Exposing Infor OS to Internet

Hi All,

Greetings and I hope you are doing well.

We just purchased Infor OS and are in process of finalizing the architecture.

We intend to implement Workflow for various business processes along with LN ERP and also expect to provide an option for email approval from the mobile device with a constraint from our network security team - restricting the installation of VPNs on mobile devices.

We are thinking of placing Infor OS on a DMZ environment and exposing ports for the communication to the internet will eventually help us get the desired email approval.

I request you to share your experience if you have similar architecture so that we can learn from you and avoid pitfalls and adopt refined solutions and workaround.

Kindly provide your valuable feedback.

Infor OS Cloud is not an option for us

Thank you

Best Regards,

Ashok

+1 604-362-4450

Find more posts tagged with

General Discussions

Accepted answers

All comments

ashok-kuppuswamy

Hi All,

Apologies for reposting the same message - I am doing it to get more views and a possible response.

Thanks

gsingh

Hi Ashok, I have not tried this but i guess it could work however as you know you would have to manage the security implications to the server and supporting SQL etc plus public routing DNS needed to get back to inforOS. to access the workflow links. . If you log a ticket with infor they may have some information on suitability / security as they obviously are exposing InforOs to the internet for Cloud customers. Sorry can't be more help in this case

ashok-kuppuswamy

Thanks a lot for sharing your views on the subject, I am afraid approaching the concierge may not help as it is outside support's scope. I will try my luck and keep posted.

unknown

you have boxed yourself in with a solution saying you want Infor OS exposed.

You could do things like process the approval email off the exchange server once within your network to action the workflow using something simple like powerapps.

use middleware via Azure API or AWS api to have an exposed endpoint that then communicated to the internal infor OS instance and actioned the workflow.

what have infor suggested ? any good solution architect (infor or otherwise) should be able to come up with an intergration architecture that supports what you need to do.

ashok-kuppuswamy

Hi George,

Thank you so much for your response.

We are exploring the option of the Internet not only for email approval but also to leverage several mobile apps currently available and also the new apps that will be released in the future.

Further using a middleware will need continuous maintenance and development as and when we need enhancements.

We are working with Infor partner for the installation of Infor OS (on-prem) and are still not successful due to an unknown error which is been looked at by Infor for the last 30 + days.

We are planning to expose the server to the internet once the server is installed, In the meantime, we just wanted to get the opinion from this user community.

Best Regards,

Ashok

gsingh

Hi Ashok

George raised an interesting option with middleware which could be useful to enhance or plug gaps in Cloudsuite. There are maintenance considerations but for simple use cases it should not be too much e.g. with MS PowerAutomate / Logic apps - it is a trade off as always. There are some interesting cloud edge security solutions (SASE) that are designed for protecting distributed workforces without traditional vpn so there may be some options there.

if you want / can share the install issue someone may have an idea here or come across it. Otherwise best of luck!

unknown

Hi Ashok,

Putting the Infor OS server in DMZ zone would go against any security best practice or recommendation, so it's a bit tough to advise how to do it under a best practice model.

Even if you only open specific ports, the server could be subjected to port scanning, DDoS, or any other annoying or nefarious activities that could negatively impact the performance of a critical business system. If it's important to your business, you'd also likely be out of compliance with any modern security standard (e.g. ISO 27001, SOC2, PCI DSS).

It is rarely recommended to forgoe security over ease of maintenance.

As a partner with an Infor OS Center of Excellence, we do implement and support on-premsises installations. If public access is necessary, we put a reverse proxy in the DMZ and keep the application and data layers well protected in isolated networks.

By using a reverse proxy, if an attack should happen, the reverse proxy can be isolated allowing your Infor OS to operate normally even though your public access may be interrupted.

To this end, we also use a peered/hybrid network approach in Azure for the reverse proxy where we can leverage advanced threat intelligence and protection.

I think I would have to carefully consider the effort to secure and risk of attack of a fully exposed architecture versus a more standard architecture that offers better security.

Matt Komara

If you do expose InforOS, the firewall and/or load balancer (or reverse proxy) should have some sort of layer 6 & 7 protections. Any enterprise load balancer comes these protections. A typical firewall alone is not good enough.

I've only exposed the ION API with an IP whitelist has been as far I got to exposing my on-prem InforOS.

unknown

Infor OS should never be deployed in a DMZ and typically cant be deployed in a DMZ as it can not be installed on standalone servers, only domain joined servers. We have a defined process for handling external access if the deployment is handled by Infor OS Services. As others have suggested you can use a reverse proxy in a DMZ to handle the external requests to the internal servers. If the Infor OS deployment is leveraging ADFS security then you can also use the Web Application Proxy ( WAP ) built into Windows server, this server can be standalone deployed in a DMZ. It is essentially an ADFS proxy that allows you to publish applications that rely on ADFS like Infor OS.

There are other deployment considerations that must be planned for if external access is required, for example you need to define an alias name for your Infor OS farm that contains your externally accessible domain name ( eg. infor.com not infor.local ) and secure that name with publicly signed certificates.

Planning is key if external access is required I would recommend reaching out to your Infor CSM and getting Infor OS services engaged.

Copyright © 2025 Infor. All rights reserved.