Setting Up Directory Assistance for LDAP in HCL Domino

Setting Up Directory Assistance for LDAP in HCL Domino

Integrating remote LDAP directories into your HCL Domino environment can streamline authentication and directory lookups. Here's a step-by-step guide to setting up directory assistance for an LDAP directory.

Prerequisites

Before diving in, ensure you have:

• Network Connectivity: Verify that your Domino servers can reach the remote LDAP server. A simple ping test can confirm this.

• Directory Assistance Database: Create a directory assistance database (da.nsf) from the da.ntf template and replicate it across servers that will utilize it. Each server must have a local replica to use directory assistance. (ibm.com)

Creating a Directory Assistance Document

1. Access the Domino Administrator:

- Open Domino Administrator. - Navigate to the server that will use the directory assistance database.

1. Open the Directory Assistance Database:

- Go to the Configuration tab. - Expand Directory > Directory Assistance. - If prompted with Server Error: File does not exist, ensure the server is set up to use the directory assistance database.

1. Add a New Directory Assistance Document:

- Click Add Directory Assistance.

1. Configure the Basics Tab:

- Domain Type: Select LDAP. - Domain Name: Assign a unique name different from other Directory Assistance documents. - Company Name: Enter the associated company's name. - Search Order: Define the order in which servers search this directory relative to others. - Make this domain available to: - Notes clients and Internet Authentication/Authorization: For mail addressing and client authentication. - LDAP Clients: To enable LDAP service referrals. - Group Authorization: Choose Yes if you want to search group memberships in this LDAP directory for database access control. - Enabled: Set to Yes.

1. Configure the LDAP Tab:

- Host Name: Enter the LDAP server's hostname or IP address. - Port: Default is 389 for standard LDAP or 636 for LDAPS. - Optional Authentication Credential for Search: Provide credentials if the LDAP server requires authentication for searches. - Base DN for Search: Specify the base distinguished name (e.g., dc=example,dc=com). - Channel Encryption: Choose Yes if using SSL/TLS. - LDAP Vendor: Select the appropriate vendor (e.g., Active Directory).

1. Save and Close the document.

Testing the Configuration

After setting up, it's crucial to test the configuration:

• Verify Connectivity: Use the Verify button in the LDAP configuration section to test the connection. If you encounter errors like LDAP Server is NOT available, ensure the LDAP server is accessible and that network configurations are correct. (developer.ds.hcl-software.com)

• Monitor the Domino Console: Restart the Domino server or the LDAP task and monitor the console for any error messages related to directory assistance.

Troubleshooting Tips

• SSL/TLS Issues: If connecting over LDAPS (port 636), ensure that the Domino server trusts the LDAP server's SSL certificate. This might involve importing the certificate into Domino's key ring.

• Authentication Failures: Double-check the credentials provided in the Optional Authentication Credential for Search field. Ensure they have the necessary permissions to search the LDAP directory.

• Group Authorization: If group lookups aren't functioning, verify that the Group Authorization setting is enabled and that the LDAP directory contains the expected group structures.

The Outcome

By integrating a remote LDAP directory through directory assistance, your Domino environment can authenticate users and perform directory lookups seamlessly across multiple directories. This setup enhances flexibility and centralizes user management, especially in environments with diverse directory services.

Setting Up Domino's Native Backup: A Hands-On Guide

Why Native Backup Matters

If you've been juggling third-party backup solutions for your Domino servers, you know the drill: compatibility issues, complex configurations, and sometimes, less-than-ideal integration. With Domino 12, HCL introduced a native backup and restore feature that simplifies the process, offering a seamless way to protect your data without external tools. Let's dive into setting it up.

Prerequisites

Before we get our hands dirty, ensure:

• Domino Version: You're running Domino 12 or later. This feature isn't available in earlier versions.
• Operating System: Your server is on Windows or Linux. The native backup doesn't support other Operating Systems.

Step 1: Initialize the Backup Database

First things first, we need to create the dominobackup.nsf database, which will house our backup configurations and logs.

• Run the Backup Task: Open your Domino console and execute:

`` load backup ``

This command initializes the backup database. If it's the first run, Domino will create dominobackup.nsf in the data directory.

• Verify Creation: Navigate to your Domino data directory and confirm the presence of dominobackup.nsf.

Step 2: Configure Backup Settings

With the backup database in place, let's set up the backup configurations.

1. Open dominobackup.nsf: Using the Domino Administrator client, access the backup database.
2. Create a New Configuration:

- Platform Selection: Choose between 'Default' (applies to multiple servers) or 'Server' (specific to one server). For most setups, 'Default' suffices.

- Backup Paths: Specify directories for storing backup files. Ensure these paths have adequate storage and permissions.

- Excluded Databases: If there are databases you don't want to back up, list them here.

- Schedule: Define when backups should run. Regular scheduling ensures consistent data protection.

For a detailed breakdown of each configuration field, refer to the official documentation.

1. Save and Close: Once configured, save your settings.

Step 3: Schedule the Backup Task

To automate backups:

1. Create a Program Document:

- Program Name: backup

- Command Line: Leave this blank.

- Server to Run On: Specify your server.

- Schedule: Set the desired frequency and time for backups.

1. Save the Document: This schedules the backup task as per your configuration.

Step 4: Test the Backup

Before relying on the setup:

• Manually Run the Backup: In the Domino console, execute:

`` load backup ``

• Monitor the Process: Check the console for any errors. Also, verify that backup files are created in the specified directories.

Step 5: Restore a Database

Testing the restore process ensures your backups are reliable.

1. Open dominobackup.nsf: Navigate to the 'Restore' view.
2. Select a Database: Choose a database to restore.
3. Restore Options: Decide whether to restore to the original location or an alternate one. You can also choose to restore deleted documents.
4. Initiate Restore: Click 'Restore' and monitor the process.

For more insights on the restore process, check out the Domino Backup Introduction.

To Review

Setting up Domino's native backup isn't just about ticking boxes; it's about ensuring your data's safety without unnecessary complexity. By following these steps, you integrate a robust backup solution directly into your Domino environment. Remember, regular testing of both backup and restore processes is crucial. After all, a backup is only as good as its restore.

For a visual walkthrough, consider watching this HCL Domino Backup/Restore Function video.

Optimizing Domino Cluster Failover for Seamless High Availability

Ensuring high availability in an HCL Domino environment requires meticulous configuration of cluster failover mechanisms. Proper tuning not only guarantees seamless user access during server outages but also optimizes overall server performance. 

This guide delves into key settings and parameters essential for effective cluster failover management.

Understanding Domino Cluster Failover

In a Domino cluster, failover is the process by which the system redirects user requests from an unavailable server to a replica on another server within the cluster. This mechanism ensures continuous access to databases, even during server downtimes. The Cluster Manager on each server monitors the availability of other cluster members and manages the redirection process accordingly.
Learn more about how failover works here.

Configuring Silent Failover on Notes Clients

By default, when a Notes client encounters a server failure, it prompts the user with a dialog box before switching to a replica on another server. To enhance user experience by making this process transparent, you can enable silent failover:

    1. Set the FailoverSilent Parameter:

- Add the following line to the client's notes.ini file: `` FailoverSilent=1 `` - This setting suppresses failover prompts, allowing the client to switch servers without user intervention. Detailed information on this parameter.

    2. Deploy via Desktop Policy:

- Navigate to Policies - Settings - Desktop Settings in the Domino Directory. - Under the Mail tab, select Client Settings. - Enable the option "Enable silent failover when a server goes down". - This policy distributes the FailoverSilent=1 setting to all clients, ensuring consistency across the organization.

Enabling Mail Router Cluster Failover

To ensure that the Domino Mail Router can reroute emails to available servers during a mail server outage, configure the following:

    1. Set the MailClusterFailover Parameter:

- Add the following line to the server's notes.ini file: `` MailClusterFailover=1 `` - This setting allows the Router task to forward incoming messages to a cluster replica of the recipient's mail file on another available server. More details on this parameter.

    2. Configure via Server Configuration Document:

- Open the Domino Administrator. - Navigate to Configuration > Servers > Configurations. - Edit the relevant Server Configuration document. - Under the Router/SMTP tab, go to Advanced > Controls. - Enable the Cluster failover option.

Managing Server Availability and Load Balancing

To prevent servers from becoming overloaded and to manage failover effectively, adjust the following settings:

    1. Set the Server_Availability_Threshold Parameter:

- Add the following line to the server's notes.ini file: `` Server_Availability_Threshold=75 `` - This value (ranging from 0 to 100) defines the minimum acceptable level of available system resources. When a server's availability index falls below this threshold, it declines new database open requests, prompting clients to failover to less loaded servers. Further information on this parameter.

    2. Configure via Server Configuration Document:

- Open the Domino Administrator. - Navigate to Configuration > Servers > Configurations. - Edit the relevant Server Configuration document. - Under the Notes.ini Settings tab, add or modify the Server_Availability_Threshold setting.

Restricting Server Access During Maintenance

During maintenance windows, it's crucial to prevent new user connections while allowing existing sessions to conclude gracefully:

    1. Set the Server_Restricted Parameter:

- To restrict new database open requests: `` set config Server_Restricted=1 ` - This command can be issued directly on the server console. The value 1 restricts access until the next server restart, while 2` makes the restriction persistent across restarts. Detailed explanation of this parameter.

    2. Monitor and Manage Active Sessions:

- Use the Domino Administrator to monitor active user sessions. - Notify users of impending maintenance to minimize disruption.

Tuning the Cluster Repair Service

For environments utilizing symmetrical clusters, the Cluster Repair service ensures database replicas remain consistent across servers. To optimize its performance:

1. Access the Cluster Configuration Document:

- Open the Domino Administrator. - Navigate to Configuration > Clusters > Configuration. - Edit the Cluster Configuration document.

1. Adjust Repair Service Settings:

- Under the Tuning tab, configure the following: 

• Number of repair threads: Set between 1 and 20 (default is 4). 
• Check donor availability: Frequency (in minutes) to check donor server availability (default is 5 minutes).
• Retry failed repairs after: Interval (in minutes) before retrying a failed repair (default is 5 minutes).
• Maximum number of retries: Number of retry attempts before marking a repair as unrepairable (default is 3).
• Repair performance: Level of CPU and disk I/O dedicated to the repair service, from 1 (slowest) to 5 (fastest) (default is 3).
• Repair logging level: Level of logging detail, from 0 (none) to 4 (diagnostic) (default is 2).

- These settings help balance repair efficiency with system resource utilization. More on tuning the repair service.

Conclusion

By carefully configuring these parameters and settings, you can enhance the resilience and performance of your HCL Domino cluster. Regular monitoring and adjustments ensure failover processes remain seamless, providing users with uninterrupted access to critical services.

Booting up the old Blog

Once in a while, I get inspired, or in this case, someone beat me to doing something, and so I have forked their project for my own, and soon to be, your benefit.

When I started down the road with the AI Admin app, it was, like most people find, a small step forward, but one that helped me get a clearer picture of what works, doesn't work, and what makes you want to smash your laptop in pieces.

But that left me wondering, what else I could do to help my fellow admins and wayward developers who must do admin stuff?

5 days ago, although I only saw the post 3 days ago, Heiko posted about this site: https://bryanhsiao.github.io/domino-news/en/.

This is great for developers and people who speak Taiwanese.

I have been playing with a blog posting app, I have 2 others that are active and still tweaking, unrelated to my Domino work, for Admins, and realized Bryan had put this up on GitHub for people to adapt.

Well, I adapted it.

And it took 2 days of testing to get it to a point where it is ready and puts the posts into my blog feed.

I will be editing them slightly, but it gets 95% of what I want done on its own.

You can go look at the site and the GitHub links he has.

Right now, it is random topics while I work on prompting it for specific topics.

Do we need more tech info? Maybe, maybe not.

But sometimes you do want information in one place rather than hopping all over the HCL docs.

In any event, I hope to get 2-3 a week out if they meet the guidelines, so far only 1 out of 8 has met them.

That post will go out overnight, well, for my time zone.

ClamAV and Domino

 I am not an expert on Anti-virus things and Domino, that would be Daniel Nashed.

But if HCL Domino has something new, I test it out and set it up on my server.

In this case, I had heard that ClamAV would now work with Domino as of 14.5.1.

Having used Clam for many years at the OS level, I wanted to play with this in Domino.

My server is Windows, not Linux, ClamAV Linux instructions are pretty common, Windows, not as much.

Boy was this the hardest "easy' thing to do ever.

To start, HCL provides no documentation.

There are only 3 references to ClamAV in the official docs:

https://help.hcl-software.com/domino/14.5.1/admin/wn_config_features_1451.html#wn_config_features_1451__section_fq1_wgc_23c

https://help.hcl-software.com/domino/14.5.1/admin/conf_configuringscanninginscscancfg.html?hl=clamav

https://help.hcl-software.com/domino/14.5.1/admin/conf_scanningattachmentsforviruses.html?hl=clamav

None of which tell you much about how to set up ClamAV or how to configure it for Domino integration.

I opened a ticket and eventually was directed to this post:

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129703

Which is in Japanese. Use Google Translate or Chrome built in translstion.

I see now, at my urging, HCL has released the same document in English.

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131220

Their perspective is that we should go to ClamAv to set it up and then magically know how to integrate it.

I asked why it wasn't in the actual documentation and got a runaround answer, given HCL announced the availability, not ClamAV.

The new technical document covers some of the set up required.

I am going to add what is missing, more for my benefit, and anyone else who will try this on their servers.

Step 1 is Download the ClamAV from the link in the document, https://www.clamav.net/downloads and install it. BUT this does not tell you how to set it up in Services.

For that, you perform this:

Open the Windows Command Prompt as an Administrator and navigate to your ClamAV folder.

Run the following command to install the ClamAV daemon service:
clamd.exe --install

Remember to set it to automatic.

Step 2 is to copy the config file as described and perform the edits.

Step 3, however, did not work for me no matter how I tried to get the certificate. Even with HCL Support help, they eventually had to send me the certificate required.

Step 4: You have to get the updated virus definitions. NOTE: This is a once off effort. And Manual.

If you want it to be automatic, and you do, you need to do these steps.

Open the Windows Command Prompt as an Administrator and navigate to your ClamAV folder.

Run the following command to install the ClamAV daemon service:
freshclam.exe --install

Once you Load mailscan at the Domino server console you will get the cscancfg.nsf and need to follow the document entries as provided.

NOTE: The ClamAV server name(DNS) must be 127.0.0.1. Do not put your server IP there, it will not work at all.

Make sure you open port 3310 with your local server firewall, and in my case, the outside ISP.

I changed the Subject Prefix Scanned field default text to something I would know came from my server, not a spammer.

Lastly, make sure you add Mailscan to your tasks line in your notes.ini also something not mentioned in the document that is kind of important, unless you like having your mail stuck in mail.box and spend 2 hours troubleshooting it one morning, like I just did.

I eventually figured out it was an AV issue when running SMTPDebugClient=1 and

Tell Router list run from the server console.

You see this:

Mbx NoteID          ID          State          Size Pri Count ScheduledDate           From

  1 000008FE 0028261D Wait AV        8443         1                         K Brooks/org

  2 00000902 00283C39 Wait AV       13306         1                         kbrooks@test.com

  1 00000902 002864E3 Wait AV        8749         1                         keith@gmail.com

  2 00000906 00287C9A Wait AV        8640         1                         keith@gmail.com

Oh, that makes sense after the server restarted late yesterday. Mailscan was not in tasks.

So, my time spent, is your time gained.

12.0.2 FP8 didn't update version numbers

This is probably not a problem with FP8, to be upfront, but just in case I am using it for the title.

4 out of 8 servers at a customer did not chaaange tehir version number when I updated them to FP8.

They stayed FP7.

In the past, I have had this issue where updates don't happen, due to various reasons like a corrupted NAB, failed hot fix removals, etc..

But this was different because 4 servers, DEV domain, were fine.

QUAL domain is not updated.

How Did I Get Here

Servers were 12.0.2 FP7 HF1 Windoews 2019

I shut the Domino server down, including the Domino service.

Paused the Windows Management service(ONLY affects HF's for some reason), then ran the hot fix as administrator to remove it.

Started the server from the icon asd a regular application, so I can see it running, and a "sh ser" showed the correct FP7 version. Let it run for a few minutes till I saw HTTP start and some other tasks. Then shut it down.

Run FP8 as an administrator, runs fine, no errors.

Restart the box, actually, 2 servers had issues with the Domino service login, and I restarted the whole VM, the other 2 the service started fine.

Waited to see the server docs change, and nothing.

The upgrade.log showed everything looked ok.

I opened a ticket with HCL after the 1st 4 failed to update, then I checked the next 4 and those worked.

The Resolution and Reasoning

Sooraj from HCL Support provided me with the following resolution and an explanation after I provided some files and screenshots.

Take a backup of the files below and replace them from a "working" server [12.0.2FP8]

Domino\nstrings.dll
Domino\res\C\nstrings.res

Shutdown the incorrect Domino server
Take a backup of the two files mentioned above.
Copy similar files from a working 1202FP8 server and replace them.

(I left the existing ones, and added a _BAD at the end of the name)

Start the Domino server.

While I asked to close the ticket, I also wanted an explanation for future thoughts. 

Sooraj provided the following:

This problem was reported for the first time, and based on my analysis, it appears that those two files were not updated by the FP8 installer. It was still using the FP7 code. This ideally occurs due to an access issue with the account that started the installation, but unfortunately, I cannot confirm this because the upgrade.log doesn't show any such errors.

Possibly a server processing issue, a delay, or perhaps not fully completing a virus scan, or some other local issue was to blame.

But on 4 servers, I don't believe so. 

One, sure, things happen. 

In this situation, all 4, well, 8, are nearly identical setups.

Hope this helps others with similar issues at some time in their admin journeys.

 

Engage 2026, the Year of AI and my session

 There were 11 AI sessions out of about 70, not including roadmap or sponsor/commercial sessions.

I figure in a year or 2 we won't be saying AI and just, look what I built.

Thank you to everyone who messaged me asking where I was hiding. It wasn't my intention to miss the event, but I did not make it.

Instead, I was live from my apartment, doing my session. What may have been a first for Engage, a solo session done remotely!

Due to my flight travel plans being interrupted and changed a few times, it became clear I may not even get to Engage until after my session would have started, and have to stay a day later, but leave much earlier, and this caused quite a few issues, which I discussed with Kris and reluctantly had to give up trying to attend.

Kris said he would hold my space in case things changed for the better, but alas, that was not the case.

However, he said we could try to do it remotely. Webinar mode basically. 

Thanks, Kris and Tom, for the chance and possibility!

I agreed we could try it, not expecting much or even how we would do it, so I labored on with my slides.

I asked the OpennNTF Board, which I am part of, if we could use our webinar meeting app and if someone could connect everything in Ghent.

The Board agreed, and it was game on.

Roberto was very helpful in getting it all set up, Thank you Roberto! I had presumed I would lose 5-10 minutes with setup and adjusted my session accordingly. It was only 7 minutes.

My next thought was, why would anyone come to my session, knowing I wasn't there to give it?

Turns out, about 15-20 people ventured into the room, and I think they were surprised by what they saw and heard.

Full deck is here: https://speakerdeck.com/kbmsg/ai-making-admin-and-users-lives-better

My session was supposed to be on AI tools/apps that anyone had created to help users and admins. To get people thinking more practically about what could be done.

Along the way, I discussed why citizen developers who leverage AI, or anything, don't exist as they did 25 or even 10 years ago.

With locked down browsers and IT blocking changes to applications, let alone updates, and the lack of a Domino Designer client installed (even though it is no longer an extra charge), it is just not easy for users, or even shadow it, to create anything, let alone use it. You can read more about this on page 8 of my slides.

But we admins and developers are not as constrained, aside from browser lockdowns.

I had hoped, had I been at Engage, to go to the Monday HCL workshop on vibe coding. There was also Bernd's session on Tuesday around the advances his company has made, which I looked forward to for his insights. Then there was Dominic's session on Wednesday, also aimed at Admins and AI, which, if I had read all the sessions in advance, I would have tried to compare notes earlier. To be fair, I often don't get around to reviewing the agenda until the week before the event.

I work with some entities that I am not allowed to post about, which explains my dearth of blog posts. But that doesn't stop me from creating things I need to work with in their environments.

My main point of the session was to show a script(LotusScript, server commands, Java, and formulas) building tool for Domino admins. I am not a developer, although I can edit existing code and make things do what I want. When it comes to doing it from scratch, I am useless.

Enter AI, and I said, " I bet I could create something to make my life and other admins ' lives better".

I give you my Domino Script AI Tool.

You can go use it here: https://kbmsg.github.io/domino-scripts/

Or pull it from my GitHub: https://github.com/kbmsg/domino-scripts

The slide deck discusses some of the templates and what it does; the GitHub site provides more details and how to start using it.

I built it to work with Claude.ai, and feedback already asked that I let Ollama be used too.

I started the ollama config, but it is not quite working. If you see it say v66 or newer and followed by Ollama works, like it says just now, you are good to go!

Domino Script AI v64

This will be posted to https://OpenNTF.org as well.

AI vibe coding is literally like building your parachute after you jump out of a plane. Sure, you get most of it right, but that last 10% is the problem, and it takes time.

But, and this is a huge but, if I tried to do this from scratch, it would take me days and days. While I am on iteration 65 or so, all together it took only a few hours to get here, but stretched out over a few days, giving time, resources, and work.

If you have ideas for me to include, feel free to comment here or via GitHub or the OpenNTF Discord channels. 

PS - If you are in a licensing situation and need to sort the CCB vs CCX people, you may want to try the Dump ACL to CSV template. As discussed on page 16 in my slides.