Problem:           

If your controller is failing and you need to move the LSF LDAP to another controller

Resolution:

Edit the ldapbind information in the SSOP service and reload it.

1. Create a dump of the SSOP service:

• ssoconfig -c
• Option 5 Manage Lawson services
• Option 6 Export service and identity info
• Option 2 for not all services
• Enter SSOP in upper case
• Enter NONE in upper case
• Give a filename (it will write out the file to the directory you are in when you run the ssoconfig -c command.) Example: ssop_prod.xml
• Exit the ssoconfig menu.

2. Make a copy of the .xml file that you just created. This is your backup of the SSOP service in its original state.
3. Then edit the first .xml file and change the following lines:

<BATCH_LOAD FORMAT=”” OVERRIDE=”false”>

to

<BATCH_LOAD FORMAT=”” OVERRIDE=”true”>

and this line to the new machine name and port:

<PROVIDER>ldap://dc1.lawson.com:3268</PROVIDER>

to

<PROVIDER>ldap://dc2.lawson.com:3268</PROVIDER>

4. Save the file.
5. Do one of the following to load the modified SSOP service file:

ssoconfig -l ssoconfig_password filename.xml

Exit.

6. A stop and start of the Lawson environment and WebSphere application server is required in order for this to take affect.

Installing LDAP certificate in AD LDS instance

1. Identify the AD LDS service instance in Services
   • LSF
2. Launch MMC (Microsoft Management Console)
3. Choose File > Add/Remove Snap-In
4. Add the certificates Snap-In
5. Choose “Service” account and click “Next”
6. Choose “Local Computer” and click “Next”
7. Choose the Service Account for your AD LDS service and click “Finish”
   

   

8. Right-click on the service that was added and select “All Tasks > Import”
9. Click next and browse to the .pfx certificate file. Click “Next”
10. Enter the private key password
11. Place the certificate in the <AD LDS service>\Personal store
12. Click Next then Finish

Export the certificate for Java OS & Java WebSphere

13. Right click the certificate > All Tasks > Export and click Next
14. Do not export the private key
15. Choose Base-64 encoded X.509 (.cer) and click Next
16. Choose a location to save the file for later use
17. Click finish

Grant Permissions to Certificate Container

1. Run command “certutil -store MY’
2. Find the container with your AD LDS certificate using the thumbprint to identify it
3. Give NETWORK SERVICE read & execute permissions on the key container file AND the key container directory (C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys)
4. Stop the AD LDS environment service
5. Restart the AD LDS service

Smoke Test

6. Open the ldp.exe tool
7. Type the server FQDN > SSL port and check the SSL box
8. Click “OK”
9. Successful connection to LDAPS
   

Update the LDAP Certificate in WebSphere

Cell Trust Store

1. Access the WAS Admin Console and navigate to: Security > SSL certificate and key management > Key stores and certificates > CellDefaultTrustStore > Signer certificates
2. Click the Retrieve from port button.
3. Host: <your AD LDS host>
4. Port: 636
5. Alias: give it a meaningful name
6. Click Retrieve signer information.
7. Click OK & save changes.

Node Trust Store

1. Access the WAS Admin Console and navigate to: Security > SSL certificate and key management > Key stores and certificates > NodeDefaultTrustStore (for the LSF server) > Signer certificates
2. Click the Retrieve from port button.
3. Host: <your AD LDS host>
4. Port: 636
5. Alias: give it a meaningful name
6. Click Retrieve signer information.
7. Click OK & save changes.

Perform these same steps in the Landmark websphere instance.

Update LDAP Certificate in OS Java

Do this in both Lawson and Landmark

1. Open a command line and set environment variables
2. Run command “where java” to determine where LAW_JAVA_HOME is located
3. Back up <LAW_JAVA_HOME>/jre/lib/security/cacerts
4. Copy the cert that you exported from the LSF service from the Lawson server to the Landmark server
   • This is the cert you will be importing into cacerts
5. Run the ikeyman utility at WAS_HOME/bin
6. Open the LAW_JAVA_HOME/jre/lib/cacerts file and select the Key database type of JKS
   
7. Type password “changeit” (default)
   
8. Select “Signer Certificates”
9. Delete the existing certificate, then re-add it
   
10. Click “add” and navigate to the ldap certificate exported earlier
11. Give it a meaningful name
    

Update LDAP Certificate in WebSphere Java

1. WebSphere Java directory is WAS_HOME/Java
2. Back up files WAS_HOME/java/jre\security/cacerts
3. Peform the same steps as OS Java using iKeyman for both Java instances

Problem:           

Patch being installed if failing when running lawappinstall activate. It fails when running ujobload.

10/31/2023 5:44:25 Executing ujobdump.

10/31/2023 5:44:25 ujobdump execution successful.

10/31/2023 5:44:25 Executing ujobload.

10/31/2023 5:44:26 ERROR – ujobload failed.

ujobload via lawappinstall activate *** No jobs found to load When run manually, it fails with Segmentation Fault(coredump:

Resolution:     

lawappinstall update will stage tokens potentially needing a ujobdump/ujobload in LAWDIR/productline/backup/ACTIVATEstage/JOBconversion.

If conditions are correct, lawappinstall activate will run ujobdump and ujobload, then clean up the staged area.

1. ujobdump -d LAWDIR/productline/backup/ACTIVATEstage/JOBconversion productline $LAWDIR/productline/backup/ACTIVATEstage/JOBconversion.dmp -t <list of Tokens>

In the above <list of Tokens> would be a space-separated list of the tokens located in $LAWDIR/productline/backup/ACTIVATEstage/JOBconversion/??src directories.

1. ujobload -ou productline LAWDIR/productline/backup/ACTIVATEstage/JOBconversion.dmp
2. remove dump file, LAWDIR/productline/backup/ACTIVATEstage/JOBconversion.dmp
3. remove stage dir, LAWDIR/productline/backup/ACTIVATEstage/JOBconversion

Run steps a through d manually, then rerun lawappinstall activate.   If the ujobload fails in step b with a Segmentation Fault(coredump) or other error, make sure the user running ujobload has write access to these files and their directories.

LAWDIR/UJobLoadDir/productline/Tokens

LAWDIR/productline/UJobLoadDir/LDLog

Make corrections if necessary, run steps b through d above, and rerun lawappinstall activate.

What do the Lawson Base Mingle Roles Control?

• “Infor-SuiteUser” is the end-user role. This is the default role assigned to all the users. Users with this role have access to the portal only. The portal is one of the components of the Infor Ming.le application. The portal consists of a top level header, an app switcher panel, search, the user menu, share, bookmarks, and a right panel (context/utility applications panel). The users with this role only do not have access to the social space or ION-related features.

• The “MingleEnterprise” role provides access to the social space component of the Infor Ming.le application. The social space component consists of activity feeds, connections, and groups.

Users who have this role can do these actions:

• • View the activity feed page
  • Post messages to colleagues and groups
  • Create new groups
  • Connect to users and groups

• “MingleAdministrator” is the role assigned to users to have access to administration pages in Infor Ming.le.

By design, the “MingleAdministrator” role is added to all applications in the tenant. The user with this role can view all application icons on the App Switcher panel. The user’s ability to open the application and access functionality, however, is controlled by the application security.

Users who have this role can see the Admin Settings menu item under the profile menu.

Users who have this role can do these actions:

• • Manage applications
  • Manage context/utility applications
  • Manage drillbacks
  • Manage general settings
  • The user with the “MingleAdministrator” role also needs the “MingleEnterprise” role in order to administer some of the users’ related features in social space.

These users can also do these actions:

• • Manage users’ feeds and groups’ feeds
  • Delete any Infor Ming.le group
  • Deactivate the users and groups and also reactivate them

• “MingleIONEnabled” is a role that allows users to access ION-related features within Infor Ming.le.

ION-related components consist of alerts, tasks, ION notifications, and workflows.

Users who have this role can do these actions:

• • View alerts and perform all the actions in the alerts
  • View tasks and ION notifications and perform all the actions in the tasks and ION notifications
  • Alerts and Tasks options are displayed in the user menu for the users who have this role.