| User access to ERP LN |  |
| To let the user access ERP LN the last validation will be done by the BLogin daemon. Blogin daemon and SSO ID Web UI receives a ticket from SSO server or a token from AD FS. This ticket/token is send to BLogin with a request to start a bshell for the user that is described in the ticket/token. BLogin will receive an SSO User through the ticket or token. This SSO user will be mapped to the following files on disk: $BSE/lib/user/sso/s[sso_user] $BSE/security/sso_permissions.xml BLogin will use the SSO user to extract the Application User and the System User (listed as ‘baanuser and unixuser’ in the s[sso_user] file) from the supplied BSE environment. BLogin will check in $BSE/security/sso_permissions.xml whether the SSO user is allowed to switch to the found System User. BLogin impersonates the found System User, starts a bshell and connects to Web UI. The user is authorized to start the application. sso_permissions.xml To secure the impersonation step of the process, the system administrator must manually create the sso_permissions.xml file. The permissions file is stored in a separate directory, because the permissions on the $BSE/lib (or %BSE%\lib) folder are not secure enough. Various convert-to-runtime sessions must be able to write in this lib folder. In the home BSE of the BaanLogin Daemon, create the separate configuration file sso_permissions.xml The path on Windows where the executable BaanLogin Daemon (rexecd.exe) is started can be found in the Infor ES Logic Services Properties. Go to Start -> Control Panel -> Administrative Tools -> Computer Management -> Services and Applications -> Services On Windows the path can be: %WINDIR%\Baan %WINDIR%\BaanX64 %SystemDrive%\Infor\ERPLN\commonx86 %SystemDrive%\Infor\ERPLN\commonx64 The x86 folders are used by the 32-bit Infor ES Logic Services. The x64 folders are used by the 64-bit Infor ES Logic Services. The Infor\ERPLN variant is the default folder for new installations. However, earlier installations or systems where already %WINDIR%\Baan or %WINDIR%\BaanX64 was used, the existing variables will be taken over by the new installations of Infor ERP on this system. If multiple BSEs are installed on a Windows system the version of the logic service equals the highest version of all installed BSEs. On UNIX this will be the BSE where the blogind6.x is started in the security directory. Important! Groups or users who have Full Control on a folder or directory can delete any files in that folder regardless of the permissions that protect the file. Make sure that the sso_permissions.xml file is secured and cannot be changed or deleted by other users than the system administrator. for example, the system administrator must correctly secure these directories and file on UNIX: $BSE $BSE/security $BSE/security/sso_permissions.xml For example, the system administrator must correctly secure these folders and file on windows: %SystemDrive%\Infor\ERPLN\commonx64 %SystemDrive%\Infor\ERPLN\commonx64\security %SystemDrive%\Infor\ERPLN\commonx64\security\sso_permissions.xml The following elements are verified: SSO Location: must match with the location format in $BSE/lib/sso_config (or %BSE%\lib\sso_config) Impersonation Example Examples of an sso_permissions.xml files. Example 1: all users will be impersonated as bsp (generic user).
    <?xml version="1.0" ?>
    <SingleSignOn>
        <impersonations
                  sso_location=" https://InforSSOServer:8443/cas/">
            <impersonation os_user="[domain]\bsp">
                    <sso_user name="*"/>
            </impersonation>
        </impersonations>
    </SingleSignOn>
Example 2: A user will be impersonated as their own u[user] file.
    <?xml version="1.0" ?>
     <SingleSignOn>
          <impersonations
                    sso_location=" https://InforSSOServer:8443/cas/">
           <impersonation os_user="*">
                  <sso_user name="+"/>
              </impersonation>
          </impersonations>
     </SingleSignOn>
Example 3: User John Doe or Jane Doe will be impersonated as OS user jdoe.
    <?xml version="1.0" ?>
    <SingleSignOn>
        <impersonations
                  sso_location=" https://InforSSOServer:8443/cas/">
          <impersonation os_user="[domain]\jdoe">
                <sso_user name="John Doe"/>
                <sso_user name="Jane Doe"/>
            </impersonation>
        </impersonations>
    </SingleSignOn>