Login
Register
Search
Home
Forums
Jobs
LawsonGuru
LawsonGuru Letter
LawsonGuru Blog
Worthwhile Reading
Infor Lawson News Feed
Store
Store FAQs
About
Forums
Infor / Lawson Platforms
S3 Systems Administration
Pointing Lawson to an LDAP server with a different Root DN
Home
Forums
Jobs
LawsonGuru
LawsonGuru Letter
LawsonGuru Blog
Worthwhile Reading
Infor Lawson News Feed
Store
Store FAQs
About
Who's On?
Membership:
Latest:
Wayne Willis
Past 24 Hours:
0
Prev. 24 Hours:
0
Overall:
5190
People Online:
Visitors:
316
Members:
0
Total:
316
Online Now:
New Topics
Lawson Landmark
Executing IPA from PR160
5/3/2024 2:46 PM
We're facing a situation where we need to upda
IPA/ProcessFlow
Executing IPA from PR160
5/3/2024 2:46 PM
We're facing a situation where we need to upda
S3 Customization/Development
Cobol - Extract Current Time
4/24/2024 7:21 PM
How do you extract just the Current System Time in
Lawson Landmark
LPL INSTR Functions
4/5/2024 8:32 PM
I'm writing a simple report using the Create R
Infor SCM
Translating 856 to get the ~ REF^CN^ field
4/3/2024 8:24 PM
We are trying to get the tracking number which is
IPA/ProcessFlow
Sample XML file create Flow
4/3/2024 3:43 PM
Hello everyone, I am new to creating XML files
Lawson S3 HR/Payroll/Benefits
bn105 error message
3/26/2024 6:40 PM
I need to change some of the set ups in our Life I
IPA/ProcessFlow
IPA executing Job
3/13/2024 7:08 PM
New to the IPA world and was wondering, can an IPA
Lawson S3 HR/Payroll/Benefits
Life Age Reduction on benefits plans
3/12/2024 7:15 PM
For our optional life we have an age based coverag
Lawson S3 HR/Payroll/Benefits
BN53.1 Add-In
3/7/2024 3:31 PM
We are migrating to Solstice. They require a
Top Forum Posters
Name
Points
Greg Moeller
4184
David Williams
3349
JonA
3288
Kat V
2984
Woozy
1973
Jimmy Chiu
1883
Kwane McNeal
1437
Ragu Raghavan
1354
Roger French
1311
mark.cook
1244
Forums
Unanswered
Active Topics
Most Liked
Most Replies
Search Forums
Search
Advanced Search
Topics
Posts
Prev
Next
Forums
S3 Systems Administration
Pointing Lawson to an LDAP server with a different Root DN
Sort:
Oldest First
Most Recent First
You are not authorized to post a reply.
Author
Messages
Jonathan Lake
New Member
Posts: 2
10/18/2012 4:11 PM
LDAP is AD bound.
We had implemented our production lawson environment to point to an LDAP that has o=lawsonprd,dc=company,dc=org as the root DN.
Our DR lawson environment was created pointing to an LDAP server that has o=lawsonprddr,dc=companyp,dc=org as the root DN.
We are trying to reconfigure our DR environment to use a replicated LDAP server which is identical to prod. using o=lawsonprd,dc=company,dc=org as the root DN.
Here is what I have done:
ssoconfig -c option 3 and reconfigure this to point to the different ldap server. lase fails to start.
I edited $LAWDIR/system/RMApiInit.properties and updated all the hard coded LDAP DN's to reflect what it should look like to make this work. Lase now starts, however smoke tests fail with:
Error: Failed to authenticate user lawson
Message: com.lawson.lawsec.authen.LSFSecurityAuthenException:Message:javax.crypto.BadPaddingException: pad block corrupted. This is where I am stuck.
It is my understanding there is some encryption mismatch. I did an ssoconfig -c to export the services and identities, and the items causing problems are put in the lase_server log. The services export fine, the identities provide a huge list of what could not be exported. I am stuck and not sure what to do next.
I don't know if re-doing an ldap bind would help (I wouldn't think so but could be worth a try).
If deleting and recreating users in ldap would help any.
I'm hoping to get this resolved for our DR test this weekend.
Jonathan Lake
New Member
Posts: 2
10/18/2012 6:56 PM
I have found that if I do an ldapbind on our DR server, ssosmoketest works and I can bring up the environment. However, this breaks our prod environment, giving the cell padding errors with the ssosmoketest.
Is there a way to move our DR server to use the same LDAP instance as our prod server without breaking either environment?
Roger French
Veteran Member
Posts: 545
10/18/2012 9:04 PM
I think you're going down a path that will give you more headaches. It sounds great in theory, but I don't think it's going to work.
One Lawson environment requires one Lawson LDAP.
Another Lawson environment requires another, separate Lawson LDAP.
Not recommend and most likely not doable (I've never done it) to have a single Lawson LDAP for two separate Lawson environments.
Both Lawson environments can be bound to your organization's AD (used for sso passwords) using the ldapbind tool.
John Henley
Senior Member
Posts: 3349
10/19/2012 11:50 AM
I'm trying to understand what you're attempting, but it's confusing to mix "ldapbind" with "ldap repository", as the two are different.
As simply as I can explain:
- "ldapbind" (when referring to LSF) is the authentication mechanism used by Portal (the SSOP service) to authenticate a user. Where it gets confusing is that LSF also uses an ldapbind internally against it's own repository in addition to the SSOP authentication. So in the $LAWDIR/system/install.cfg, the LDAPBINDDN parameter is the internal ldapbind --- not the SSOP service's ldapbind. So you have to be very specific about which ldapbind you're talking about. For some clients, ldapbind for SSOP is done against the Lawson internal LDAP repository (i.e. LSF manages SSOP passwords); for others SSOP is bound to a corporate LDAP, typically Active Directory.
- "ldap repository" is the container used by LSF to store security-related data (i.e. users, their identities, security classes, roles/rules).
For your DR test, I'm assuming you have a separate DR LSF environment, on a separate server, on a separate network.
Are you trying to point that environment, which contains it's own LDAP repository, to a different AD for ldapbind for SSOP ?
Or are you trying to copy the production LDAP repository to update/replace the DR LDAP repository so that you have a refreshed copy of the users, security rules, etc.?
You are not authorized to post a reply.