Automated User Setup and ISS

If i understand correctly - you're already running a flow that creates LS users/account, and you want to modify the flow to create Landmark Actors, etc...correct??
If so, you'll be using the Landmark node exclusively. You'll use the Landmark node to: create the Actor (Actor class), add Roles (ActorRole), create Identities (Identity), then add Identities to the Actor (Identity Actor). Depending on your setup, you'll also use it to add the Security Answers (SecurityAnswer) to the Actors, but that would only depend on if you KNEW their security questions/answers. After this, you can also add User profiles, Tasks, Cat Values, etc.

If can get tricky, so my advice is to test, test & test...then test again. I also have legs in my versions that go thru and do a cascade delete of everything. That way i can continue to test with the same users over and over. It also prepares me for when business owners say "can we use this to delete users and do clean-up?"

What do you mean by using the Landmark node exclusively? We are using LSF as our primary authentication source, so ISS should be connected to the LSF side, not the Landmark side, right?

As for deletes, does that work from Landmark? I was advised by Xtreme Support yesterday that you can't actually delete a user from Landmark, it keeps them in the Gen database.

in your original post you said "...but would need nodes added to create the user on the Landmark side manually", which is why i prefaced my answer with "If I understand correctly..."...meaning it appeared that you wanted to add logic to your flow to create/update Actor records.
SO...if you were going to create Landmark Actor records in a flow, it would require using the Landmark node.

Not sure why you got that answer from Infor. I've got a flow that creates Actor records on the LTM side (where Actor records are typically added by business owners, even though you can do the same in GEN), then deletes the Actor from LTM. When i view the Actor in GEN (while this flow is running) I can see them following the Create, then after the Delete node runs, they are no longer in the Actor business class in Gen.

When you manually add a user in ISS, it adds additional attributes to the LSF LDAP user record. Without these attributes, the user will not display in ISS. I have not troubleshooted any further than that. I assume the new ISS List Based Sync would create those attributes and allow you to view in ISS, but you would need to be on LSF 10.0.6.

Darn, that's not the answer I was hoping for Carl, we're only on LSF10.0.4. So you that without the list-based sync we wouldn't be able to modify the users in ISS? Do you think the user would function properly if they were to log into Ming.le and then access Landmark (single sign-on)?

Ok, I just tried using the list-based sync (it was in the instruction manual so I figured I'd give it a shot). It seems to have run and processed the user through all the systems. I did look through the security_provisioning.log file and it looks like it is still doing a sync on all of the categories. Is this normal?

From my experience, the users were able to log into all applications as normal. The only issue was they did not show in ISS.

Once you run the sync they will show up in ISS. I have a PF that creates the users on LSF side and then I run the sync. I can also create the users in LMK using the same flow but I chose to run sync.

You can automate adding the users to Landmark and ISS by creating an xml file and running the ssoconfig command on the LSF server. The XML format and syntax for the ssoconfig is in the ISS documentation. The only change to the documentation is where it says to enter the InputFile in the ssoconfig command line, make sure you add the entire path along with the filename.

I have a client that is experiencing some issues with Landmark roles being added to the wrong employees and would like to delete the roles without deleting the users. Are the following true statements?

1. I believe that the ISS tool is what keeps the LSA and LTMPROD security in sync. When you make the security changes in ISS, both the LSA and LTMPROD security gets updated. I do not think there is a automated process to move the LTMPROD changes to LSA

2. We currently use ISA I believe to do our maintenance but we call is ISS. The issue in PROD is that Landmark is the only accurate keeper of the security roles. If you run the sync from Lawson to ISA/ISS through to Landmark the security will be messed up

3. the synchronization will only sync the LSF and Landmark environment security roles. The sync does not add roles to user records. It simply takes the roles that are in LSF and copies them to Landmark and vice versa. From Paula's last response it appears that the issue is that their are some users that have roles that shouldn't be assigned to them? If that is accurate then running the sync will not help.

4. Will running the sync cause users to get access to roles that they should not have?

I will appreciate any comments as Infor is not aware of issues with ISS and suggesting upgrade to 10.0.6.12 from 10.0.6.6