Home
IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
Configuring
Use this information to configure an IBM® Domino® network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters. Also use this information to set up IBM iNotes® on a server using Domino Off-Line Services (DOLS).
Configuring directory services
This section describes how to plan, set up, and use IBM® Domino® directory services.
Extended ACL
An extended access control list (ACL) is an optional directory access-control feature available for a directory created from the PUBNAMES.NTF template -- a Domino® Directory or an extended directory catalog. An extended ACL is tied to the database ACL, and you access it through the Access Control List dialog box using a Notes® or Domino Administrator client.
Setting up and managing an extended ACL
Use these tasks to set up and manage an extended ACL.
Showing a subject's effective access to an extended ACL target
You can determine the effective access a subject has to a target in an extended ACL. The effective access is the actual access a subject has to a target after the database ACL and extended ACL access settings and conflicts are evaluated.

IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
- What's new in IBM® Domino® 10?
  Learn about all of the new features for administrators in IBM® Domino® 10.
- Overview
  Welcome to IBM® Domino® Administrator Help.
- Installing
  Use this documentation to install the IBM® Domino® server and subsequently deploy the IBM Notes® client.
- Planning
  Use this topic as an overview of planning task.
- Configuring
  Use this information to configure an IBM® Domino® network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters. Also use this information to set up IBM iNotes® on a server using Domino Off-Line Services (DOLS).
  - Configuring a network
    This section presents the planning concepts and setup procedures necessary for a successful IBM® Domino® deployment over a network. It provides information on network protocols from a Domino perspective but does not attempt to provide general network information.
  - Configuring users and servers
    Topics in this section describe how to set up users and servers.
  - Editing the NOTES.INI file
    You should rarely, if ever, need to modify a server's or client's NOTES.INI file. The NOTES.INI file contains many settings that Domino® and Notes® rely on to work properly. An accidental or incorrect change may cause Domino or Notes to run unpredictably. Therefore, you should edit the NOTES.INI file only if special circumstances occur or if IBM® Support Services recommends that you do so.
  - Configuring directory services
    This section describes how to plan, set up, and use IBM® Domino® directory services.
    - The Domino® Directory
      The Domino® Directory, which some previous releases referred to as the Public Address Book or Name and Address Book, is a database that Domino creates automatically on every server. The Domino Directory is a directory of information about users, servers, and groups, as well as custom entries you may add. Registering users and servers in a domain automatically creates corresponding Person documents and Server documents in the Domino Directory for the domain. These documents contain detailed information about each user and server.
    - The LDAP service
      Lightweight Directory Access Protocol (LDAP) is a standard Internet protocol for searching and managing entries in a directory, where an entry has one or more attributes associated with a distinguished name. A distinguished name -- for example, cn=Phyllis Spera,ou=Sales,ou=East,o=Renovations -- is a name that identifies an entry within a directory tree.
    - LDAP schema
      A directory entry contains information about a particular entity, or object -- for example, a person or a group -- and is associated with a distinguished name. An LDAP schema is a set of rules that define what can be stored as entries in an LDAP directory. Each LDAP directory has a default schema, which organizations can customize, or "extend," by adding elements to it. The elements of a schema are attributes, syntaxes, and object classes. LDAP directory servers provide the ability to enforce the schema to ensure that directory changes made using LDAP operations conform to it.
    - ldapsearch utility
      Domino® and Notes® provide a command-line search utility, LDAPSEARCH.EXE, that you use to search entries in any LDAP directory. The ldapsearch utility connects to a directory server and returns results that match search criteria you specify. It is available on Domino server and Notes client platforms.
    - Directory assistance
      Directory assistance allows a server to look up information in a directory other than a local primary Domino® Directory (NAMES.NSF).
    - Directory catalogs
      A directory catalog is an optional directory database that typically contains information aggregated from multiple Domino® directories. Clients and servers can use a directory catalog to look up mail addresses and other information about the people, groups, mail-in databases, and resources throughout an organization, regardless of the number of Domino domains and Domino Directories the organization uses.
    - Extended ACL
      An extended access control list (ACL) is an optional directory access-control feature available for a directory created from the PUBNAMES.NTF template -- a Domino® Directory or an extended directory catalog. An extended ACL is tied to the database ACL, and you access it through the Access Control List dialog box using a Notes® or Domino Administrator client.
      - How other database security features restrict extended ACL access settings
        The access set for a user in an extended ACL can never exceed the access the database ACL, including the database ACL privileges and roles, allows the user. For example, if the database ACL allows a user only Reader access, you cannot use the extended ACL to allow Write access. Or if a user is omitted from the database ACL User Creator role, you can't use the extended ACL to allow the user Create access to Person documents.
      - Elements of an extended ACL
        To set up an extended ACL, you use the Extended Access at target dialog box, which you open from the database Access Control List dialog box.
      - Extended ACL access settings
        There are several access settings you use to control a subject's access to an extended ACL target. For each access setting you choose Allow or Deny. You can leave an access setting unchecked, but if you do, other subjects in the extended ACL or database ACL determine whether the subject is allowed or denied the access. It's better to select Allow or Deny to help ensure you get the access control results you expect.
      - Extended ACL subject
        An extended ACL subject is a name for which you are setting access to a selected extended ACL target. To add a subject to an extended ACL, you select the target and then click Add in the "Extended Access at target" dialog box.
      - Extended ACL target
        You select a target to specify either a category of documents or a specific document to which you are controlling a subject's access. Selecting a category of documents as a target is recommended because you can set access to multiple documents at once and because the access applies to documents added to the category in the future.
      - Extended ACL examples
        Review the topics in the related information for examples of how to use extended ACLs.
      - Extended ACL guidelines
        Plan an extended ACL on paper before you implement it. After you have planned the extended ACL on paper, test it in a nonproduction environment before deploying it.
      - Setting up and managing an extended ACL
        Use these tasks to set up and manage an extended ACL.
        Enabling extended access
        To set up an extended ACL for a Domino® Directory or Extended Directory Catalog, you must enable extended access for the database.
        Setting a subject's access to an extended ACL target
        You can set a subject's access to an extended ACL target in a Domino® Directory or an extended directory catalog.
        Setting a subject's form-specific access to an extended ACL target
        When you set a subject's access to an extended ACL target, you can use this optional procedure to make exceptions to the subject's default access to the selected target and set access differently to documents created from a specific form.
        Showing a subject's effective access to an extended ACL target
        You can determine the effective access a subject has to a target in an extended ACL. The effective access is the actual access a subject has to a target after the database ACL and extended ACL access settings and conflicts are evaluated.
        Modifying or removing a subject's access settings at an extended ACL target
        You can modify a subject's access to an extended ACL target. You can also remove a subject from a target to remove the subject's access settings for the target.
        Using the history log to monitor changes to an extended ACL
        You can display a log of all changes made to an extended ACL and to the database ACL. Each entry in the list shows when the change occurred, who made the change, and what changed.
        Disabling extended access
        Disabling extended access takes effect immediately and irreversibly removes any extended ACL restrictions that have been set and so will alter security checking for the database
    - Setting up Domino® Active Directory synchronization
      When the Domino® server is installed on a Microsoft™ Windows™ 2003 server, as an administrator, you typically need to maintain two separate directories for the same set of people and groups. Maintaining user and group information involves adding entries to both directories, deleting entries, ensuring that passwords are the same when users use Notes® Single Logon, coordinating group membership in both directories, and ensuring that user or group settings, such as email addresses and telephone numbers, are identical.
  - Configuring messaging
    This section provides an overview of messaging and describes how to set up mail routing, how to set up and customize mail servers, and how to track mail.
  - Configuring iNotes®
    IBM® iNotes® (previously IBM Domino® Web Access) provides IBM Notes® users with browser-based access to Notes mail and to Notes calendar and scheduling features. Administrators specify mail policy and security policy settings as well as notes.ini file settings to complete the full implementation of IBM iNotes.
  - Configuring Web servers
    This section describes how to set up the IBM® Domino® Web server, the Domino Web Navigator, and other Web servers such as IBM HTTP.
  - Setting up a cluster
    Setting up a cluster includes the tasks of creating and verifying that it is working correctly, and then setting up user access, mail, replications, size quotas, directory assistance, roaming, web navigation, and use of a private LAN in the cluster.
- Securing
  This section describes IBM® Domino® security features, including execution control lists, IDs, and SSL.
- Administering
  This documentation provides information about the administration tools for managing and monitoring IBM Domino® servers and databases.
- Tuning
  Use this information to improve IBM® Domino® server, Domino Web server, and messaging performance through the use of resource balancing and activity trends, Server.Load commands, advanced database properties, cluster statistics, and the Server Health Monitor.
- Troubleshooting
  This section describes how to find and solve problems with IBM® Domino® server and Administrator client.
- Glossary

Showing a subject's effective access to an extended ACL target

You can determine the effective access a subject has to a target in an extended ACL. The effective access is the actual access a subject has to a target after the database ACL and extended ACL access settings and conflicts are evaluated.

Open the database that uses the extended ACL, and choose File > Application > Access Control.
With Basics selected, click Extended Access. You see Extended Access only if you have enabled extended access.
In the Target box, expand the target categories as necessary and select the target for which you want to determine a subject's access.
Click Effective Access to open the Effective Access at target dialog box.
In the People, Servers, Groups field, type or select the subject whose effective access you want to determine. If the subject you cannot be found in the directory, this prompt appears:
```
Name type cannot be determined. Is this a group?
```
Click Yes if the name is a group, or No if the name is not a group.
Note: You cannot determine the effective access for the subject Self.
Click Calculate Access.
The Default Access section shows the subject's default access to the selected target.
View the Modified Forms section to see any forms for which the subject's access is different than the default access for the selected target:
1. Select a form to see the access set for the form.
2. View the Browse, Create, and Delete access set for the selected form.
3. View the field access set for the selected form. -Default- shows the default field access for the select form. If there are individual fields listed, select a field to see how its access is different than the default field access.
The Database Access section shows the access the database ACL grants the subject.
The Access derived from box shows all the subjects that can control the subject's access allowed in the database ACL and the extended ACL and displays a check mark next to the subject or subjects that determine the access.
When you are finished viewing the effective access, click Done.