ESS and LS9.0

What is the question?

hello,

Ok, i curently have 500 corporate users (ls9 - using LAUA). I want to give them ESS access and do not mind creating a second login for each user (example use emplyee ID number) -so that account has ONLY ESS access

What is the best way to do this ?

Do I have to add all the second accounts to My Active directory and into LAUA, or is there a way to add all the users into LS - and point them to one "generic" LAUA security user and security class. ?

Thanks in advance.

Hi John

I guess the questions I have in trying to get my corp. users ESS access (1 login for applications, 1 login for ESS):

Can I use 1 generic user (essuser) for LAUA security ?

What do they need access to in LAUA to grant ESS access (is it just LOGAN) ?

How do I "point" all of my corporate ESS only accounts to use that generic (essuser) user, so they use its security in LAUA ?

 

thanks again for your assistance

I am in a similar situation where my Finance users have lost the securit yrights to access certain ESS data due to their LAUA secuirty class. Lawson's official position on this is you have to create a second user ID. So far I have not found a way to spoof it like you could by using the login field on RD30 in Env 8.03. I am testing a workaround that you may want to consider. You can assign the HR system codes to a new sec class and then remove all the forms except the ones the ESS forms need to call. It's not pretty, but I think this will work for us until we turn on LSF9 security.

Hi Joe

Do you still have to put the "second" ESS user into AD and assign them the secuity class ?

I was hoping to avoid this - but - correct me if I am wrong - the solution is

1.Creat a second login for current lawson application users (corporate) - such as employee number

2. Assign a Generic ESS security class to the new logins (emp. number)

 

my boss was thinking as you were, that you could "point" the second login to a generic user and security class in LAUA - thus avoiding to add all the secondary ESS user accounts into LAUA.

I've not tried to do it this way yet, but for the 2nd (ess only) uid to work they will need to be able to get past the sso login screen, so I would think a 2nd AD account would be required. In my scenario we're still on LAUA security and for you to be able to assign the "sea" sec class to them so they need to be in set up in AD to show in laua. If you are using lsf9 secuirty or don't have Lawson "bound" to your AD the conditions might be different. I don't think lsf9 sec admin will allow multiple users to be assigned the same id - if it did you could get around the whole mess as far as I can tell, 99% of ESS is looking up stuff based on empno, not uid.

Actually we are still on LAUA..

Seems like we have similar setups, LSF9.0, still using LAUA and Windows\SQL setup..

So did you go through and create AD accounts the ESS only access ?, so your applications users have one login for Lawson work adn another for ESS ?

We have < 20 finance users but I didn't want to create 2nd accounts. I set up a new wide open security class, left the data access alone but removed all the form id's except those that ESS calls out to (for us there were <10 form id's referenced by ESS/MSS). I've tested ESS logged in with this sec class - it seems to work fine and will still prevent the finance only users from getting to the all the HR/BN/PR forms from LID since they are denied. I need to do a bit more tweaking to prevent damage in the event that someone had the knowledge to navigate to directly to one of the forms we had to "allow" for ESS to work. This is unlikely in my shop since the users do not know which HR forms are enabled nor what they do.

You have to create a "privileged user" - see Article 558755 in the KB.

We have a privileged online identity set up but our application users need their OS Identity record for running the applications. If you don't delete the OS Identity record the Privileged Identity is not used and the LAUA security class asigned to the OS Identity will be in effect. It's a catch 22.

Hence, the raison d' etre (OK, I'm not French) for Lawson 9.0 Security instead of LAUA security.

I believe that you would have to create 500 ESS ids and define them in AD. These ESS ids would point to the 1 "priveleged user." Whatever is in this user's security class would be given to ESS users but for their own employee id.

Thanks for all your input.

We used loaduser file to add in ess only user access (based on emp ID number)..I then pointed these to the 1 essuser with generic corp ESS security access. We used a different portal xml file to eliminate 'roaming" eyes