User Ids in a Report Security group in LBI

http://www.lawsonguru.dan...lbi-security-groups/

This gives only the name of the Report sec group and not the actual user-ids that belong to the report sec group. Previously these user-ids in a previous version was stored in ENPUSERGROUPLIST but this table does not exist in the latest version of LBI for 9.0.4.2. These user-ids that are attached to a report security group have to be stored somewhere but where ?

Ruma: Take the ERS_SECURITYGROUPS.SECURITYGROUPID and use that to link to ERS_REPORTACCESS.JOBNAME
Then filter ERS_REPORTACCESS to REPORTID=-99 and INSTANCEID=-99
I think that will get you close.

I got this part. If I created a group in sec admin and attached that to a report security group in LBI there used to be a table called ENPUSERGROUPLIST that had all the ids for these users. These user-ids were attached to group in sec admin. I guess the table was removed from LBI so we can no longer find out the user-ids that were attached to a group in sec admin that could be attached as part of the report security group.

Something similar to this works for me.
Select *
from LAWRS.ERS_REPORTACCESS RA,
LAWRS.ERS_SECURITYGROUPS SG
where RA.INSTANCEID='-99'
and RA.REPORTID='-99'
and RA.JOBNAME = SG.SECURITYGROUPID
;

Ruma: Do you mean Lawson Security Admin? If so, you'd have to query the ldap to find out the members of the groups.
See the Unix script that I've attached.

Thanks Greg. This helps me. I am however disappointed that there are 2 tables removed that used to store this information in LBI. One for reporting services called ENPUSERGROUPLIST and the other in framework services called ENPENTRYACCESSLIST.

It's probably from Lawson's own recommendation to not run the LBI Sync with the "remove expired users and roles" box checked. I can see LS and the tables getting horribly out of whack.

With our rate of turnover and/or reorganizations/reassigning job duties, it's probably a good thing that all we need to do is keep people in the correct groups in LS. But I can see your point as well.

Hi there,

I read the entries to this post and still have a question.

Can you delete a user ID without removing the user from all of the reports, dashboards and rights that are assigned to the user ID? It appears that that is the case when I read the post but I would like to verify the procedure. We have some orphans that are no longer in AD and some other IDs that I need to research before taking action. I also think we may have a user or 2 that have multiple IDs.

Thank you.

@Donna: You can delete an ID from Lawson Portal and as long as you are NOT running the LBI sync with the 'remove expired users and roles' box checked, they will still be in LBI... If you are running the LBI sync with this box checked however, you will be removing them from all reports, smartnotes, dashboards, etc.

Greg,

We do not have the 'remove expired users and roles' box checked. However, in most cases the users we are removing are either orphaned users (no longer in active directory) or termed users so your answer is very reassuring.

Thank you for taking the time to respond.

Donna

Donna: Why would you want termed users to still be on reports?
Our practice here is to remove their LBI delivery device, and eventually remove them from the reports as well.

I'm just curious.

Greg,

I don't want to keep them in LBI but I did not want to do anything that will create other maintenance issues so we have not checked the 'remove expired users and roles' yet.

We are beginning a maintenance project on LBI and will probably check the 'remove expired users and roles' once we have the analysis complete.

I do have one more question though. It appears that all we have to do with the Termed employees who are no longer in Active directory is delete them from Lawson Security. Is that correct?

Thanks to some of your prior posts, I have been able to create reports that allow me to analyze users and their relationships to LBI roles and published reports since my last post. Now I just need the time to do the actual analysis and perform the clean up tasks.

Thank you again.

Donna

Deletion from LSA is all that we do here..

With the 'remove expired users and roles' box checked though, if the expired user owns anything in LBI and gets removed from LBI, that content will be transferred to a default account called SYSTEMMANAGER --- Any LBI administrator can use the 'Content' link from the Tools dashboard to transfer and reallocate the content. The LBI Guide recommends that before a user is removed from LBI, they transfer their content themselves though to prevent the system from doing it automatically and possibly screwing something up.

The last part is not actually part of the documentation, but my thoughts alone.

Thank you for the kind words!

Greg,

Thank you. I have enough information now to complete my task.

Your contributions to Lawson Guru are a wonderful help to members of the community and certainly should be recognized.