User/Actor Management -- Best Practices when User Terminates

We have both Lawson S3 and Landmark. All Employees are Users/Actors in both.
We use our corporate LDAP for access. When the employee leaves we delete the LDAP, so they no longer have access. What are others doing in addition to this?
Do you delete the Users/Actors in LSF/LTM? Disable only in LTM?

Thanks,
Chuck

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

strahoon

We just disable the individual in LSF security.

jreese

We have a process flow that updates employees so they only have ESS security and remove their SSOP link in LSF and remove and delete their identity records in Landmark. We do the SSOP and Identity deletions to make it easier for our Onboarding process to handle rehires.

unknown

@jreese

I am interested in seeing that flow. I like that process better than ones I've seen in the past. Would that be something you could share?
If so, please send to jared.lytle@umchealthsystem.com
Thanks!

keiths

If you are sharing the flow, could I please get a copy as well? If so, please send to sjibb@caasco.ca. Thanks,

unknown

I would like a copy of the flow as well please. jwiencek@choc.org We'll need to delete user accounts because we current re-use userids/account names.

moellerg

Do you mean that you re-use userids and account names for different people? What do your auditors say about that?

unknown

Yes, that's what I mean. Auditors aren't crazy about it and neither we. We have an identity management project in the works that will resolve that issue and then we'll just be able to disable user accounts.

unknown

I would like to get a copy of your flow as well. klorenz@Tacoma.k12.wa.us. Thank you.

unknown

I would like a copy of that flow as well lbrant@mhemail.org, thank you.

unknown

Here is what we do and I'm also going to comment on an 'issue' we have with this process that I'm trying to work through.

When employees are created in the system, we have an IPA that creates actor, context, links agent and adds standard roles. (We are federated) That IPA produces a .csv and saves it on our network share. Our Help Desk then uses that .csv to know what 'shell' Active Directory needs created per user. That .csv is then moved to a 'ready' folder and another ipa runs daily to look for file. If it's there, it then creates the identity/ssop and links accordingly.

Upon employee termination, we watch action of terminate and just delete the actor context, unlink the identity /ssop

All of this works great and really reduces manual intervention.

However, I'm doing an Audit of users/roles/groups.

Problem is because we don't unassign roles or groups on termination, they show up on my audit of who is in what role.

I just looked at this today and there isn't an IPA action to UnassignActorRoles

I opened a support ticket and they just replied that we can't auto unassign and needs to be done manually.

So now I'm somewhat in a lose because now I'll be back to where have to touch every term

Plus the fact if someone is in manager role, has an lsf manager GROUP for lbi reporting and then come back as a rehire in a non manager capacity, they would still have that manager group access for lbi reporting

Not sure if this post helps anyone or not, but that's where I'm at

jreese

Annette, we reset all the termed employees back to ESS security rights when they term as well as inactivate them. Easier if they happen to come back. To get roles removed from Landmark, I have a routine in my termination flow that queries to get all the user's roles in Landmark, and then runs through the Data Iterator and any role that doesn't apply to the ESS security is removed with a shell script that runs a version of secadm that removes the role. Our secadm must run as lawson and pass the lawson password so our syntax is:

secadm -p passwd role remove RMID UserRole(lawson) prodline

plancor

Hello Annette, I can't speak to the Landmark side since the only Landmark application we have is IPA. However, when I was researching how to remove and/or change LSF security (ie Roles and Groups) for employees with position changes via IPA, support provided the attached uber simple flow as an example. Basically, use the Resource Update node to reset the user's Roles and Groups to a more limited list - or removed them all together. As a disclaimer, I haven't actually gotten around to adding this logic to our workflows, but it would seem to be a workable solution.

Just thought I'd share in case it may be helpful to anyone.

richard-waite

Annette in response to removing roles - We determine for example if the person moved to a manager position or back to an employee position and put the roles into a variable to loop then go through them one at a time and rebuild with the roles he needs minus the roles we want removed then do the [Resource Update]. In the case of termination you could do the [Resource Update] with a specific set of roles. Just expanding on <Plancor> explaination.

jeff-dietrick

I’m relatively new to how Landmark works with ISA so bear with me…. I have a flow that inactivates users and replaces the current role with a self-service only role. I also have it deleting the Identities. These changes are reflected in both ISA and LSA but Landmark doesn’t reflect any of these changes unless I go back into ISA and manually save… and even then Landmark still shows the identities that were deleted. I’m assuming in addition to the flow that removes/changes roles and identities in ISA I need to use the “Landmark Transaction” to do the same in Landmark? I was hoping when I made a change in ISA it would automatically sync .

BTW It drives me crazy having all of these old unused accounts in ISA so I really just want to just delete the accounts but I found they come back automatically if an ISA/Landmark sync is done.

Any guidance would be appreciated…Also could I get a copy of the flow you mentioned? jeff.dietrick@camc.org

Thanks!

Copyright © 2025 Infor. All rights reserved.