upgrade from ADAM to AD LDS

We currently have an ADAM server running on windows 2003. We need to retire the Windows 2003 server which requires us to upgrade from ADAM to AD LDS ( Active Directory Lightweight Directory Access Protocol (LDAP) ) on a new windows 2008/2012 server.

Can anyone provide any guidance or link to documentation regarding AD LDS Lawson configuration so that we can replace the old ADAM server? INFOR XTREME cannot provide any assistance with this migration from a Lawson perspective and we need to understand any updates that might be needed to our Lawson server. They want us to pay for additional services for guidance.

We have AIX Unix platform that has everything such as Oracle DB, WebSphere, Lawson application etc.

Attachment_4383.zip

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

Have you considered switching to Tivoli? runs in the UNIX environment.

unknown

That's what we use here at Yale, and seems to be fine.

0712131256598360.doc

unknown

We upgraded our Adam servers from 2003 to Windows 2008 in May. It didn't seem very painful but our systems guy/adam guru did make sure the service account we were running had the right setup/permissions.

A quick list of the steps we took.

1. Built the windows 2008 R2 servers.
2. Added the ADLDS role in the add roles wizard
3. Used the ADLDS setup wizard to replicate our existing 2003 Adam instance
4. Let the data replicate across (test the replication by changing something and verifying in jexplorer that it changed on the 2008 server as well)
5. Transfer the naming master and schema master roles to the new server (some command line work).
6. Use SSOconfig to point your LSF environment at the new 2008 ADLDS server
6. Turn off the old adam services to make sure you are hitting the new server.

unknown

Greg - I'm probably telling you nothing new but the only documentation I've been able to find on AD LDS is from Microsoft. Basically, AD LDS is the new name for ADAM and the setup should be very similar. We will be doing our upgrade a few months down the line so I can't help any further.

bhillz

In your configuration: is the Lawson ADAM distinct (it's own island) from any other AD Domain, being managed only by the Lawson tools?

OR

Are you integrated (or trying to integrate it) with the corporate domain/forest)?

clara-tan

Hi,

Other users have done a good job on noting steps. Our upgrade went smooth as well and we did it in house. The windows guy did send me this link to a document which was helpful too blogs.technet.com/.../how-to-decommission-an-adam-adlds-server-and-add-additional-servers.aspx

Otherwise, we created accounts, he saved the data and restored to the new location. I ran the ssoconfig and pointed to the new server and it was all up and working just fine.

We to have AIX unix for the LSF and oracle database. We actually put our new AD LDS on our same Smart Office windows server.

tom

Thanks for all the responses.

I have an additional question from my client services engineer , Can Lawson interface directly to our MS Active Diirectory Domain Services (ADDS) and bypass AD-LDS services or do we need to have AD-LDS middleware in-between Lawson and our ADDS?

moellerg

Although I am not an expert... You can interface Lawson directly to your corporate AD, but it is generally not recommended. The AD-LDS stores all of the security for Lawson, and Lawson makes a LOT of calls to it. We did a simulation at our site and were kind of surprised by the amount of calls that it would make.
We chose to install a separate LDAP for the Lawson security piece, but still have it ldap bound to our corporate AD, so that the passwords were controlled on that side of the house. And will likely continue that as we upgrade to version 10.

unknown

Greg Moeller wrote, "The AD-LDS stores all of the security for Lawson" Yes, that is correct. If you look in there with a browsing tool like JXplorer, you find a complex set of storage elements, and also within some of them, security-related XML. For Lawson Security to work in regular AD, it would all have to be duplicated in the regular AD. Think of the AD-LDS (and MS-ADAM before it) as the data storage for LSA. Technically it's less about authentication, which AD handles, it's about data storage for security information specific to Lawson. Hope that helps.

[Updated on 9/1/2015 10:22 AM]

tom

Greg M, thank for the informative response. How many Lawson users do you have at your site. Want to compare that to our user base.

moellerg

We have approximately 5200 Employee Self-Service users, 200 Manager Self Service users and maybe 120 core Lawson (HR, Materials and Finance) users that are in Lawson off and on pretty much all day long. There are a smattering of other users, but they don't use the Lawson system for much and are maybe in it once a week for 20 minutes tops.

[Updated on 9/1/2015 10:46 AM]

com201011_proactive.pdf

tom

Mio and Greg, thanks too you both for clarifying this.

Greg, we are very close to your user base so your testing would be very applicable to our condition.

With Milo's explanation of how Lawson utilizes AD-LDS we definitely do not want to add that overhead to our AD Domain Service.

We will proceed with replacing ADAM with AD-LDS.

Thanks Again

Copyright © 2025 Infor. All rights reserved.