SnTT - TOTP Needs an ID file in the ID Vault to Work, What if some are Missing?

Yes, of course, a properly managed Domino environment should have been using the ID Vault for several years now.

But we all have customers who, for one reason or another, just never did it, or worse, think they did but never check that it worked.

And then we hear from them out of the blue to help get TOTP installed and update their environment.

No big deal, right? Set up the ID Vault, and when people log in to their Notes client, their ID files get sent to the ID Vault. Newly registered people are also automatically added to the ID Vault.

But what do you do about people who solely use webmail/iNotes?

How do you get their IDs into the ID Vault?

This, I thought, would be an easy thing, but it turned out to be way more effort than first thought.

One option is to select the user in the Directory with the names.nsf open, right-click on their person document, and select upload ID to the ID Vault. A similar Action from the top menu bar option can be found in the Admin client when the Directory is not open.

Not so fast. 

First, the option and action did not appear. Second, even if they did appear, we had 2 problems: where were these people's ID files and the better issue was who had the passwords? 

When you upload ID files to the ID Vault, Domino asks for the password for the file being uploaded, and if it does not match, you are out of luck.

We could not resolve the 2nd problem. More on that in a minute.

The first problem, I reached out to HCL Support to find out what happened to the action/agents.

Turns out they were in the template but not in the database.

After reviewing it with HCL, we found the customer had edited the People view of the Directory and set it to not update with changes from future templates.

I changed that setting in Designer and the properties of the view, then ran a replace design on the Directory, restarted the server, and it now worked and showed the action/agent items.

Now, back to the ID problem.

How can one register new users optimally without wiping out all their details in their existing person document?

I figured I needed to look at registering people with a text file and how to do it without changing their existing internet password or wiping out their mail file.

11 years ago, I wrote this post, https://blog.vanessabrooks.com/2010/06/id-registration-via-text-file.html, waiting for the moment it would be helpful again.

Well, that day has come. However, to be fair, I have used it a few times over the years.

I also searched for how to create a user but not a mail file. I did not get an answer to this in my searches or when asking some people, so I decided I just had to work around the issue. If anyone knows, please let me know in the comments, and I will edit this post accordingly.

Using the spreadsheet I created in 2010, I started figuring out what the syntax should be to complete this.

After a few tests, ok, maybe a few more tests, I realized I needed to maintain the file names but change the file directory. That way, dummy mail files would be created, which could be deleted, saving their existing mail files. However, the person document would now show the wrong location for the person's mail. Hang on, we will fix that soon too.

These people needed ID files in the ID Vault but would never use them otherwise. The ID files require a password, but we do not want it to synch with their internet password because that would overwrite their existing one. Domino has a way to help us do this, too; the explanation is below.

What does this spreadsheet look like before you copy the text to a .txt file? I figured I only needed to use a few fields, and this is what I used just 6 fields:

LAST    FIRST    PASSWORD    FILE DIRECTORY    FILENAME    EMAIL

Now the fun part is you need a semi-colon (;) after any entry you want to enter, so my text file for registration ended up looking like 250 of these(see the 11-year-old blog post for details on what goes in what order if you need more fields):

Brooks;Keith;;;PASSWORD;;;;mail2;kbrooks.nsf;;;;;;keith@b2bwhisperer.com;

But you need one more essential thing before starting the registration process for everyone.

If you click on options from the Registration window menu, 

you will want to check the line that says "Allow Registration of previously registered people," and check the "Don't prompt for a duplicate person" option, and select the most important option, "Update the existing address book entry.

When you use these settings, Domino will not stop for every duplicate user and just change precisely what we tell it to change in the person document.

In the registration form, you should ensure your ID Vault policy is set up for everyone.

As discussed earlier, we don't want to overwrite any existing Internet passwords; thus, you need to click on Password Options and uncheck "Set Internet Password"; otherwise, you will write over their current Internet password. HINT: Back up your Names.nsf before doing this, so if you do screw it up, you can get it all back quickly.

In the Mail tab of registration, you set the mail template to use and leave the mail file name field with just the directory name. The .txt file handles this.

Set the expiration date you want to use for everyone you are creating on the ID Info tab.

Now you import your .txt file, and Domino will tell you if any of them have syntax issues.

Domino will then let you know if anyone had issues or how many were completed when you ran it.

Please test with 2-3 people first, making sure all fields and entries look right, and the mail file is created where you specified.

How do we change the mail file locations, which now were mail2 instead of mail for 250 people out of 500?

A few months back, I started adding scripts to Openntf.org under the snippets Admin Scripts area to help other admins and for just this purpose. 

I took one of the scripts, adapted it for the Mail File location field, and then selected the users to run it on, and in seconds they were all back to normal. 

I posted that new script as well in case anyone will need to do this at the openntf site here.

Afterward, we had a few issues:

• Some people we were told were solely web users were not. This meant they lost their ID certificate and could not log in. Easy enough to fix by copying the new certificate into their person document and replacing the old one. 
• A few people in our spreadsheet had mistyped an email or mail file name and a few similar names and file names that got by us in editing. Easily fixed, we had a backup to verify what they should have in their fields.

And there you have it. I know it sounds like a lot, but really, it is not that big of a deal.