Securing DS in PROD

I think you have to secure the URL. I don't think you can secure it through Lawson Security.

Thanks Davidfor the quick response, We did find a KB article that references securing the URL.

I included that in case anyone else in interested but it sounds like what we see and you are confirming, we have to secure the URL to make it work.

Securing the Lawson Design Studio

Description:
Does Lawson provide a way to secure Design Studio so that only specific users can access it?

Resolution:
No, Lawson does not deliver a mechanism to secure the Design Studio (DS) application. By default, everyone that has access to the Lawson Portal can also access DS. However, an alternative is to grant or deny access by restricting access to the DS URL (http://hostname/lawson/portal/studio) or the /lawson/portal/studio directory via your web server.

Hello Mark,
Per Lawson's best practices, Design Studio being a customization tool is NOT installed in Production. You develop and test in other environments and migrate the file to PROD.

My take on this is that you should not use or install DS in PROD environment.

But, in the event that you do or need to, you could possibly try securing the URL for DS within IIS (if on Windows),  or Apache (if on Unix). 

I've brought this up before to Lawson at CUE, with the same response as above. I find it very difficult to believe though with all the security in the system they can't seem to control access to a tool that allows you to make changes by someone with just a little knowledge. Case in point: I switched jobs where I no longer do Design Studio modifications or even have access to most forms. But I KNOW how to get access to make changes if I so desired.

Tell me it can't take that much to add a flag to RM security.

Then you might want to explore having a single, general, login which has access to DS, which is accessible by using a URL - it's a web-based tool (yes we all know that. )

For example, if you have a login called 'dslogin', and set it up in Sec Admin, it will give you access to DS, as well as Portal. You can further secure login access to Sec Admin, Pflow admin, LBI, RM... so those tools are only accessible to specific logins besides 'dslogin'.

But, when you have other IDs besides 'dslogin' which have access to Portal, etc. those other IDs also have access to DS as well. 

Another option (which I have not tried) would be to explore securing the executible for DS on your severs by using groups (Windows or Unix groups) and put the dslogin ID(s) only in that group which has access. (http://server/lawson/studio)

It's not against the law to have DS in a PROD environment, but it's with caution, because having access to change web files, forms, etc.using DS (for example) in PROD is a no-no to many IT departments, auditors, etc.  When you make a customization you do it in DEV or TEST first, then move the files to PROD, and then use the Portal Admin tools to change the PL, etc., 

Thanks for all the suggestions, We have not installed DS in PROD during the 4 plus years of development here do to exactly what you all have pointed out with the difficulty to secure.

The issue of having pages (not forms) that are developed not changing product lines without manual intervention may still be a better long term solution than opening up DS in PROD.

We will most likely try a few things to secure DS on the server. When we get around to this, I will update this post with results in case anyone else is interested.

I believe that Lawson has made some strides in allowing DS to be secured through Lawson Security. I'm not sure which version of the Lawson Administration: Resources and Security guide I'm looking at, but it is under Chapter 22.

It looks like you need to create an executable for FileMgr using tokendef, and then you can create a security class to allow access to it for those users who need it.

Nick