Blog

nVision and Siebel Analytics

This week, when I was picking up my kids at school, I ran into one of the nVision developers who used to work for me (who's still working at Oracle). She's working on taking nVision to Fusion, which will use the Siebel Analytics platform.

When I first remembered that Oracle's acquisition of Siebel included Siebel Analytics, I told my co-workers that if Oracle was smart, they'd use that as the replacement for nVision (and metric calculations in EPM).

So, Why is it a good thing?
Believe it or not, we at PeopleSoft evaluated Siebel Analytics (although under a different name) to be the infrastructure for the next generation of nVision. At the time, it was a small company called nQuire. We put together a bunch of things we wanted them to prove they could do within a week against multiple PeopleSoft systems. At the time, Chris Heller and myself had a lot of discussions about the product's claimed capabilities... his quote was "Either they're crazy or they're geniuses". We found out that they were geniuses.

Unfortunately for PeopleSoft, Siebel beat us to the punch and acquired nQuire and re-branded the product. Now that Oracle has acquired both Siebel and PeopleSoft, it looks like that original vision may be realized for PeopleSoft customers.

So, what is Siebel Analytics?
Siebel Analytics is most of the functionality we planned to provide in reporting in PeopleTools 9.

  • A data abstraction layer that allows users to work with meaningful objects for building reports
  • A browser-based way of building both tabular and crosstab reports by business users
  • A server-based quering engine that runs the reports and delivers results

In the published PeopleTools 9 plans, we had different names for the same functionality

  • Data Objects (Data Abstraction Layer)
  • nVision Studio (Browser-based way of building tabular and crosstab reports)
  • nVision Engine (server-based querying and reporting engine)

Mark Rittman has some good images on his weblog (which is a must-read for anybody wanting to understand what's going on with Oracle and BI) that shows screenshots for building and managing the data abstraction layer and for building queries or reports.

Data Abstraction Layer

The data abstraction layer looks exactly as it did when we reviewed the product.

oracle_analytic_server_admin

The far right pane contains the list physical objects that are the sources of data and metadata. These can be tables or files (and I'm assuming XML sources now). You can think of these as record definitions in PeopleSoft.

The middle pane allows you to map the physical objects to objects that have a more meaningful business names and structures. They abstract away joins and unions and other physical attributes you don't want to present. (a good example we had them prove in the PeopleSoft evaluation was that you could have a single representation for sales, where under the covers you were getting historical sales from a data warehouse and current sales from the CRM system). These are related to Data Objects in the PeopleTools 9 feature list.

The left pane contains the presentation layer for how you would want to present these objects to business analysts. For example, you might want to have different versions of an order, depending on the vertical you're using (where fields specific to a vertical are displayed and not others, and where the terminology presented to the user is targeted to that user type). In other words, you might have a different presentation object for Universities and Commercial in CRM, where in a university a customer is displayed as a contributor and in commercial, they're displayed as customer. These are related to Data Views in the PeopleTools 9 feature list.

Reporting

Siebel analytics provides a drag-and-drop interface for building reports in the browser using these objects. Although I believe that there is some opportunity for making the user interface more targeted to business analysts, they've done the big, hairy effort to pull together crosstab and tabular reporting into a single reporting tool. Here's another screenshot from Mark Rittman's weblog that shows some of the user interface.

oracle_answers_crosstab

As you can see, you have the objects from the presentation layer in the left pane, and you have the ability to lay them out in a report.

So, What's left to be done?

Good question. Here are the major tasks I see that need to be done to get nVision using this platform:

  1. Map ledgers to the Siebel Analytics metadata. This should be relatively straightforward, but it is dependent on the fusion business unit/setid project as well as how chart of accounts configuration gets done in fusion.
  2. Teach the Siebel Analytics platform how to read trees. Again, this is dependent on the fusion tree project. Fortunately, there are a lot of designs in place for how an engine would utilize different approaches for modeling trees. Another good thing is that the Oracle database has sql extensions for trees/hierarchies that make this much, much simpler than what is currently being done in nVision.
  3. Build a robust excel user interface that leverages the calculation engine in Siebel Analytics. From what I know about WebADI, this infrastructure may do the trick, because it is build to allow web services to be used interactively to embed application functionality into to provide a user experience targeted to a business user.
  4. Extend Siebel Analytics with output management functionality (this will probably involve work with concurrent manager, which is being managed by the person who used to own PeopleSoft's process scheduler and report manager).

Conclusion

Hopefully this makes most PeopleSoft customers more comfortable with the future of things. I've already known or suspected much of this information earlier, but was waiting for Oracle to provide enough information publicly for me to safely write this entry.

Labels: , ,

Comments (21)
21Wednesday, 22 June 2011 16:50
Chris Heller
There's lots of, ummm, unusual behaviour with signon PeopleCode, but dropping headers is a new one to me. Our Desktop Single Signon stuff uses custom headers to communicate between the web server and app server without problem, and I know of lots of other people doing this as well.

How are you actually accessing the headers in PeopleCode? Do any of the headers sent by the browser actually show up?
20Wednesday, 22 June 2011 16:49
goodie
Hi Chris,

Thank you so much for getting back to me on this. The flow is as follows:

User requests http://server:port/psp/instancename/EMPLOYEE/HRMS/h/?tab=DEFAULT

from an external link. Apache intercepts the request inserts the custom Shibboleth headers and redirects to the ps url (GET request). My signon PeopleCode fires and the headers are not present. I am then redirected to the login screen with a message stating "incorrect userid or password". If I simply request the url again my PeopleCode finds the headers and logs me into the correct page within PeopleSoft.

I wrote a test servlet that simply dumps the headers and installed it on the PIA server. When I access the test servlet it finds and prints the headers. I am therefore confident that the headers are being injected properly.

I am attempting to implement this on PeopleTools 8.48.03 (Oracle Application Server on Redhat Linux).

I have not configured guest signon within the WEB_PROFILE. Should I simply be able to submit a get request (with custom headers) to a page in PeopleSoft and read the headers within signon Pcode? Do I need to implement guest access to bypass the signon process?

I have written the following Pcode to simply access the header info:

&requestParams = %Request.GetParameterNames();
&requestHeaders = %Request.GetHeaderNames();

Upon first request to the url the request object does not contain my custom header information. I am interrogating the request object with the PeopleSoft debugger.

I appreciate any help you are willing to provide.
19Wednesday, 22 June 2011 16:48
Chris Heller
The problem is that you won't get signon PeopleCode to (reliably) run unless you have a public access account configured or it is a POST request with the signon page stuff.

So for your scenario you need to setup a public access account (it can be something with no access) and then sign the person on appropriately from the headers inside your signon peoplecode.

If you're planning on going to the Alliance conference, come find me and we can chat more about the other issues that you may encounter along the way.
18Wednesday, 22 June 2011 16:48
goodie
Hi Chris,

Thanks again for your assistance. Unfortunately I will be unable to attend the Alliance Conference this year. I will setup a public access account and give it another try.

Will I simply need to read the headers and Authenticate the user? Once I setup public access are there many issues I will need to address?

Thanks Chris.
17Wednesday, 22 June 2011 16:47
goodie
Hi Chris,

Thanks to your help I resolved my issue. I truly appreciate your help on this.

Thanks
16Wednesday, 22 June 2011 16:47
Tim
Chris,
Thanks for this article. It really helped to solidify in my mind how we should approach SSO. Thanks!
15Wednesday, 22 June 2011 16:45
Glenn
Hi Chris,
Thanks for the excellent post. I'm fumbling my way through setting up IIS as a reverse proxy with the goal of using NTLM authentication for "desktop signon" and have gotten a little stuck. I'm not sure how to parse the header that IIS is adding to the request. I've tried using the &requestParams stuff that Goodie mentioned in a previous post, but it seems my debugger session doesn't really start catching code until the signon is complete. I'm trying to interrogate the header before that occurs -- in my custom signon PeopleCode.. Any ideas?
14Wednesday, 22 June 2011 16:45
Glenn
Chris,
I think I've figured out my problem from yesterday -- have been looking at the headers from another random PCode event post-signon. Sorry to have bothered you ... but would like to reserve the right to do so again should I get stuck :-)

Glenn
glenn.merberg@quadrint.com
13Wednesday, 22 June 2011 16:44
Chris Heller
PeopleSoft is not built with ASP, so it does not use ASP code.

You'll want to check PeopleBooks for information about the Request object in PeopleCode.
12Wednesday, 22 June 2011 16:44
amar
but i can have asp code at the root of IIS server, which gets the remote user env.variable, where the the asp realm is protected by netegrity siteminder. Then i can post it peoplesoft login url with autosubmit. Any asp code please? we've PS9.
Also any security feature built around while passing remote_user? because anybody can send the request thru lwp agent etc., if he knows the user id who has entitlements.
11Wednesday, 22 June 2011 16:43
Tomcat Tuning and Performance
Hi Chris,

We have setup the public access account and have PeopleCode working to read headers that are injected by Shibboleth. Everything works 95% of the time, but periodically we receive the error Invalid UserID and Password in our logs. How could this be? Could PeopleSoft be reading from cookies on the browser and trying to log the user in via PS single sign on? Any help would be greatly appreciated.
10Wednesday, 22 June 2011 16:42
Chris Heller
@Tomcat Tuning and Performance

There are a few different things that we've seen and had to add code to get around. One is that IE sometimes does some weird things with caching old sessions, so even though you think that you're logging someone in for a new session, the old session gets used. We just detect when this happens and force another login attempt (but we do it silently so the user does not realize that this has happened).

We're doing a session at OpenWorld on debugging these sorts of things. If you're there, be sure to come by and check it out.

@Amar, sorry for the delayed response. I didn't your extra comment until Tomcat's was posted.

Anyways, yes, you can send along the REMOTE_USER information in an HTTP header, but as you mention (and we pointed out in the original blog post) this is extremely insecure because there is no validation from the PeopleSoft side that it wasn't spoofed.

We've shown a few different people how easy it is to add extra HTTP headers in a request to PeopleSoft (or any web app for that matter), and they're generally surprised by just how easy it is.

So, you definitely can't just trust having an IIS proxy in front of Peoplesoft without doing some more work to ensure that someone can't just log themselves in as whoever they want.
9Wednesday, 22 June 2011 16:42
Stéphane Lapierre
Hi,
I'm trying to implement the SSO with JCIFS.

I'm trying to read the "Authorization" Header (that contains NTLM string)in the PeopleCode, but it only appears in the first HTTP GET of the request.

so from my signon peoplecode point of view, this parameter does not exists.

is there any way to make this parmeter more persistent ? or to read the Windows ID somewhere else ?

Regards
8Wednesday, 22 June 2011 16:41
Rajasekar Rajendran (Raj)
I was able to achieve the SSO to trust the thridparty authenticated cookie.. To achieve this as we know, we have to enable the public access and then the username/password should be given in the DEV Webprofile... But now the problem is when an AAF notification delivered URLS like http://host:port/psp/Opportunity.GBL goes for task.. I mean, when the user clicks the URL in the email it shows the You are not authorized instead of redirecting to Singon Page.. Is there any fix for this...
7Wednesday, 22 June 2011 16:41
GR Marriage
Hi Chris,

I would like to implement the single sign on into PeopleSoft application using the desktop windows login. COuld you please provide me a detaileds steps to implement it.It would be of great help to proceed with implementing it.

Thanks

Ravi
6Wednesday, 22 June 2011 16:40
Anonymous
Hi Chris,

I log in to a website using an id and password. After logging in to the website, there is a link for Peoplesoft page. When I click on the link, It redirects to the peoplesoft page without asking the login credentials. What I would like to know is that how the credentials which I give in the website gets passed to our Peoplesoft and what kind of authentication methods are processed?
5Wednesday, 22 June 2011 16:39
samy
hi Chris,
Thanks for the blog, it helped. I am trying to implement desktop SSO for peoplesoft using Web Server level authentication. But I am not able to figure out how would you allow the support team to login with a different account like say psadmin account.
I believe we change the cmd=login to cmd=start in signon.html and need to replace this in all the html files used in the web profile.
Kindly help as I have reached a deadend...

Regards,
Samy
4Wednesday, 22 June 2011 16:39
Chris Heller
Samy, we added specific code to our Desktop Single Signon product to handle letting people manually log in. Your signon code needs to differentiate between manual requests or automatic requests (which will depend on what you are doing for the automatic requests).

I'm not sure why you are changing the signon.html page though.
3Wednesday, 22 June 2011 16:38
Anonymous
Hello Chris,

I've riched peoplesoft homepage but when I want to enter any page or click on any button the user automatically signout.

When I look in psadmin I can see that all users are signin with Public user...

And actually, in webserv log, I found two 'delete cookies' lines for each time a users is autoatically signout.

Have you any ideas on this?

Thanks.
2Wednesday, 22 June 2011 16:38
Anonymous
Hello Chris ,

We are using the Single sign on in our system.When ever a user is trying to login to the system, he is getting the mesaage that "Domain is not included in the list of domains". I just want to change the error message users are getting.

If you can guide me where can I do the changes.That will be really helpful.

Thanks and Regards
Amit
1Wednesday, 22 June 2011 16:27
Bert
Larry - great insight. Any updates! Thanks dude!!

Add your comment

Your name:
Comment:

News Archives