AD FS and Lawson account automation

Hello all, As everyone knows, we're being forced to move to AD FS by Infor - - even though existing technology has been 'bulletproof' - - so we're in the <somewhat painful> process of doing that. Question: In our lovely new world, we'll need to create users in IFS along with what we're already doing. Does anyone know if it's possible to automate this part of user creation? All that I see currently is a way to *manually* upload a spreadsheet (which seems fairly archaic!). Appreciate any experienced insights. Thanks, Lenny (lc@choa.org)

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

Glad to see that someone else sees this as a problem. The only potential solution I see is that when one goes into IFS to maintain users, there might be a button to "Synch with Active Directory". I don't actually get to see that button. I'm told that this feature is not available to multi-tenant customers. If your server happens to be on-premise, you may want to open an incident and ask about it.

The inability to create a truly automated process for updating IFS is so 20th-century. I hope this conversation spurs some development of what should be a fairly simple process. Thanks, Lenny, for this important post.

Just to be clear on my understanding your talking about the Federated Security on the Ming.le side? If so then the users can be synced against AD security groups. We are on prem so I am not sure how this works for cloud but in our case we've created Security Repository groups that are synced against an LDAP bind against our Active Directory. So every hour in our case the LDAP bind scrapes the appropriate OU structure and adds any user that has the specific security groups that we have assigned. You can have multiple groups with multiple different IFS security (we run one for standard users, finance users, payroll users, HR users, etc)

Josh, We are going live with this on 12/7 and we do synch against an LDAP bind against AD as well, but we only pulling in from one OU structure. Can you explain the multiple groups with multiple different IFS security? I thought it was controlled more by the OU structure it was synching to, and not groups. We currently just have it set to do our EMSS security and any power user (Payroll, HR etc..) we are still manually adding to the different IFS security for those users.

Well, we are in the cloud -single tenant, use ADFS and the process of syncing IFS and AD group is automated. The sync is scheduled.

The accounts in IFS are automatically created when the sync takes place. The administration is minimal if you have teh correct version of IFS. We struggled in the beginning. Can also add manually by admin if schedule is behind. Most of the initial work was done by our d resources to automate the adding or deletion of user in the AD security group that we use for syncing.

I must say we use ADFS 2.0. We will be upgrading to ADFS 3.0 but I don't expect this process to change.

I can share more details if necessary.

Can you confirm you are using INFOR OS? Version 12? We are running Infor OS ™ 12.0.27.41 & Registry 773

For me I use Identity Repository Groups and create individual groups driven by AD security groups. I then assign the security roles to the different groups.

Additionally make sure that your LDAB bind is high enough in the OU structure that it can see all the way down the structure

0712050808185563.doc

We are 12.0.24.37 & Registry 721. So if I am understanding this correctly, as long as we have the bind high enough, if we use AD groups to assign the security roles, the sync will not add all AD accounts to those roles, only the ones in those AD groups? That would be great.

Hello, we are planning the AD FS move and are looking for consultant assistance. If any one who contracted with a partner would care to share who they used and if they were satisfied with the work, we'd be very grateful! Or, if you already have a trusted partner that you are planning to use for this task. We are an on prem shop and have always taken care of most Lawson tasks in house, but are looking to partner with someone for AD FS. Thank you!

Not sure if you are in the Chicago area, but there will be two vendors (Intellias and Hybridge) presenting sessions on the ADFS migration during the December 7 Great Lakes User Group meeting. Other vendors who provide ADFS migration services will also be in attendance, if you would like to speak with them. If you are able to attend, registration can be found on the GLUG Communities page. My organization is planning to use Intellias.

Analysts International (AIC) had done a number of the ADFS migrations....They have a Youtube channel with informational videos that give some background and things to consider as part of the migration: www.youtube.com/.../UCqS1RE5-7cICwzwEKPBXyAA

There is a phone/email to contact at the end of each video.....or I can assist

As a side note, there is an upcoming webinar on this topic:

Infor Lawson security training webinar 'Moving to Microsoft ADFS SSO'

Dec 13 / 2pm US Eastern

Join us for this free training session with Glen Rexing that will highlight the importance of updating to Microsoft® Active Directory® Federation Services (ADFS) for providing SSO services.

pages.infor.com/20181213-oth-edu-webinar-moving-to-microsoft-adfs-sso.html

Thanks you Hans (Infor might now be waking up to the reality of this! - - sorry for saying!) and others who have contributed their ideas (Josh/Mose). Looks like we need to think AD->IFS so we'll work on that. Have a good day!

Thanks Hans! It's always good when you contribute.

Could you also lift the curtains a bit and share if there are any plans (or even better development) in simplifying user on-boarding & maintenance.

For instance, shouldn't user updates via syncing be real-time rather than scheduled (nighty)?

0911060553270289.pdf

As noted in the threads so far, there are two models; Multi-Tenant and Not Multi-tenant. Both support capabilities for automation of users from a source, and both support the use of Groups.

Very basically,

Multi-tenant can use SCIM (including SCIM groups) which is the recommended method.

non multi tenant support the LDAP bind , with multiple repositories (LDAP paths) and AD Groups.

Both support XML BOD interfaces, so a Process Security User master could be used.

It is expected that all user management is performed in Infor OS, and the standard integrations to the applications is implemented to keep those systems (such as landmark) synchronized for User and Security.

If HCM (Infor or another)is involved, there are options for Landmark updates direct that leads to birthright and position based entitlements. These need to be considered as they can have an impact on your design.

This leads to design on how the IdP is populated and used for authentication.

Piling on what Kevin noted below, a couple more notes...

Customers do NOT need to manually create users in IFS (they can) - but that should be part of an automated process that is handled either via LDAP Bind, SCIM, or from the processing of a Security User Master (SUM) BOD, depending on the deployment method/architecture involved.

In addition, user synching does not need to happen only nightly. There is the ability to have the synchronization (via SCIM) scheduled and it can be scheduled to run whenever and as often as you desire.

I really think that if you have additional concerns or questions - a sit down with ICS team (from the Infor OS/IFS/Security side - not on the application side) will answer a lot of those questions. You should also probably attend that webinar above. NOT AT ALL trying to discourage further discussion, just trying to get you to SMEs

...

Thanks for the additional information, it is always appreciated.

0712131256598360.doc

Hello all, Another recent discovery that we made is the need to update to the latest version of MS Addins. That's a significant effort here. Looking forward to the Hans-mentioned webinar. Lenny (lc@choa.org)

Note that technically older version of the Add-ins will still work over the non-ADFS path - something that you have to configure during ADFS setup as well.

This may be better in a new thread soon but it's somewhat related to the ADFS change over. And I'm not sure if this is going to be included with the upcoming ADFS presentations. But has anyone completed the ADFS along with Ming.le 11 integration using the lite version of IFS included with Ming.le? Ming.le was kind of the start of understanding LS as STS and now we need to team Ming.le with IFS which relies on ADFS.

I'm a little late to this, but didn't see this response in the thread. In the IFS Admin Console under Configure -> Parameters on the Synchronize with Active Directory tab there is a column titled User Selection. That can be either Manual or All Users. We have it set to All Users and don't have to manually add users.

Hi Plancor - How did your ADFS install go? I am happy to report that we are up running, Rob from Intellias did a super job for us!

jjotoole: I'm very glad to here Rob did a great job! Thank you for updating me. We just had our kick off call this morning, but it looks like Intellias' schedule will put us out about 4 - 5 weeks for a project start.

Quick Links

Popular Tags