Managing users in LSF/Landmark

We are new to Landmark, currently running LSF10 and now implementing IPA/Landmark. So my question is regarding the removal of Lawson access for users that are termed, etc.

Currently in LSF when we have a user that terms or no longer needs Lawson access we delete those accounts. Is that a popular process when running LSF and Landmark now that these users are in both places? If not are we inactivating users somehow, etc?

Thanks

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

Lawson does not recommend the removal of users anymore. They instead recommend that you disable them. There is an option to disable them in the Infor Security Administrator tool when you do User Provisioning.

todd-brown

Okay, so just the disable on the LSF side or is there something to do on the Landmark side as well?

unknown

As we have employees who are rehired, we disable the accounts, remove groups and roles, but keep the entry.

todd-brown

Yea, rehire process is being discussed her as well and how do develop our IPA flow.

unknown

I don't think you need to specifically do anything in Landmark. I think the user can't log in anyway, if you disable them from ISS, because that contains the administration for all of the user identities, not just LSF. (LSENV, Thick Client, SSO, and so on. The tool I use is part of the newer Infor Security Services where you do Federation, configuration and SSO - it is a web-based portal.

unknown

We do the same thing, Kelvin. And I have a permanently open ticket within our inside ticketing system to keep track of what groups/roles we remove. (I do a screenshot of what I remove) That way if they replace the person months down the road, I don't have to try to guess at what security that original person had.

todd-brown

Okay so the disabling takes place in ISS tool and not LSA, and you all do this manually?

0712131256598360.doc

unknown

Yes, that is correct ISS, not LSA. You can do it in LSA, but it is better to do it in ISS, so that synching works correctly and doesn't flip out. I admit, sometimes, I forget and still do it in LSA. There are many things that can still only be done in the LSA group of tools, like roles and security class setup, reporting and profile administration. I do it manually, because we don't have payroll or any of the HR modules to deal with, so not all employees are Lawson users which means there aren't changes daily or even weekly. However, I know there are people out there who have written IPAs to handle adding users and maybe they have done it for disabling users as well.

Navigation paths and screen shots - Infor Lawson User Experience .docx

userDefineLang.zip

clara-tan

we are similar, we don't remove old users, just inactivate their account in LSF Security which is ideal for looking back to see what access a user had. We are LSF 10 and Landmark 10however we are not federated (we don't use in baskets) so we have very few users in Landmark it's just needed for a few Process Automation jobs. Thus we found out from two consultant calls that we don't have to update to ADFS but we will and need to plan for federated, landmark 11, and then ADFS that's been our sweet but dated spot for now

Copyright © 2025 Infor. All rights reserved.