Lawson and mhc document self service

Hello, we are looking at implementing mhc document self service for online viewing of w2 and 1095, we have it working fully internally with our hosted Lawson and with mhc internal. We are looking at moving it to the dmz but are curious how other users who utilize both applications have their file share, app server and security around the two.

Our three options are as follows.

Keep everything internal and only accessible from network

Put web server and file server in dmz

Put web server in dmz and allow communication to file share that is internal

Anyone who has used this software and has advice would be appreciated!

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

We don't have MHC specifically in our dmz. We use our organization citrix application for authentication (it's dmz, etc) and employees log in with their AD credentials then autolaunch to our TM Employee Space. From Employee Space we then have a link to MHC to view pay stubs. We are federated between TM and S3 so it's one authentication for employees.

Our MHC authentication is tied within S3.

Not sure if this helps you a lot but that is how we are doing it.

unknown

HI Brian,

The DSS has local shares that are published via DFS. The database server sits by itself. The DE sends PDFs to DSS via the DFS (encrypted). We do, however, allow outside connections to our DSS. The DSS web server sits in the DMZ.

Thank you!

unknown

Thank you, so just to clarify you have the PDF files on the DSS server in the DMZ as well?

What protocol and how many characters did you use for the encryption key for the pdf encryption?

Thank you for your input!

bhillz

Just to clarify your exposure risks with the various options:

A: Risks are related to VPN activities (Risk that is already accepted).

B: Web Server in DMZ: if Web server is compromised, attacker could *potentially* the rest of you internal network since they punch through the firewalls to you internal network.

C: Web server and file server in DMZ: If compromised, only W2 & 1095, data is at risk.

How do you treat ex-employees (terminated or left)? Do you plan to let them have access after they have left?

If Option B is used, they could have additional exposure to your internal network (they still have an account).

unknown

Very good points, I do not think anyone has considered termed employees yet, so I will bring that up!

unknown

We have used MHC and DSS for many years and have had W2's available via the DMZ from day one. Only the MHC server component needs to be on the DMZ Web Server machine, the encrypted PDF files can sit on your S3 server behind the FW. While any DMZ machine is a potential breach point, if your server and endpoints are configured correctly the risk should not be extraordinary. This is where solutions external to Infor (intrusion protection, etc.) come into play. Application access needs to be considered assuming your application users are also EMSS users. We use Ming.le internally for S3 apps but Portal works as well so if the application users Portalrole allows access to apps then apps become accessible via the DMZ even if they only need EMSS access from home. To mitigate this you can lock menu content and remove search box from Portal, then make app users run Ming.le via a VPN connection. Lastly, when a team members employment ends we provide 30 days of access to EMSS (limited menu just pay and W2) before turning off access completely. Good luck!

Copyright © 2025 Infor. All rights reserved.