Home
IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
Planning
Use this topic as an overview of planning task.
Planning directory services
IBM® Domino® provides a range of directory service features.
Planning directory services in a multiple-directory environment
IBM® Domino® provides directory catalogs and directory assistance to help companies operate in environments with secondary directories.
Directory search order
The order in which IBM® Notes® and IBM Domino® search directories depends on the nature of the search and the configuration of the directory.
Directory search order for Internet client authentication
If there more than one directory with a trusted naming rule that matches the user name, the server searches the directory with the most specific matching rule first. If directories have identical trusted naming rules that match the Internet user name, search orders assigned to the directories determine the order in which the server searches them.

IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
- What's new in IBM® Domino® 10?
  Learn about all of the new features for administrators in IBM® Domino® 10.
- Overview
  Welcome to IBM® Domino® Administrator Help.
- Installing
  Use this documentation to install the IBM® Domino® server and subsequently deploy the IBM Notes® client.
- Planning
  Use this topic as an overview of planning task.
  - Roadmap for deploying Domino® servers
    Use this as a tool when planning how to integrate IBM® Domino® into your existing environment.
  - Planning server-to-server connections
    Servers must connect to each other to exchange data, for example to replicate databases and exchange mail. You can create connections between servers across a local area network (LAN) or wide area network (WAN), by using a pass-through server (a server that acts as an intermediary server between a client and its destination), or over the Internet. Create a Server Connection document whenever you need to establish any new or additional server connections. You can modify this document when necessary.
  - Planning directory services
    IBM® Domino® provides a range of directory service features.
    - Using directory servers in a Domino® domain
      An IBM® Domino® domain is a network of clients and servers whose users, servers, connections, and access control information is described in a single database called the Domino Directory. When you set up the first server in an organization, Domino creates a Domino domain and a Domino Directory for the domain. When you add servers to the domain they pull replicas of the Domino Directory. To create an additional domain and Domino Directory, you perform a first server setup.
    - Using a central directory architecture in a Domino® domain
      A central directory architecture is an optional directory architecture you can implement in an IBM® Domino® domain. This architecture differs from the traditional distributed directory architecture in which every server in a domain has a full replica of the primary Domino Directory.
    - Planning LDAP features
      Lightweight Directory Access Protocol (LDAP) is a standard Internet protocol for searching and managing entries in a directory.
    - Planning directory access control
      Use the database ACL to control the general access that users and IBM® Domino® servers have to the Domino Directory. Optionally, use an extended ACL to refine the general database ACL and further restrict access to specific portions of the directory. An extended ACL is available for only a Domino Directory and an extended directory catalog.
    - Planning new entries in the Domino® Directory
      The tools you can use to add entries to the IBM® Domino® Directory are the IBM Notes® user registration program, migration tools that are integrated with the Notes user registration program, Domino directory synchronization tools, and third-party LDAP applications. You can also add an entry manually, for example you typically add a group entry manually. You might also develop a custom Notes application to add entries.
    - Planning the management of entries in the Domino® Directory
      You can use the IBM® Domino® Administrator, the Web Administrator, directory synchronization tools, and third-party LDAP applications to manage entries in the Domino Directory.
    - Planning directory services for Notes® clients
      There are a variety of directory services features available to IBM® Notes® clients.
    - Planning directory services in a multiple-directory environment
      IBM® Domino® provides directory catalogs and directory assistance to help companies operate in environments with secondary directories.
      - Planning directory catalogs
        A directory catalog is an optional directory database that can aggregate entries from multiple IBM® Domino® directories into a single database. A directory catalog provides enterprise-wide directory access via a single database.
      - Planning directory assistance
        Servers use directory assistance to look up information in a secondary directory -- a secondaryIBM® Domino® Directory, an extended directory catalog, or a remote LDAP directory.
      - Comparison of directory catalogs and directory assistance
        Using a condensed directory catalog on a server is no longer supported.
      - Directory search order
        The order in which IBM® Notes® and IBM Domino® search directories depends on the nature of the search and the configuration of the directory.
        Directory search order for Internet client authentication
        If there more than one directory with a trusted naming rule that matches the user name, the server searches the directory with the most specific matching rule first. If directories have identical trusted naming rules that match the Internet user name, search orders assigned to the directories determine the order in which the server searches them.
        Directory search order for group names in database ACLs
        When a Internet or IBM® Notes® user attempts to access a database on a server and the database ACL includes a group name, the server searches directories in this order to locate the group to determine if the user is a member of it:
        Directory search order for LDAP searches
        If an LDAP user does not specify a search base, the LDAP service does not return a referral. If an LDAP user specifies a search base, the server picks an LDAP directory enabled for LDAP users with a naming rule that matches the specified search base. If there is no such directory, the server doesn't return a referral. If there is more than one such directory, the server picks the one with the most specific matching rule before picking one with a less-specific rule. If directories have identical naming rules that match the search base specified by the user, search orders assigned to these directories determine the order in which the LDAP service picks them for referrals.
        Directory search order for a name in a Notes® address field
        When an IBM® Notes® user enters a user or group name in a Notes mail address field, the Notes client and mail server search directories in the following order to retrieve the address for the name.
      - Distinguished name syntax in multiple-directory environments
        For a multiple directory environment that include entries that reside in both IBM® Domino® and LDAP directories, it's important to understand in what contexts to use an IBM Notes® distinguished name and in what contexts to use an LDAP D distinguished nameN (defined in RFC 2253).
    - Planning internationalized directory services
      Options are provided for internationalized directory services.
    - Planning directory customization
      You can add forms and views to the IBM® Domino® Directory to accommodate specific needs of your company. If you use the LDAP service, you can also use the Domino LDAP Schema database (schema.nsf) to define new object classes and attributes to be added to the directory.
    - Directory services terms
      This topic is an overview of Domino terminology around directory services.
  - Planning a mail routing topology
    IBM® Domino® offers you considerable flexibility in configuring your mail system infrastructure, allowing you to use IBM Notes® routing, SMTP routing, or both, for internal and external messages.
  - Planning a cluster
    When planning a cluster, it is important to consider the performance and ability of your hardware. The cluster must have enough CPU power, memory, and disk space to handle the cluster traffic and the number of databases and replicas required.
  - Planning the TCP/IP network
    The default TCP/IP configuration for an IBM® Domino® server is one IP address that is globally bound, meaning that the server listens for connections at the IP addresses of all NICs on the computer. Global binding works as long as the computer does not have more than one IP address offering a service over the same assigned TCP port.
  - Planning the NetBIOS network
    The IBM® Domino® network is compatible with NetBIOS, a set of IBM session-layer LAN services that has evolved into a standard interface that applications use to access transport-layer network protocols.
  - Messaging overview
    The IBM® Domino® mail system has three basic components: Domino mail servers, Domino mail files, and mail clients. The Domino mail server is the backbone of an organization's messaging infrastructure, acting both as an Internet mail server and an IBM Notes® mail server. Domino provides standards-based Internet messaging through its support of the Simple Mail Transfer Protocol (SMTP), Post Office Protocol version 3 (POP3), Internet Message Access Protocol (IMAP), and Multipurpose Internet Mail Extensions (MIME). At the same time, Domino supports Notes mail through the use of Notes routing protocols -- Notes remote procedure calls (NRPC) -- and the Notes rich text message format.
  - Planning your Notes® client deployment
    Use the references listed here to plan for, install, upgrade to, and configure the IBM® Notes® client.
  - Planning security
    An important aspect of planning security for your Domino® environment is understanding the tasks and features involved with securing each type of resource.
- Configuring
  Use this information to configure an IBM® Domino® network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters. Also use this information to set up IBM iNotes® on a server using Domino Off-Line Services (DOLS).
- Securing
  This section describes IBM® Domino® security features, including execution control lists, IDs, and SSL.
- Administering
  This documentation provides information about the administration tools for managing and monitoring IBM Domino® servers and databases.
- Tuning
  Use this information to improve IBM® Domino® server, Domino Web server, and messaging performance through the use of resource balancing and activity trends, Server.Load commands, advanced database properties, cluster statistics, and the Server Health Monitor.
- Troubleshooting
  This section describes how to find and solve problems with IBM® Domino® server and Administrator client.
- Glossary

Directory search order for Internet client authentication

If there more than one directory with a trusted naming rule that matches the user name, the server searches the directory with the most specific matching rule first. If directories have identical trusted naming rules that match the Internet user name, search orders assigned to the directories determine the order in which the server searches them.

About this task

To authenticate an Internet client connecting to an IBM® Domino® server, the server searches directories for the user name and credentials in the following order:

The server's primary Domino® Directory
All directories defined in the server's directory assistance database that a) have a naming rule that is trusted for authentication and that matches the logon name of the Internet user and b) have the directory assistance option Make this domain available to: Notes clients and Internet Authentication/Authorization enabled