBUSER". change-default-user-id
  6. Double check the user header is PS_SSO_UID for OAMSSO_AUTHENTICATION function. Save the record definition. ps-check-header

Set the default proxy address

  1. From the Main Menu navigate to PeopleTools > Web Profile > Web Profile Configuration > Search > PROD > Virtual Addressing.

  2. Choose the Default Addressing, set the following fields and click Save

    NameThe Fully Qualified Domain Name (FQDN) for the public domain of the PeopleSoft application, could be something like

Handling 'logout' from PS

Default 'logout' action takes user to PS sign-on page, this link should either be disabled or updated to redirect user to SSO logout page. To achieve this:

  1. Obtain the correct logout URL for PeopleSoft portal.

  2. Open the portal through a web browser with debug tools enabled. Find the element with the PT_LOGOUT_MENU id and save the URL path with the query parameters. In this example, we have: /psp/ps/EMPLOYEE/SA/?cmd=logoutfind-logout-url

  3. Go to the advanced sub-tab on DCMC, and input the value into the field Logout DAP URI. set-dap-logout-url

Handling 'login' from PS

Default PS Sign-in page can also be replaced to redirect users to SSO login page, just to cover scenarios where user inadvertently land in PS sign-in page. There are several ways to achieve this goal. One way is to update index.html in PORTAL.war with the SSO Login Redirect.

$ cat /home/psadm2/psft/pt/8.57/webserv/peoplesoft/applications/peoplesoft/PORTAL.war/index.html

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta HTTP-EQUIV='Refresh' CONTENT='0; URL=/psp/ps/?cmd=start'>

Handling of 'Session Timeout' from PS

Default PS session expiration page can also be replaced to redirect users to SSO login page, just to cover scenarios where user land in PS expire page if the session is timeout. Update expire.html in PORTAL.war with the SSO Login Redirect.

$ cat /home/psadm2/psft/pt/8.57/webserv/peoplesoft/applications/peoplesoft/PORTAL.war/WEB-INF/psftdocs/ps/expire.html

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta HTTP-EQUIV='Refresh' CONTENT='0; URL=/psp/ps/?cmd=start'>

Go to the advanced sub-tab on DCMC, and input the value /psp/ps/?cmd=start into the field Login Redirect URI. set-login-redirect-uri


After completing configuration steps in PeopleSoft, application and web servers need to be bounced for changes to take effect.

Test an Oracle PeopleSoft application

To confirm Oracle PeopleSoft application access occurs correctly, a prompt appears to use an Identity Provider account for sign-in. Credentials are checked and the Oracle PeopleSoft appears.


To improve security, organizations using this model may also consider blocking all direct access to the application, thus forcing the use of a strict path through the Datawiza Access Proxy.

What's more