Userid/Passwords with Employee Space or Self Service

Ok.. we are new client working on build at this time.
Planning to use LDAP/AD credentials for Infor, both S3 for payroll (ESS) and Landmark TM (Employee Space).
However, currently not all of our employees have AD accounts (home health aides, etc). Which isn't a problem to create AD for them but realize if they go to the url we create for external access to Employee/Self Service to update their records, view pay deposit, enroll in benefits, etc... if their AD account expires (ours are set to expire every 60 days) the employee will never know their AD expires until they are locked out of signing in to Infor Employee/Self Service.

Are we really the only Infor customer that has this situation?

I think at this point our only option is NOT to use LDAP/AD credentials and really make all core/daily users have yet one more password to remember.

Any feedback would be greatly appreciated.

Find more posts tagged with

Infor Lawson Human Resources Group - Discussion

Comments

todd-brown

You are not the only customer with this issue. We are in the planning process for ldap bind with Lawson. We have no good solution for the external users. Its possible that we can create a process that will email people when their passwords are about to expire. At that point they will need to contact our IT helpdesk to have the password reset.

Anyone have a better solution I would LOVE to hear it.

todd-brown

We also have kicked around the idea of not expiring the external user AD passwords. However our IT auditors are not thrilled with this idea.

unknown

We have the same situation but luckily we only have a small group of people that only use the Lawson application and no other network application. We have basically told them that every 90 days their password expires. When they can't log into Lawson anymore to try to log into the network Citrix URL and it will tell them to change their password... or they can call the Help Desk but our HD gives them a temporary password so they still have to log in somewhere to set it a permanent one before they try Lawson again.

They do like having 1 password between the Network and Lawson.
Also keep in mind that if you are bound and your Network group changes the persons user id that also needs to be changed in Lawson security or the person will not be able to log in. This shouldn't happen that often but its good to keep in mind if you have different groups maintaining the systems.

unknown

Thanks Lisa and Todd for the feedback.
You are both considering/doing the only things I could come up with other than not using LDAP. I have analysis under way to indicate how many employees/users we are talking about out of our 3500 count.

unknown

Has anyone got an LDAP BIND in place that allows terminated employees external access for X days to view Paychecks or W2 information?
We are going to LDAP Bind using corporate ID for login. Current policy with using a Lawson ID that employees can access Lawson externally through their last paycheck. Network ID's are terminated on the day of termination. Is there a way around this inside Lawson Security? Would we have to have a separate LDAP for terminated employees maybe?

unknown

Remote access to our network requires an active network account which is not allowed following termination. So no - they can't get on the network - so they can't access Lawson.

unknown

We don't have a good solution to that either... we have the same situation for employees on Leave of Absence, we are required to stop their system access while they are away.

We don't display the W2's on the Lawson side we use an outside vendor to send them out and the employee can access those on the vendor site.

As for pay stubs they have to contact the Payroll dept. to get a copy.

unknown

I said the solution is to require the employee to provide a personal email address to have payroll send a pdf with their paystub or mail their last check. They don't want the additional work....
We are meeting today with Lawson consultants to discuss possibilities.

bhillz

Any your Security Office approves of sending payroll information through a non secure medium, such as email? Why not just broadcast all paystubs to everyone?

unknown

It was a suggestion to send it via email not a solution. Our security team has basically said there is no solution if we go to LDAP Bind.

0712131256598360.doc

unknown

At our site, our Security policy says that all access to all systems has to be turned off on termination or LOA. So even if we weren't LDAP bound we can't have an account active beyond the date given to us by HR.
Our auditors look for this as well.

Sending out the pay stub via email would be fine as long as you use a secure email system.

juergen-erbe

Or ensured that the file itself was encrypted.

There are plenty of solutions avaliable to take an already existing PDF file and 'regenerate' it with a user and/or owner password.

User passwords actually encrpyt the file and are not trivial to remove as long as the password behind them are appropriately picked.

Owner passwords are unfortunately trivial to remove, but aren't used to actually protect the data as much as they are used to enforce usage rights (i.e - are you allowed to print this, are you allowed to edit it in Adobe Reader, etc.)

asztudenyak

We have many MANY employees that use only the ESS portion of our Lawson system. Since one must log in to the network to access the splash page for ESS, all employees must have an AD account. If they don't access it often enough and miss their expired password notice (ours is 90 days), they simply call our help desk and get it reset. It's never been a problem for anyone - I mean, that seems pretty standard to me.

We have had a request for employees on long term leave (we stop access also) to be able to log in, and I think we are addressing it, but not sure what the plan of action is. Termed employees though - no, no access at all. They would have to contact Payroll for copies of anything that was needed.

[Updated on 4/17/2015 11:50 AM]

unknown

We are LDAP bound and have an employee population >10,000. We remove all access immediately at termination (including network and EMSS) and deliver a paystub, by mail, to employees who have a term status. We use MHC for check writing and were able to add a setting that indicates the program should generate a paystub for the final paycheck, even if it's direct deposit for a person who is in term pending status. This process gets our payroll department out of the business of printing individual copies by request every pay period.

Since most of our applications are single sign on, our workforce is constantly using their credentials in some system or other so we have very few issues with passwords expiring from lack of use. Our employees have to call our helpdesk for password resets regardless of system so its a well established and recognized process.

unknown

We are bound to AD and have a large remote user base for EMSS. We do not expire our EMSS user passwords since they do not have access to the S3 applications. Users have the ability to change their password from the default generated one and we have a 3rd party password reset option that they can leverage if they forget it. We do not email or mail stubs and W2's to termed EE's because they often change their email address or move. Instead, we provide access to termed team members in EMSS for a period of time by putting them in a "term-pending" status and they are kept alive in AD. When they hit this status we manipulate the users EMSS menu so they only have access to pay stubs and W2's. On the HR side they are effectively termed since there is no pay or benefits and their original term date is retained. Once the pending period expires the employee is moved to "Term Perm" status in Lawson and the AD account is disabled so they have no access. If you take this approach you just need to be mindful of any seat based licensing for AD, EMSS, etc since your actual active user count at any given time will be increased by a certain percentage. While it will never eliminate all the requests, we have found this approach to greatly reduce calls to HR for last check reprints, etc. Good Luck!

[Updated on 4/17/2015 12:28 PM]

[Updated on 4/17/2015 12:28 PM]

Copyright © 2025 Infor. All rights reserved.