LDAP backups within the LSF/S3 application server

We are LDAP bound. LSF is our primary authentication.

I was working with Support on an issue from our Sync and they recommended to ensure our LSF Ldap is being backed up.

We are AMS supported but on premise. I contacted them and Ldap backups are not being done.

I had requested if they can be done daily and am still working through that but they indicate that is overkill and most clients do it quarterly.

Can anyone shed light on this for me? I know our security changes daily with new hires, transfers, terminations, etc, thus it is my understanding if something were to go wrong with LDAP and would lose it, would need to go to a backup and if Ldap isn't backed up/exported to a file, then we would only be able to go back to the last file.

Perhaps I am just not understanding all of this. I am 'hi level' technical and jumping in on this that is outside of my area of expertise.

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

LDAP can ride on a number of different 3rd-party technologies. Which one are you? I know of Tivoli and LDS/AD (used to be MS-ADAM). Depends on the technology how it gets backed up. I only have backup knowledge of MS-ADAM, the backup can be run any time since it has to be run "live".

d-hofmann

We are using MS-Adam. We backup nightly.

Having had to use our backups before, I would stay with nightly.

Even with ISS we will continue.

bhillz

Quarterly? That's fine if you only add/delete/change users once a quarter. It all depends on how much user churn you have, but weekly is a minimum.

Next Gen XA Streamlining Customer Service Reg List Partners Remove.csv

unknown

I'm curious how folks using MS-Adam are doing their backups? Are they just included in the nightly server backups or are you backing up MS-Adam on it's own? If so, what are you using to do the backups? We were given a script to run manually using the dsdbutil when we needed to backup the LDAP (prior to fixing an ID, etc.) but it sounds like we need to be backing it up much more frequently.

unknown

We use MS-Adam and are doing the dsdbutil but have just written it to a powershell script that does the back and then copies it in an archive folder appending it by date so we have unique names for historical purposes. It also cleans out old files after a given date.

unknown

Thank you. I don't know what we have. AMS set us up. But now I am also hearing 'ldap is not supported by them'. So I'm trying to figure it all out. But I'm certain it's not Tivoli. I just know they walked through using Jxplorer to get to it to clean up 'orphaned' ldap records that caused errors on our sync.

unknown

I needed to clarify on something I said earlier.. I said they indicated most clients do quarterly... I re-read and it's monthly..

Anyway, I'm continuing to work with them but they just updated they are working to schedule LDAP backup through dsdbutil or window server backup.

I still have questions back to them but wanted to thank all of you that have replied. Monthly just didn't seem like a good practice and has at risk.

unknown

Like someone else mentioned it really depends on how many adds/changes you make to security for adding and modifying users. We do ours nightly as we have it scripted so just created a scheduled task that runs it automatically. That way you are never more than one day behind for any changes if you need to recover. Hope this helps.

abissa

We are using MS LDS AD and running on a VM server. Our server team back up VM server nightly. If the VM server lost, they can simply clone VM server (together with all applications) from nightly backup.

lmerrill

That's exactly the same setup at our place too. Backup VM server nightly.

unknown

I have a maxim, from sad experience: "Backups are easy. Restoring a backup, that's much harder!" You may want to examine your backup situation very carefully. I've noticed that "modern" applications are designed to be always-on., and their backups should be taken while running. Both Microsoft SQL Server and MS LDS AD are designed that way. Which means that only under certain carefully-crafted conditions will a full VM server backup/clone work. Special attention needs to be taken as to what software is running and what is down when the VM server backup is taken. Restore needs to be tried to be proven. 'Nuff said.

unknown

As I'm reading these replies (thank you) and what I have been trying to research, I believe the following is accurate.

And we are Windows/Sql site...

1. A standard backup of your applications server does not backup the 'ldap' (hence why I started this post and my support ticket)

2. Need an ldap backup that exports out some file and then that is captured in the backup of the server

3. Sounds like I need to understand how dsdbutil is used.

I will share what I learn from my Xtreme ticket with AMS as they have indicated they will do backup with dsdbutil

But then my questions to them are if they are setting it up to automate for me and where they will place the export of the ldap for backup. We are on premise but have AMS for our support but hearing they don't support Ldap.. it's being discussed at various levels with our account manager.

Then later this year, I would like to try a disaster recovery test to restore our LSF, Landmark and sql that go with it.

d-hofmann

We use the dsdbutil.exe in a power shell script to make a backup to a file while everything is up and running.

unknown

I found this is not a responsibility of AMS. They only do ldap backups if you are in the cloud and only do it once a month.

I found the command in documentation and am now getting one of my more technical coworkers to write a script or .bat file so it can be scheduled.

For those that asked more about the dsdbutil command. The Lawson Authentication Admin guide has information but here is the snipit to save you time... and I am assuming the 'Instance Name' is the 'product line' but I'll be testing this command in my test environment.

Make a full backup of your LDAP instance. Infor recommends using the dsdbutil utility. For example:

dsdbutil "ac i <InstanceName>" ifm "create full <YourBackUpLocation>"

For example:

dsdbutil "ac i LSFPROD" ifm "create full D:ADAMackups"

Copyright © 2025 Infor. All rights reserved.