loadusers modifications for ADFS

unknown

Like many of you we are in the midst of updating our on-prem system to ADFS authentication.

For those of you who have made the transition, what changes did you have to make to your loadusers scripts/processes?

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

I believe our only changes were adding the RMID field to the xml (we left it blank as it will copy the ID field value if I recall correctly). The other change was adding @domain to the SSOP ID. I don't think we had to make any other changes.

venturaa

Hello Kyle, I am curious to know where it is exactly that you added the RMID field. Did you perform this task in ISS?

unknown

We had significant changes to ours. Our RMID used to be blank before, the User ID field used to have the NT id & the identities were in the same loadusers input file. We changed the RMID to be the NTId, User ID to have company email address. Had to create a separate file to load identities with the ssoconfig -l command, keep the SSOP identity there, but change the value to email address & lastly add another set of service identities for both LSF & Landmark with domainNTid values which were part of the new ADFS bind.

unknown

<USERDATA>

<USER ID="user" RMID="" FirstName="fname" LastName="lname" Role="role" />

This is what the xml ended up looking like. We have continued to use loadusers into S3 as we are only using Landmark for IPA and most users are not using it. We have had a process flow for a while now that adds users to Landmark so that ISS doesn't have a ton of conflicts.

I actually think the @domain update that we do is on that same flow. We delete the SSOP ID and then re-add it with the @domain.

venturaa

Do you mind me asking why you need to delete the SSOP ID and then re-add it? Does the flow not enter the desired variable or is this a system bug you've encountered?

Copyright © 2025 Infor. All rights reserved.