HCL Domino V11 – Directory Synchronzation – Part 7

Registering Active Directory users in Domino

When you use Directory Sync, you can register Active Directory users in Domino to create mail files and Notes IDs for them.

To register Active Directory users in Domino, open the Admin client and navigate to “People & Groups -> People“. Select the name of an Active Directory user to register. Right-click and select Register Selected Person.

Select the certifier and type in the password.

The Register Person dialog appears, pre-filled with …

ouups. NOTHING in there.

This is an issue, I ran into during BETA testing. It took a while until we found out the cause for it. If you encounter the same in V11 GA in your environment, open the Notes Client notes.ini and search for

NewUserServer=<servername>

Most likely, servername is not the name of the registration server. Delete the entry from notes.ini and restart the Administration client.
If this does not fix the issue, check your policy settings. Chances are that the registration server in the registration policy does not match the server where you want to register the user.

This is a known issue and will be fixed hopefully in Domino V11.0.1. It’s being tracked under SPR# MOBNBHQQUH.

With the correct settings in place, you will see the following

Complete the registration dialog and register the user.

The Active Directory users is now registered in Domino.

By now, you can only register one user at a time. An enhancement request already exists to register ALL selected Active Directory users.

Renaming Domino users when their names change in Active Directory

When you use Directory Sync and the common name of a registered Domino user changes in Active Directory, follow this procedure to change the name in the Domino directory Person document, too.

The Rename Domino users upon Active Directory rename option must be enabled in the Directory Sync configuration document.

When a Domino user’s common name changes in Active Directory, a Rename Common Name administration process request is created. You must approve the request for the rename to be carried out in Domino.

I renamed the user in Active Directory

Here is what you see on the server console during the sync.

[0290:0004-16DC] DirSync  Entry with mail address 'd.vader@darkside.org' - NoteID 33086 was found in the target directory.
[0290:0004-16DC] DirSync  
DirSync  CSyncFromAD::DoModify(dn = 'CN=Darth Vaderman,CN=Sync,DC=ad,DC=fritz,DC=box', newentry=0)
[0290:0004-16DC] 22.01.2020 08:34:28 LLNDirSync CSyncToAdminP::ModifyPerson: FLATFirstFuameValue: CN=Darth Vaderman/CN=Sync/DC=ad/DC=fritz/DC=box
 Status: No error.
[0290:0004-16DC] DirSync Submitted adminp request to rename user CN=Darth Vader/O=singultus to CN=Darth Vaderman/O=singultus
[0290:0004-16DC] DirSync  Modified LastName from 'Vader' to 'Vaderman'
[0290:0004-16DC] DirSync  Modified memberOf from '' to 'CN=BadGuys,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  Modified uSNChanged from '234953' to '235340'
[0290:0004-16DC] DirSync  'person' Document updated, UTF8 Name = 'CN=Darth Vaderman,CN=Sync,DC=ad,DC=fritz,DC=box' 
[0290:0004-16DC] DirSync  CSyncFromAD::DoModify - Modified existing Note for 'CN=Darth Vaderman,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  
[0290:0004-16DC] 22.01.2020 08:34:28   DIRSYNC From Active Directory (AD) - Summary (1.111 sec, Start=235338, Adds=0, Modifies=1, Deletes=0, Skips=0, Errors=0, End=235340)

Open admin4.nsf and navigate to “Rename Common Name Requests”.

Select the names to process and click Complete rename for selected entries. Select certifier and provide the Notes certifier password.

Select “Change common name” in the next dialog box.

A standard administration process Rename In Domino Directory request is then initiated for each name processed.

Deleting registered users 

When users or groups are deleted in Active Directory, they are also deleted in the Domino® directory, with one exception: Active Directory users who are registered as Domino users (have mail files, etc) are not deleted from Domino.

The objectGUID item will be removed from the personrecord on next resync.

DirSync  Removed ObjectGUID for Registered User with Note ID 33086, user = CN=Darth Vaderman/O=singultus.

HCL Domino V11 – Directory Synchronzation – Part 6

Synchronize users

In this part of the tutorial, we want to look at what happens when DirSync synchronizes objects from Active Directory

Let’s first take a look into the Directory Assistance document for the AD domain to find the BaseDN.

Using LDAPAdmin, we can now navigate to CN=Sync under the root entry DC=ad,DC=fritz,DC=box. This is where DirSync will for users and groups to sync to the target directory.

Our Directory Sync document for domain AD has an LDAPFilter applied to sync only a subset of all entries under the BaseDN

In this sample, only Darth Vader has a mail address that matches the filter criteria.

Let’s see what happens, when DirSync kicks in.

DirSync connects to the Active Directory using the information from the Directory Assistance document for domain AD. It then finds the configured baseDN and evaluates the LDAP filter expression.

[0290:0004-16DC] DirSync  CSyncFromAD::SyncSpan (NAMEldap_search_ext_s call) : (&(&(|(objectClass=Group)(objectClass=Person))(|(mail=@brightside.)(mail=@darkside.)(mail=@msdn.)))(uSNChanged>=234898)) took 1 msec

[0290:0004-16DC] DirSync  Processing ldap entry (SyncSpan) #1 from page #1, total entries #1: 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'

DirSync has identified “Darth Vader” as a valid candidate for sync, creates a new document in the target directory and copies the values from the object attributes in Active Directory to the matching Notes items in the document

[0290:0004-16DC] DirSync  Modified LastName from '' to 'Vader'
[0290:0004-16DC] DirSync  Modified OfficeCity from '' to 'Tatooine'
[0290:0004-16DC] DirSync  Modified OfficeState from '' to 'Alpha Quadrant'
[0290:0004-16DC] DirSync  Modified o from '' to 'Dark Side Inc.'
[0290:0004-16DC] DirSync  Modified JobTitle from '' to 'Bad Guy'
[0290:0004-16DC] DirSync  Modified Comment from '' to 'description'
[0290:0004-16DC] DirSync  Modified OfficeNumber from '' to 'Deathstar'
[0290:0004-16DC] DirSync  Modified OfficePhoneNumber from '' to '+99(555)DEATHSTAR'
[0290:0004-16DC] DirSync  Modified FirstName from '' to 'Darth'
[0290:0004-16DC] DirSync  Modified memberOf from '' to 'CN=starwars,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  Modified uSNChanged from '' to '234898'
[0290:0004-16DC] DirSync  Modified WebSite from '' to 'www.deathstar.info'
[0290:0004-16DC] DirSync  Modified objectGUID from '' to '8e7032bd93bded4782479eaf66208b25'
[0290:0004-16DC] DirSync  Modified InternetAddress from '' to 'd.vader@brightside.org'
[0290:0004-16DC] DirSync  Modified MailAddress from '' to 'd.vader@brightside.org'
[0290:0004-16DC] DirSync  Modified MailSystem from '' to '5'
[0290:0004-16DC] DirSync  'person' Document updated, Common Name = 'CN=Darth Vader' 
[0290:0004-16DC] DirSync  CSyncFromAD::DoModify - Added New Note for 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'

Finally, DirSync saves the document and prints the sync summary

[0290:0004-16DC] DirSync  
[0290:0004-16DC] 21.01.2020 11:01:03   DIRSYNC From Active Directory (AD) - Summary (0.037 sec, Start=234898, Adds=1, Modifies=0, Deletes=0, Skips=0, Errors=0, End=234898)

Opening names.nsf in the Admin Client, you’ll find a new entry for “Darth Vader”. An icon indicates that this entry has been synced by DirSync.

Additional fields to sync

DirSync by default syncs standard attributes from an Active Directory object to Notes items in the target directory document.

The name in parentheses is not the name of of the target Notes item. It is just descriptive. The actual mapping of an attribute to a Notes item is done via the schema.nsf database on the server.

You can enhance this list and add additional attributes. (higlighted yellow).

In our sample, additional attribute “o” is mapped to the according Notes item “o”.

Currently there is an issue with multi value items. There is no such type in Active Directory. Multiple values are stored in attributes of the same name.
DirSync only syncs the first attribute. This is a known limitation. The issue will be addressed in a future version.

Another known issue is with attributes of type “Image“. They are currently not synced to the person document. The issue is tracked under SPR MOBNBJGSL6 and targeted for V11.0.1.

Internal fields

DirSync adds a couple of internal items to the person document that are needed to identify an Active Directory object in the target directory.

These items should not be modified!

Modifications in Active Directory

During a scheduled sync, DirSync processes only objects that have been changed after the last sync. (uSNChanged)

[0290:0004-16DC] DirSync  Processing ldap entry (SyncSpan) #1 from page #1, total entries #1: 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  Entry with mail address 'd.vader@brightside.org' - NoteID 33050 was found in the target directory.
[0290:0004-16DC] DirSync  CSyncFromAD::DoModify(dn = 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box', newentry=0)
[0290:0004-16DC] DirSync  Modified o from 'Dark Side Inc L' to 'Dark Side Inc.'
[0290:0004-16DC] DirSync  Modified uSNChanged from '234927' to '234930'
[0290:0004-16DC] DirSync  'person' Document updated, UTF8 Name = 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box' 
[0290:0004-16DC] DirSync  CSyncFromAD::DoModify - Modified existing Note for 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  
[0290:0004-16DC] 21.01.2020 13:48:06   DIRSYNC From Active Directory (AD) - Summary (0.022 sec, Start=234930, Adds=0, Modifies=1, Deletes=0, Skips=0, Errors=0, End=234930)

Be careful, when you set an already synced attribute to an empty value; AD will remove such attributes from the object. As a result, the target document will not be modified.

I removed the value from the “o” attribute in the user object. The attribute was removed completely from the object.
DirSync recognised the change and processed the object. But it could no longer find the “o” attribute and left the item in the person document unchanged.

[0290:0004-16DC] DirSync  Processing ldap entry (SyncSpan) #1 from page #1, total entries #1: 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  Entry with mail address 'd.vader@brightside.org' - NoteID 33050 was found in the target directory.
[0290:0004-16DC] DirSync  
DirSync  CSyncFromAD::DoModify(dn = 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box', newentry=0)
[0290:0004-16DC] DirSync  Modified uSNChanged from '234935' to '234936'
[0290:0004-16DC] DirSync  'person' Document updated, UTF8 Name = 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box' 
[0290:0004-16DC] DirSync  CSyncFromAD::DoModify - Modified existing Note for 'CN=Darth Vader,CN=Sync,DC=ad,DC=fritz,DC=box'
[0290:0004-16DC] DirSync  
[0290:0004-16DC] 21.01.2020 13:59:06   DIRSYNC From Active Directory (AD) - Summary (0.022 sec, Start=234936, Adds=0, Modifies=1, Deletes=0, Skips=0, Errors=0, End=234936)

Deleting objects

When users or groups are deleted in Active Directory, they are also deleted in the Domino® directory, with one exception: Active Directory users who are registered as Domino® users (have mail files, etc) are not deleted from Domino. The deletion is not performed during a scheduled sync. You have to initiale a resync to delete persons that do no longer are available in Active Directory.

SyncFromLDAPToNAB - Deleted existing Note for 'Darth Vader'. This is NOT a registered user and could be a deleted orphan
[0290:0005-16E0] DirSync  resyncall - SyncFromLDAPToNAB completed in: 0.225 seconds
[0290:0005-16E0] DirSync  Updating SyncAll Request's DirSyncRequestState to 2
[0290:0005-16E0] 21.01.2020 15:07:10   DIRSYNC Full Resync From Active Directory (AD) - Summary (0.225 sec, Start=0, Adds=0, Modifies=0, Deletes=1, Skips=2, Errors=0, End=234945)

HCL Domino V11 – Directory Synchronzation – Part 4

In this part of the tutorial about Domino V11 Directory Synchronization, we want to take a closer look at the actions that can be performed on DirSync configuration documents.

Enable Configuration

To enable a DirSync configuration, select it in the view and click the Enable button.
You will be presented a dialog box where you can select from 2 options.

Select Run in test mode to simulate the actions that Directory Sync would take but without changing any Domino® data. Make any adjustments needed to the Directory Sync configuration. When you are ready to enable synchronization for real, select Synchronize data.

Next, click OK to close the Activate Directory Sync dialog

DirSync will recognise the new configuration on the next scheduled run.

Disable configuration

To disable a DirSync configuration, select the document in the view and click the Disable button.

Next, click OK to close the Deactivate Directory Sync dialog

A “Disable” request document will be created.

DirSync will disable the configuration on next scheduled run and also delete the request document.

You also have to disable a Directory Sync configuration before changing it. You will get a warning message if you try to edit an enabled Directory Sync configuration.

Resync

You can resync all of the Active Directory data.Resync if you make changes to the Directory Sync Configuration document that affects which data is synced. Resyncing occurs through a Dirsync thread that runs in the background, in parallel with the usual incremental sync.

Next, click OK to close the Resynchronize Selected Directories dialog

A “Resync” request document will be created.

On the server console you will see the following entries when the DirSync task processes the resync request.

[1BE0:0004-1D10] DirSync  Updating SyncAll Request's DirSyncRequestState to 1
[1BE0:0004-1D10] 20.01.2020 06:56:19   DIRSYNC From Active Directory (AD) - Summary (0.001 sec, Start=234776, Adds=0, Modifies=0, Deletes=0, Skips=0, Errors=0, End=234775)
[1BE0:0005-0284] DirSync  Sync all request calling SyncFromLDAPToNAB.
[1BE0:0005-0284] DirSync  resyncall - SyncFromLDAPToNAB completed in: 0.363 seconds
[1BE0:0005-0284] DirSync  Updating SyncAll Request's DirSyncRequestState to 2
[1BE0:0005-0284] 20.01.2020 06:56:26   DIRSYNC Full Resync From Active Directory (AD) - Summary (0.363 sec, Start=0, Adds=3, Modifies=0, Deletes=0, Skips=0, Errors=0, End=234775)
[1BE0:0004-1D10] DirSync  Deleting SyncAll Request
[1BE0:0004-1D10] 20.01.2020 06:57:19   DIRSYNC From Active Directory (AD) - Summary (0.001 sec, Start=234776, Adds=0, Modifies=0, Deletes=0, Skips=0, Errors=0, End=234775)

Resync Issue

There is a small issue with resync when you accidently flag a disabled DirSync configuration for resync.

After you confirm to resynchronize selected Directories, the configuration will be flagged for resync by setting the item DirSyncReset=”1″.

When you now enable the configuration, you would expect a resync of the selected configuration, right?
But that does not happen. The DirSync task starts as soon as it detects the new configuration, but it does neither perform the requested resync nor it resets the DirSyncReset item value.
Even trying to reinitiate the resync fails. You need to remove the DirSyncReset item value by either using an agent or another tool of your choice.

I have created a case with HCL for this (Case# CS0081445)

Issue with Domino Directory file name

If you see the following error message on the server console

[1BE0:0004-1D10] CSyncFromAD::ProcessEntry could not open customer directory -  reason File does not exist

check the Domino Directory file name item value in DirSync configuration. Most likely, the file name is misspelled or the file does not exist on the server. In the BETA version, this resulted in an enabled configuration to be prevented from being disabled. This has been tracked under SPR# MOBNBHUHGD and fixed in Domino V11 GA.