Novell Identity Manager Driver
for Lotus Notes Advanced Configuration

Perry Nuffer

Software Engineer

Novell, Inc.

Richard Matheson

DirXML Driver Engineering Manager

Novell, Inc.

Session Road Map

Lotus Notes Driver Architecture Overview

Driver Installation and Configuration

Advanced Configuration Parameters

Lotus Notes Driver Enhancements

Session Road Map

Lotus Notes Driver Architecture Overview

Driver Installation and Configuration

Advanced Configuration Parameters

Lotus Notes Driver Enhancements

Sharing data through an identity vault

HR

ERP

PBX

Directory

Mail

Operating
System

Database

Identity Manager

Novell eDirectory™ Server

Identity Manager Architecture

Identity Manager 2

DirXML®

Engine

DirXML

Driver

Shim

Policies

Policies

Identity

Vault

Application

Subscriber Channel

Publisher Channel

Remote Loader Service

Identity Manager Architecture
The Remote Loader

Application

Identity Manager 2

DirXML

Engine

Remote Loader Shim

Novell eDirectory Server

Policies

Policies

DirXML

Driver

Shim

Subscriber Channel

Publisher Channel

Application

Identity

Vault

Lotus Notes Driver Architecture

Two Deliverables

Application Shim

Java based

NotesDriverShim.jar & CommonDriverShim.jar

Accesses Notes via Lotus Domino Java Toolkit (Notes.jar)

Change Log Generator

ndsrep

Domino Server Console Add-in

Accesses Notes via Lotus C APIs

Stores changes in a cache (ndsrep.nsf)

Available on Win32, Solaris, Linux, and AIX

Lotus Notes Driver Architecture

Application

Identity Manager 2

DirXML

Engine

Novell eDirectory Server

Policies

Policies

DirXML

Driver

Shim

Subscriber Channel

Publisher Channel

Notes DB

Identity

Vault

Change log DB

Cfg DB

NDSREP

Session Road Map

Lotus Notes Driver Architecture Overview

Driver Installation and Configuration

Advanced Configuration Parameters

Lotus Notes Driver Enhancements

Supported OS Platforms for
Notes Driver

Windows NT

Windows 2000

Windows 2003

Windows XP

SUSE® Linux

Red Hat Linux

Solaris 8

Solaris 9

AIX 5.2

Driver Components

Preconfiguration file: Notes.xml

Installed on iManager server

NotesDriverShim.jar & CommonDriverShim.jar

Win32: Installed to \NDS\LIB folder

Linux, Solaris, or AIX: Installed to /usr/lib/nds-modules/lib folder

eDir Server

Or on Domino Server with Remote Loader

NDSREP

Win32: Installed to \NDS folder

Copy to the \lotus\domino folder on the target Domino Server

Linux, Solaris, or AIX: Installed to /usr/lib/dirxml/rules/notes folder

Symbolically linked to the Domino server executable folder

Utilities

Notes Association Tool

Run from Install media

movecfg.exe

For migrating ndsrep configuration data from the Win32 registry (v1.x) to the Notes Driver Configuration in eDir (v2.x).

Domino Directory or
Standard Notes Database

Domino Directory (Notes Address Book, names.nsf)

Special case of Notes Database

Contains Lotus Notes Users

Each note carries a Type attribute

Supports Domino LDAP Server

Standard Notes Database (*.nsf)

No table definition

Notes Templates suggest, but do not restrict, note data

A Notes document (= db record) may contain whatever items are needed

A note maps to an eDir object

Document items are mapped to eDir attributes on object

Configuring the Driver

Configured using iManager Driver Import of Notes.xml

Domino Directory vs. Standard Notes db

Notes.xml: Driver Import heavily ‘leans’ toward Domino Directory (Notes Address Book: names.nsf)

Support for Deny-Access Group

Driver maps eDir ‘disabled’ attribute to membership in Notes Deny-Access group

The driver import prompts for the UNID of a Deny-Access Group

Use the Notes Client or the NotesIDTool.exe from \Util dir on CD

Certification and mailfile support

Can be turned on or off

Default paths for ID files and mailfiles specified

Object Placement paths

All driver parameters and behaviors can be controlled via policies (DirXML Script or XSL Stylesheets)

Configuring NDSREP

NDSREP Configuration persisted in dsrepcfg.nsf

All NDSREP parameters are transparently configured with the driver configuration parameters and automatically copied into dsrepcfg.nsf

Tell Commands

Change configuration settings

Issue Commands

Tell notesdriver showconfig

Tell notesdriver replicate

Tell notesdriver quit

Configuring Multiple Instances of NDSREP

Additional configuration instances can be stored in dsrepcfg.nsf

Instances are differentiated by their driver name.

In rare circumstances where two instances have the same name, driver configuration parameters can be utilized to avoid “collision” of instance names.

Notes Driver User Rights

To access and modify the synchronized Notes database, a Notes driver user must be created and given access to the synchronized Notes database.

When synchronizing the Notes Address Book (names.nsf), it is recommended that the Notes driver user be given manager rights to the database.

Also to register Users in the Notes Address Book, a Certification Log (certlog.nsf) must exist and the Notes driver user must have at least Author and 'Create documents' access to the Certification Log.

Notes Driver User Rights (continued)

Notes Driver Users on Linux, Solaris, and AIX:

cannot be logged-in to the OS as root

must have access to the /local/notesdata folder

to read and write to the synchonized database (names.nsf) and dsrepcfg.nsf

must have access to execute Lotus Notes APIs and shared libraries

/opt/lotus/notes/latest/<os_platform>

/opt/lotus/bin

recommended that the Notes driver user be logged into the OS using the same user account as the Domino server

Lotus Notes Driver Architecture Overview

Driver Installation and Configuration

Advanced Configuration Parameters

Lotus Notes Driver Enhancements

Session Road Map

Advanced Configuration Parameters

Advanced configuration parameters (also called override or custom parameters) can be utilized within policy to 'tell' the driver shim to:

override driver defaults

override existing driver parameters

perform specific tasks

access named passwords

apply settings, flags, or attributes to data

Over 100 custom parameters exist for the Notes Driver Shim

Custom Parameters

Certify-user	create-mail	mailfile-template

mail-file-inherit-flag	cert-id	drv-param-cert-id

cert-pwd	drv-param-cert-pwd	named-cert-pwd

user-id-file	user-id-path	minimum-pwd-len

user-pwd	extended-ou	mailfile-acl-level

mail-file-quota	mail-quota-warning-threshold	mail-file-action

update-addressbook	store-useridfile-in-ab	notes-policy-name

expire-term	expire-date	cert-id-type

adminp-server	allow-adminp-support	tell-adminp-process

notes-password-change-interval	notes-password-check-setting	immediate

notes-password-force-change	notes-password-grace-period	sync-internet-password

recertify-user	roaming-user	roaming-server

roaming-subdir	roaming-cleanup-setting	HTTPPassword

AltFullName	AltFullNameLanguage	InternetAddress

MailServer	MailFile	MailDomain

Advanced Configuration

Common customized behaviors

Policies (DirXML Script or XSL stylesheets) can transform documents to specify driver behavior

Selecting certifiers

Use named passwords feature to store certifier passwords

Selecting Mail Servers

Controlling Notes mailfile creation

Location

Name

ACL Level

Quota

Controlling Notes ID File Creation

Name

Location

Re-certifying a User

Lotus Notes Driver Architecture Overview

Driver Installation and Configuration

Advanced Configuration Parameters

Lotus Notes Driver Enhancements

Session Road Map

Advanced Configuration Enhancements

Add User Enhancemnts

Roaming Users

Roaming server

Roaming folder/directory

Roaming clean-up settings

Apply client password settings

notespasswordchecksetting: PWD_CHK_CHECKPASSWORD: requires the user to enter a password when authenticating with servers that have password checking enabled PWD_CHK_DONTCHECKPASSWORD: does not require the user to enter a password when authenticating with other servers (default) PWD_CHK_LOCKOUT: prevents the user from accessing servers that have password checking enabled

notespasswordchangeinterval: Required change interval - number of days at which the user must supply a new password. Defaults to zero.

notespasswordgraceperiod: Grace period (in days) for changing the password. Defaults to zero.

Internetpasswordforcechange: true to force the user to change the password on next login; false to not force the user to change the password (default).

Advanced Configuration Enhancements (continued)

Administration Process (AdminP) Support

Recertify User

Rename Notes User

Rename Web User

Rename Group

Move User

Move Roaming User

Delete User

Delete Group

Send Domino console commands

ACL settings on mailfiles

ACL settings on synchronized database (names.nsf)

Notes field flag settings

Notes Database ACLs

The Notes Driver v2.1.1 (or higher) has the capability to add or modify ACL entries on the ACL record of a Lotus Notes database (.nsf) that is being synchronized (subscriber channel only).

Likewise, the ACL of a new mailfile that is created by the NotesDriverShim for a user can be modified with specified ACL settings at creation time.

Setting Notes ACLs: Policy

Setting Notes ACLs:
XML Command Document Fragment

<input>

<add	acl-entry-can-create-documents="true" acl-entry-can-delete-documents="true"

acl-entry-enable-role="[[ALL]]" acl-entry-level="MANAGER"

acl-entry-public-reader="true" acl-entry-public-writer="true"

acl-entry-user-type="PERSON" class-name="Person"

dest-dn="CN=DaffyDuck/OU=sales/O=novell"

drv-param-cert-id="sales-cert-id-file"

drv-param-cert-pwd="sales-cert-id-password"

event-id="MYSERVER-NDS#20040920214955#1#1"

qualified-src-dn="O=DirXML\OU=Notes\OU=Users\OU=sales\CN=DaffyDuck"

src-dn="\mytree\DirXML\Notes\Users\sales\DaffyDuck"

src-entry-id="39862">

<add-attr attr-name="LastName"><value type="string">Duck</value></add-attr>

<add-attr attr-name="FirstName"><value type="string">Daffy</value></add-attr>

</add>

</input>

Notes Field Flags

The Notes Driver v2.1.1 has the capability to set Notes field flags on documents in a Lotus Notes database (.nsf) that is being syncrhonized (subscriber channel only).

The following Notes field flags can be set:

read-access

read/write-access

names

protected

summary

driver-attr-flag Notes Field Flag

Attribute Parameters – Field Flags

authors-flag names-flag protected-flag readers-flag summary-flag

READ/WRITE-ACCESS NAMES

PROTECTED

READ-ACCESS

SUMMARY

Setting Notes Field Flags: Policy

Setting Notes Field Flags:
XML Command Document Fragment

<input>

<add class-name="Person" dest-dn="CN=DaffyDuck/OU=eng/O=novell" event-id="MYSERVER-NDS#20040915163542#1#1" qualified-src-dn="O=DirXML\OU=Users\OU=eng\CN=DaffyDuck" src-dn="\mytree\DirXML\Users\eng\DaffyDuck" src-entry-id="39853">

<add-attr attr-name="LastName"> <value type="string">Duck</value> </add-attr>

<add-attr attr-name="FirstName"> <value type="string">Daffy</value> </add-attr>

<add-attr attr-name="ShoeSize" protected-flag="true" summary-flag="true"> <value type="string">9.5</value> </add-attr>

</add>

</input>

Domino Administration Process (AdminP)

Domino/Notes R6.0.3 or higher must be available for Notes Driver AdminP features to be utilized by the Driver Shim.

The <allow-adminp-support> driver configuration parameter must be set to “true” for AdminP methods to be called.

The <allow-adminp-support> driver configuration parameter can be overridden on a command by command basis.

Notes Driver Usage of AdminP

When does the Notes Driver Shim use AdminP methods?

Recertify User

Rename User

Certified User

Web User

Rename Group

Move User

Certified User

Roaming User

Delete User

Delete Group

Notes Password Settings

AdminP Requests

AdminP requests

typically initiated and managed from the Domino Administrator client.

are stored in the Domino server's admin4.nsf database.

processed by the Domino server.

Each AdminP method called by the Notes Driver Shim generates one or more AdminP requests.

For the Notes Driver Shim, all AdminP requests are accessed and processed according to Notes Object Name (Full Name).

AdminP Requests (continued)

The Domino server processes each request on a regular interval scheduled in the Domino server's configuration.

Each time the Notes Driver Shim utilizes an AdminP method to create a request, it can also 'kick' into action the Domino server's Administration Process if the 'tell-adminp-process' parameter is included as an attribute to the <add> <modify> <delete> or <move> element in the XML command document.

tell-adminp-process=”tell adminp process all”

tell-adminp-process=”tell adminp process new”

tell-adminp-process=”tell adminp process people”

Note: The Notes driver user must have console rights to the Domino server console or the “tell adminp” command will be rejected.

AdminP Rename

An AdminP User rename request can be generated by the Notes Driver Shim when:

<allow-adminp-support> is set to true.

and ANY of the following exist in the XML command document:

Modify First Name

Modify Last Name

Modify Middle Initial

The Notes Driver Shim will interpret this as a User Rename request within Notes, and attempt to create an AdminP rename request using the 'specified' certifier and password in the XML command document.

AdminP Rename Rule (Part 1)

AdminP Rename Rule (Part 2)

AdminP Rename: XML Command Document Fragment

<input>

<modify class-name="Person" allow-adminp-support=”true” drv-param-cert-id="eng-cert-id-file" drv-param-cert-pwd="eng-cert-id-password" event-id="MYSERVER-NDS#20050208200913#1#1" qualified-src-dn="O=DirXML\OU=Notes\OU=Users\OU=eng\CN=DDuck" src-dn="\mytree\DirXML\Notes\Users\eng\DDuck" src-entry-id="40379" tell-adminp-process="tell adminp process all" timestamp="1107893353#1">

<association state="associated"> 94F4ADDB36333A4287256FA2006E8CC9 </association>

<modify-attr attr-name="MiddleInitial">

<add-value><value type="string">D</value></add-value>

</modify-attr>

</modify>

</input>

Sending Domino Console Commands

The Notes Driver Shim (v2.1 or later) running on Domino R6.0.3 (or later) has the capability of processing special commands and sending them to the Domino server console.

The Notes Driver Shim uses the same API methods to send Domino console commands as the “tell adminp process” commands previously discussed.

Driver policy can be created to send commands to the Domino Console, and process the returned results.

Any text string can be sent ('show server', 'show directory') and result strings are truncated at 32000 characters.

Many Domino console commands accept the “-xml” parameter which facilitates the policy processing of the returned result string.

Domino Console Command:
XML Command Document

<nds dtdversion="1.0" ndsversion="8.5" xmlns:notes="http://www.novell.com/dirxml/notesdriver">

<input>

<notes:domino-console-command> show directory mail/DaisyDuck.nsf -xml </notes:domino-console-command>

</input>

</nds>

Domino Console Response:
XML Return Document Fragment (One File Found)

<?xml version="1.0" encoding="UTF-8" ?> <files>

<filedata notesversion="6" odsversion="43" logged="disabled" id="87256FA4:00681466" link="1" dboptions="0,4849664,0,0">

<path>C:\Lotus65\Domino\Data\mail\DaisyDuck.nsf</path> <name>DaisyDuck.nsf</name> <title>Daisy Duck</title> <template></template> <inheritedtemplate>StdR6Mail</inheritedtemplate> <category></category> <size current="13631488" max="0" usage="12977152"/> <quota limit="0" warning="0" /> <created>20050210T115649,66-07</created> <lastfixup>20050211T051042,85-07</lastfixup>

</filedata>

<filecount>1</filecount>

</files>

Domino Console Response:
XML Return Document (Zero Files Found)

<nds dtdversion="2.0" ndsversion="8.x" xmlns:notes="http://www.novell.com/dirxml/notesdriver">

<source> <product build="20050127_1619 " instance="notesdriver" version="2.1.1">DirXML Driver for Lotus Notes</product> <contact>Novell, Inc.</contact> </source>

<output> <notes:domino-console-response event-id="0"> <files> <filecount>0</filecount> </files> </notes:domino-console-response> <status event-id="0" level="success"/> </output>

</nds>

Question & Answer

Appendix:
Additional Technical Notes

Policy Processing Order Subscriber

Convert

Event

to

XML

Event

Transformation

Schema

Mapping

Output

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Subscriber Add Processor

Subscriber

Filter

Event

Cache

NO

YES

The DirXML Engine

Command

Transformation

Does an

association

exist?

Policy Processing Order Publisher

Convert

Event

to

eDirectory

Command

Transformation

Schema

Mapping

Input

Transformation

Matching

Rule

Create

Rule

Placement

Rule

Publisher Add Processor

NO

YES

The DirXML Engine

Event

Transformation

Does an

association

exist?

Publisher

Filter

Building Associations Subscriber

One

Write

association

Apply

matching

rule:

Query

App

Merge

attributes

Mark

association

pending

Apply

placement

rule

Zero

NO

YES

Create

App Object

Modify

App object

Multiple

YES

NO

Desired

eDirectory

event

occurs

Apply

create

rule

Query

eDirectory

Modify

App Object

Modify

eDirectory

object

Does this object have an association?

Number of

matches

Error

Do we

have all required

attributes?

One

Write

association

Apply

matching

rule:

Query

eDirectory

Merge

attributes

Apply

placement

rule

Zero

NO

YES

Create

eDirectory

Object

Modify

eDirectory

object

Multiple

YES

NO

Desired

eDirectory

event

occurs

Apply

create

rule

Modify

App Object

Modify

eDirectory

object

Does this object have an association?

Number of

matches

Do we

have all required

attributes?

Query

eDirectory

Query App

Query

App

Building Associations Publisher

Error

2003-12-08T12:43:39