Mass Assignment in RM

I use two methods for adjusting Roles in an automated way:

- Mass Assignment (as you indicated) will ADD Roles to those already in place.

- loadusers DELETES and REPLACES all Roles.

There are several ways of capturing the existing Roles, including one of the recently added Lawson Security reports. You can collect those in a file, edit the file to remove the offending role from those users, format it as the XML used by loadusers and run it. It will basically wipe out their existing roles and replace with all but the offending role.

Does that all make sense?

Best regards,
Dave
(303) 773-3535

Thanks Dave.

It has been our experience that when you run the load users script, it can only be done for a NEW SETUP/ADD, or a FULL DELETION of a profile. We have been unable to use it to modify existing roles on a profile, which is what we are aiming for in this case. We'd liek to delete the role from anyone who has it, but keep all of their other roles and settings in tact as is.

Is this possioble with the loadusers script? (Or by any other means for that matter?)

Thanks again for any direction you can provide.

Here's part of the loadusers XML file I used to add the TimeKeeper Role to several users (since it wipes existing Roles, I had to include EVERY Role I wanted the user to end up with):



The entire body of the XML file looks just like that. Some versions of LSF also require you to include Firstname and Lastname (rather odd), so watch for an error that seems to indicate that. Also, you may have to watch out for passwords. If you're bound, then there's no problem. If you're not bound, loadusers does tend to reset passwords. Suggestion: build and run this for one user to get all of that figured out, then run for 10 or so, then the entire population.

Mine was obviously a Windows system. If you have that, you probably know the listusermap command to get the translation between NT000000xxx and the user ID. For Unix, the RM ID goes there.

Thanks Dave. I am familiar with the LoadUsers.xml. So it sounds like what you're saying is that any time you use it, it overwrites any existing info for the user with ONLY the information you're loading back with the file. If this is the case, then there is no way to maintain roles 1, 2 and 4, while removing role 3 form any given user (or users). Is this correct?

Has anyone devised a way to accomplish this, making UPDATES to an existing profile, without needing to remove the users existing roles?

Thank you.

You're right in that whatever Role(s) you "add" with loadusers will completely REPLACE all Roles that are already in place. If they already have 5 roles and you run loadusers with 1 Role, they will have only 1 Role when it's done.

I don't have another way to surgically update individual Roles (yet, anyway). Maybe we'll find out here someone else knows a way to do that!

Remember to be wary of passwords with loadusers if you're not bound!

Best regards,
Dave
(303) 773-3535

Thanks Dave. I hope so too. perhaps I'll make a new post with a closer description to what I'm really asking here so it catches the eyes of anyone who might have an answer. Thanks for your feedback!

There's a current env patch that appears to address this...

JT-134962 [REL_900_SP8] The loadusers tool should append the specified roles to a user's list of roles rather than replace them.

The latest (May 2010) Lawson Administration Resources and Security 9.0 Guide describes the current delete capability. I'm just starting to explore this...

You can use the loadusers utility to mass-delete users, roles, or groups. You might do this, for example, if you want to clean up your system to eliminate faulty or old data. Mass-deleting through this method is powerful and should only be done by a system administrator who is knowledgeable about the Lawson system and about XML.

The loadusers utility accepts input from an XML file that you create. You can populate any attributes that you want to delete.
Following is an example of an XML file that has been used to delete users, roles, and groups.

loadusers -f filename -p defaultProdLine -d defaultDomain
-u -g username
...

I have used this (-u) and it does work.