WebRun node to disable a user thru ISS

I'm working on a Deprovisioning process flow to remove Lawson access from terminated employees. We have both LSF and Landmark access to consider. I have figured out the syntax for other WebRun nodes to remove roles/change portal role, remove the Employee identity and remove the SSOP identity BUT I cannot figure out the syntax for disabling the user. I have run a fiddler trace and have tried every combination of syntax from the trace and also the other nodes that do work, but I haven't been able to disable a user. Below is the syntax from my trace with variable data replaced. I would THINK I need to include the System Id and Ports, but maybe not? Also, what servlet should I call in the WebRun node?

ACTION=CREATE_TASK&PAYLOAD=ID%3D<!RMID>+IsDisabled%3DYES&TASKTYPE=PROVISIONING&OBJ_TYPE=ACTOR&CREATOR=lawson&PRIORITY=1&ACTION_TYPE=disable&TARGET=LSS%2CLSF%2CLandmark

Find more posts tagged with

Process Automation (IPA) - General Discussions

Accepted answers

All comments

unknown

I managed to stumble on the right combination, for anyone else interested. I added the highlighted pieces from my knowledge of using loadusers (and having to include the First and last names in those records). Thought I'd add the Disable flags as well.

The Syntax is below and I called /scwebadminapp/UserProvisioningServlet in the Webrun Node

TASK_TYPE=PROVISIONING&PAYLOAD=ID%3D<!RMID>%20FirstName%3D<!FirstName>%20LastName%3D<!LastName>%20IsAccountDisabled%3DTRUE%20IsDisabled%3DYES%20&OBJ_TYPE=ACTOR&PRIORITY=1&ACTION_TYPE=disable&TARGET=LSS%2CLANDMARK%2CLSF&MSGTYPE=CREATETASK

unknown

Why not use a Resource Update Node? That would allow you to disable and also do all the other things you are doing through a Web Run Node.

chris-mccullough

russel-cornelson

Using a web run node to send traffic at the scwebappadmin url may not be the best solution here; I would recommend Jim's solution of using the Resource Update Node. That scwebappadmin could change without warning causing flows to start failing and "no longer works from IPA" would not be enough to get a patch.

Resource Update Node uses security jars themselves to do this; a much safer route.

robert-canham

But Resource Update doesn't update Landmark I thought, just LSF.

chris-mccullough

I have found there are 3 ways to go about security with IPA.

1. Calling the XML/load user routine from IPA

2. Updating LSF and Landmark via Resource and Landmark Transaction nodes.

3. Using web calls to ISA as nfalco1 is showing here and is the way I am doing as well.

Russ is spot on in that updates to your LSF or ISA may change these web calls thereby breaking your flow . In the 2 years I have been using this method, it has happened once and I was able to quickly adjust.

The reason I went with the 3rd option and did not pursue option 2 is because a little over 2 years ago, there was a bug with ISA in that if you updated LSF and Landmark directly with the Resource and Landmark Transaction nodes, ISA would not reflect your updates. So, while user may have access, you would not be able to see the users in ISA which would make it hard to change their security later on. The only work around was to run the ISA sync which is the routine that reconciles the little derby DB running ISA. Because of this, I pursued option 3 and never went back to visit option 2. The bug may have been addressed by now and in hindsight, I could have just called the ISA sync after running my security load, but we were in need of a solution ASAP and I have not had time to re-visit. If you want to go with option 2, you will need:

1. an LSF resource update node - that will update your resource and service for that user (SSOP, roles, etc)

2. You will also need at least 7 Landmark trx nodes:

a. Create actor

b Create Actor Identity

c. Link Actor Identity

d. Add roles

e. Add Context

f. Get Agent UniqueID (person module, agent object, for business object for employee, find the agent id)

g. Link Agent to Actor (using the agent id from f)

That is in in a nut shell...hopefully, after you add the user to both systems, they will appear in ISA - if not, you will nee dot run that ISA sync so they will show up. I have a flow for option 2 - we used it for awhile until we realized ISA was not reflecting the additions and we freaked out and I made option 3. I also have a really informative presentation on this design that was presented by one of Nogalis' free webinars years ago. I can send if you are interested.

Chris

unknown

Chris, I would be interested in your webinar. I am looking to automate security setups/terminations alongside our hire/term process flows. THANK YOU!!

unknown

928670: If you reply and click on "Use rich formatting" you should be able to attach your presentation. We would be interested in seeing it. Thank you!

CCT_ConfiguringAuthoredPlans.pptx

chris-mccullough

[View:/cfs-file/__key/communityserver-discussions-components-files/57/IPA-User-Automation-Presentation.zip:320:240]

jreese

When I download the link I am getting a bunch of blank jpg files and not the presentation.

chris-mccullough

Odd, I just tested and it worked for me. If your org blocking anything?

unknown

I was able to open the zip and access all .jpg files. THANKS!

unknown

Downloaded as a zip file, with 19 jpg files for me. Easy enough to scroll through them.

unknown

Like Chris, I chose to use web-run nodes to update ISS because the disabled actors where not showing as disabled in ISS after deprovisioning using resource update nodes. I'll take my chances on LSF/Landmark updates breaking my flow as we do very extensive testing with each patch and we'll hopefully catch anything in test before we go live.

So, I THOUGHT I had the removal of our employee agent working but it's giving me an error that I'm now working on.
<ERROR>
<MSG>Got exception while lookup for service LoggerId:kdvbl0iqlkujfrnkrdmklh6cvq
</MSG>
</ERROR>

Attachment_4299.zip

unknown

When you use the Resource Update Nodes you also need to do a List Based Sync afterwards. In the flow that I have for disabling I create an xml file with the users that were disabled. I then have a script that runs as a Windows scheduled task that runs the List Based Sync using the xml file as input. I also do the same for provisioning users. Doing this will update ISS so that they will show as disabled/added.

unknown

I figured this one out. I was missing (or had an extra) + in the Webrun syntax.

Copyright © 2025 Infor. All rights reserved.