1 / 18

Automating EMSS Security and Access from the Internet

Automating EMSS Security and Access from the Internet. Presented by: Amy Cordell September 29, 2009. About Truman Medical Center. Two-Hospital, not-for-profit located in the Kansas City Metro Area Primary teaching hospital for University of Missouri-Kansas City Schools

gigi
Download Presentation

Automating EMSS Security and Access from the Internet

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Automating EMSS Security and Access from the Internet Presented by: Amy Cordell September 29, 2009

  2. About Truman Medical Center • Two-Hospital, not-for-profit located in the Kansas City Metro Area • Primary teaching hospital for University of Missouri-Kansas City Schools • Specializes in asthma, bariatrics, diabetes, women’s health, and trauma services • Downtown location is the largest provider of outpatient care in Kansas City • Busiest adult emergency room in the city with more than 60,000 visits per year

  3. Objectives • Binding to Active Directory • Automating Adding / Deleting Users in EMSS • Access to EMSS from the Internet

  4. Advantages of Binding to Active Directory • Eliminates another user name and password • No separate administration for the Lawson app • If AD account is terminated / inactivated, so is access to the Lawson application • Identifies if duplicate AD accounts are being used • AD account was added as a user field in Lawson on HR11 and a daily import runs to add this information for use in Lawson Security

  5. Disadvantages of Binding to AD • Unable to log in as other users to test production issues in test • Must delete and reload user if AD account is changed (name change, middle initial added)

  6. Adding Users in Lawson Security • Automation process will depend on the organization’s tools • Process Flow Integrator (PFI) is the most efficient tool to accomplish automation • Perl Script in combination with MS Addins or another query tool may be used if organization doesn’t own Process Flow Integrator • Doesn’t fully automate the process • Limits the amount of data entry • More streamlined than adding the account through the security application

  7. Process Flow Integrator (PFI) to Add Users • Add users by hire date or employee ID • Query for employees with input data of hire date or employee ID • RM action is to add • Message Builder to capture output from each record for adding by hire date • Write to File for review

  8. Input Data • When process flow is ran either put in the employee ID or the hire date • Hire date used must not return large amounts of records or process flow will fail. If user is an older hire then it is best to add by the employee ID

  9. Deleting Users with PFI • Similar process to adding users • Query for employees with a termination date in a specified range • RM action is to delete • Message Builder to capture output from each record • Write to File for review

  10. Access to Employee Self Service from Anywhere

  11. Access to EMSS from the Internet • Internal DNS name created for ME.TMCMED.org • This DNS entry points back to the Lawson server and is set up on the server in the configs for the application as ME.TMCMED.org • The SSL Certificate for ME.TMCMED.org is bound here • External DNS name created for ME.TMCMED.org • This DNS entry points to the publicly available address for TMC • That address terminates on our external firewall and is translated back to the DMZ where we have Microsoft ISA (Internet Security and Acceleration) Server • Intrusion detection and additional network security is applied before ISA server receives traffic.

  12. ISA Server • ISA Server securely publishes the content from that point • In addition, Intrusion Detection and IP Protection occur here as well • All HTTP and HTTPS requests that do not match paths or other security stated below are redirected to https://me.tmcmed.org/lawson/portal • The SSL Certificate for ME.TMCMED.org is bound here • ISA Server inspects traffic and forwards to the internal server, Lawson production server

  13. ISA Server • Authentication #1

  14. Access to the Lawson Server • The only allowed paths are: • /ssoconfig • /sso • /sites/hr • /servlet • /sePlugins • /Lawson • /cgi-lawson • In order to limit access to only required paths on the Lawson server • If a subdirectory is included, then access to other subdirectories under the parent directory are not

  15. Network Security Precautions • All incidental HTTP (unsecure) traffic is redirected to SSL port 443 • Only authenticated Domain users are allowed to connect through the rule • Customized forms were created to allow for authentication to the domain • Once authenticated, access to Lawson prod server can occur • Delegation was not possible due to the configuration of the Lawson application • Access to Lawson production server is through another web form on that server

  16. Logging into Lawson • Authentication #2 • Lawson portal is only compatible with Internet Explorer • Firefox, Mozilla will not function properly with Lawson portal

  17. Questions?

More Related