Home
Configuring
Use this information to configure your network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters.
Configuring users and servers
Topics in this section describe how to set up users and servers.
Configuring directory services
This section describes how to plan, set up, and use HCL Domino® directory services.
LDAP schema
A directory entry contains information about a particular entity, or object -- for example, a person or a group -- and is associated with a distinguished name. An LDAP schema is a set of rules that define what can be stored as entries in an LDAP directory. Each LDAP directory has a default schema, which organizations can customize, or "extend," by adding elements to it. The elements of a schema are attributes, syntaxes, and object classes. LDAP directory servers provide the ability to enforce the schema to ensure that directory changes made using LDAP operations conform to it.
The Domino® LDAP schema
The default Domino® LDAP schema includes both Domino-specific and LDAP-standard elements.
dominoAccessGroups operational attribute
The dominoAccessGroups operational attribute returns the LDAP DNs that represent the security (ACL) groups to which the object belongs.

Configuring
Use this information to configure your network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters.
- Configuring a network
  This section presents the planning concepts and setup procedures necessary for a successful HCL Domino® deployment over a network. It provides information on network protocols from a Domino perspective but does not attempt to provide general network information.
- Configuring users and servers
  Topics in this section describe how to set up users and servers.
  - Understanding the Server document
    The Server document is set up when you register a server. It contains many of the settings that define how your server operates.
  - Policies
    Use Domino® policy settings to control how users work with Notes®. A policy is a document that identifies a collection of individual policy settings. Policy settings documents define a set of defaults that apply to the users and groups to which the policy is assigned. You can change policy settings and they will be automatically applied to the assigned users and groups.
  - Defining default settings for Notes® user registration
    Before you register new Notes® users, you can specify default settings that apply to all users. Default settings simplify user registration and ensure user settings consistency. You can define many default settings, such as what mail server users have or what certifier ID to use for user registration. You can also specify a default workstation execution control list (ECL) to protect data from unauthorized workstation access.
  - Using groups
    Groups are lists of users, groups, and servers that have common traits. They are useful for mailing lists and access control lists. Using groups can simplify administration tasks.
  - Replicas
    You can make a database available to users in different locations, on different networks, or in different time zones, by creating replicas of the database.
  - Calendars and scheduling
    The calendar and scheduling features allow users to check the free time of other users, schedule meetings with them, and reserve resources, such as conference rooms and equipment.
  - Editing the notes.ini file
    The Domino and Notes notes.ini files contain the settings required for the server and client to operate correctly. If you modify or add settings in a notes.ini file, do so cautiously and never edit the file directly with a text editor.
  - Configuring directory services
    This section describes how to plan, set up, and use HCL Domino® directory services.
    - The Domino® Directory
      The Domino® Directory, which some previous releases referred to as the Public Address Book or Name and Address Book, is a database that Domino creates automatically on every server. The Domino Directory is a directory of information about users, servers, and groups, as well as custom entries you may add. Registering users and servers in a domain automatically creates corresponding Person documents and Server documents in the Domino Directory for the domain. These documents contain detailed information about each user and server.
    - The LDAP service
      Lightweight Directory Access Protocol (LDAP) is a standard Internet protocol for searching and managing entries in a directory, where an entry has one or more attributes associated with a distinguished name. A distinguished name -- for example, cn=Phyllis Spera,ou=Sales,ou=East,o=Renovations -- is a name that identifies an entry within a directory tree.
    - LDAP schema
      A directory entry contains information about a particular entity, or object -- for example, a person or a group -- and is associated with a distinguished name. An LDAP schema is a set of rules that define what can be stored as entries in an LDAP directory. Each LDAP directory has a default schema, which organizations can customize, or "extend," by adding elements to it. The elements of a schema are attributes, syntaxes, and object classes. LDAP directory servers provide the ability to enforce the schema to ensure that directory changes made using LDAP operations conform to it.
      - The Domino® LDAP schema
        The default Domino® LDAP schema includes both Domino-specific and LDAP-standard elements.
        Object class hierarchy for dominoPerson object class
        The dominoPerson object class, which maps to the Person form in the Domino® Directory, is part of this object class hierarchy:
        Object class hierarchy for dominoGroup object class
        The dominoGroup object class, which maps to the Group form in the Domino® Directory, is part of this object class hierarchy:
        dominoUNID operational attribute
        The Domino® LDAP service supports Universal Notes® IDs (UNID) through 32-character values of the dominoUNID operational attribute. Designed for use with advanced LDAP applications, it allows them to uniquely identify documents in the Domino Directory even when the directory object's FullName/ListName (LDAP DN), ShortName (LDAP uid), or other normally identifying field values change.
        dominoAccessGroups operational attribute
        The dominoAccessGroups operational attribute returns the LDAP DNs that represent the security (ACL) groups to which the object belongs.
        displayName operational attribute
        The attribute displayName, from the inetOrgPerson schema, has been implemented in the Domino® LDAP server to improve performance of name resolution queries from external LDAP servers.
      - The schema daemon
        When the LDAP service runs on a server, it spawns a schema daemon that runs at regular intervals. The schema daemon running on the administration server for the Domino® Directory implements schema changes and propagates the changes to other (subordinate) servers in the domain that run the LDAP service. The schema daemon running on each subordinate server updates its LDAP service with the schema changes propagated from the administration server. The Domino LDAP Schema database (SCHEMA.NSF) is the vehicle for propagating the schema changes.
      - Domino® LDAP Schema database
        The schema daemon spawned by the LDAP service running on the administration server for the Domino® Directory creates the Domino LDAP Schema database (SCHEMA.NSF). Subordinate servers within the domain that run the LDAP service automatically get a replica of this database. The Schema database is the vehicle used to propagate schema changes to all the servers in the domain that run the LDAP service.
      - Methods for extending the schema
        Extending the schema refers to adding elements to the schema, usually object classes and attributes. The default schema comes with many object classes and attributes that are ready to be used for entries.
      - Guidelines for extending the schema
        Regardless of the method you use to extend the schema, see this topic for guidelines.
      - Extending the schema using the Schema database
        You can use the Domino® LDAP Schema database to extend the schema by adding attributes, object classes, and syntaxes to the schema.
      - Deleting schema elements from the Schema database
        If you use the Domino® LDAP Schema database (SCHEMA.NSF) to add an element to the schema, you can delete that element if it is no longer needed. After you delete an element, entries already in the directory with values for the deleted element remain, but LDAP add and modify operations can no longer specify the deleted element if schema-checking is enabled.
      - Schema-checking
        When schema-checking is enabled the LDAP service carries out LDAP add and modify operations only if the operations conform to the schema. Schema checking is enabled by default and it is best to keep this default behavior if you allow write access to a directory so that you have better control over the contents of a directory.
      - Searching the root DSE and schema entry
        The LDAP service supports schema-publishing, which means the directory includes a schema entry that you can use to retrieve the directory schema. Use the ldapsearch utility provided with Notes® and Domino® or use another LDAP V3-compliant LDAP search tool to search the root directory server entry (DSE) to determine the name of this schema entry and to retrieve other information about the Domino LDAP directory -- for example, to retrieve the LDAP versions, extensions, and controls supported.
      - LDAP root DSE attributes
        LDAP clients, such as the NAMELookup/LDAP Gateway in Domino®, need to be able to determine special capabilities belonging to a given LDAP server. Once these capabilities are determined, LDAP clients can then decide whether to take advantage of them.
    - ldapsearch utility
      Domino® and Notes® provide a command-line search utility, LDAPSEARCH.EXE, that you use to search entries in any LDAP directory. The ldapsearch utility connects to a directory server and returns results that match search criteria you specify. It is available on Domino server and Notes client platforms.
    - Directory assistance
      Directory assistance allows a server to look up information in a directory other than a local primary Domino® Directory (NAMES.NSF).
    - Directory Sync
      Directory Sync allows you to sync people and group data from an external LDAP directory into the Domino® directory. Currently data from Active Directory can be synced.
    - Directory catalogs
      A directory catalog is an optional directory database that typically contains information aggregated from multiple Domino® directories. Clients and servers can use a directory catalog to look up mail addresses and other information about the people, groups, mail-in databases, and resources throughout an organization, regardless of the number of Domino domains and Domino Directories the organization uses.
    - Extended ACL
      An extended access control list (ACL) is an optional directory access-control feature available for a directory created from the PUBNAMES.NTF template -- a Domino® Directory or an extended directory catalog. An extended ACL is tied to the database ACL, and you access it through the Access Control List dialog box using a Notes® or Domino Administrator client.
    - Setting up Domino® Active Directory synchronization (Deprecated)
      When the Domino® server is installed on a Microsoft™ Windows™ 2003 server, as an administrator, you typically need to maintain two separate directories for the same set of people and groups. Maintaining user and group information involves adding entries to both directories, deleting entries, ensuring that passwords are the same when users use Notes® Single Logon, coordinating group membership in both directories, and ensuring that user or group settings, such as email addresses and telephone numbers, are identical.
  - Configuring messaging
    This section provides an overview of messaging and describes how to set up mail routing, how to set up and customize mail servers, and how to track mail.
  - Configuring iNotes®
    HCL iNotes® provides HCL Notes® users with browser-based access to Notes mail and to Notes calendar and scheduling features. Administrators specify mail policy and security policy settings as well as notes.ini file settings to complete the full implementation of HCL iNotes.
  - Configuring Web servers
    This section describes how to set up the HCL Domino® Web server, and the Domino Web Navigator.
  - Setting up a cluster
    Setting up a cluster includes the tasks of creating and verifying that it is working correctly, and then setting up user access, mail, replications, size quotas, directory assistance, roaming, web navigation, and use of a private LAN in the cluster.
  - Configuring Widgets and Live Text
    Widgets and Live Text enables end users to see and act on Live Text in supported documents, including HCL Notes® mail, using XML extensions (widgets) created specifically for their use.
  - Domain Search
    Notes® client and Web users can use Domain Search to search an entire Domino® domain for database documents, files, and attachments that match a search query.

dominoAccessGroups operational attribute

The dominoAccessGroups operational attribute returns the LDAP DNs that represent the security (ACL) groups to which the object belongs.

Use of dominoAccessGroups can improve performance, as its use requires one LDAP request/response, regardless of the number of groups and nested groups to which the object belongs. The Domino® LDAP server can take advantage of the existing group cache (for names lists).

If dominoAccessGroups is used, other LDAP client applications need not perform recursive searches, thereby reducing application complexity.

An LDAP client should determine whether the LDAP server serves up dominoAccessGroups by querying the root DSE's ibm-enabledCapabilities attribute and checking whether the OID for dominoAccessGroups, 2.16.840.1.113678.2.2.2.2.1355, is supported.

[C:\] ldapsearch -h hostname -s base "(objectclass=*)" ibm-enabledCapabilities

ibm-enabledcapabilities=2.16.840.1.113678.2.2.2.2.1354

ibm-enabledcapabilities=2.16.840.1.113678.2.2.2.2.1355

For more information on the ibm-ibm-enabledCapabilities attribute, see LDAP root DSE attributes.

While overall computation of group membership is faster with dominoAccessGroups, it is possible that the single search now exceeds the LDAP timeout previously used by each of the multiple nested group searches. If you discover that your searches that return dominoAccessGroups are timing out, increase the LDAP Timeout value in the Default Configuration Document for the Domino® domain.