Lotus Domino Administrator 8.5 Help - Creating a Directory Assistance document for a Domino Directory or Extended Directory Catalog

DIRECTORY SERVICES

Creating a Directory Assistance document for a Domino Directory or Extended Directory Catalog
To set up directory assistance for an IBM® Lotus® Domino® Directory or an Extended Directory Catalog, create a Directory Assistance document for the directory in the directory assistance database as follows:

Note Do not create a Directory Assistance document for a condensed Directory Catalog.

1. Make sure you have read about directory assistance services and concepts.

2. Make sure that you have created and replicated a directory assistance database and have set up servers to use it.

3. From the Domino Administrator, choose File - Open Server, and select a server that you have set up to use the directory assistance database.

4. Click the Configuration tab.

5. In the left pane, expand Directory - Directory Assistance. If you see "Server Error: File does not exist," the server you selected in step 3 is not set up to use the directory assistance database.

6. Click Add Directory Assistance.

7. On the Basics tab, complete these fields:

Field Enter

Domain type Choose Notes.

Domain name The name of the Domino domain associated with the directory. If the directory isn't associated with a Domino domain because you created it manually rather than through server setup, make up a unique domain name for it.

Company name (Optional) The name of the company associated with this directory. Multiple Directory Assistance documents can use the same company name.

Search order (Optional) A number affecting the order in which servers search this directory relative to other directories configured in the directory assistance database. For more information, see the topic "How naming rules relate to directory searcher orders."

Make this domain available to Choose one or both:

"Notes Clients and Internet Authentication/Authorization"
"LDAP Clients"
Choose "Notes Clients and Internet Authentication/Authorization" to use the directory for Notes mail addressing, Internet client authentication (including LDAP client authentication), or to look up the members of groups for database authorization. For group authorization, you must also enable "Group Authorization" (see below). By default, the option is enabled. To prevent servers from using the directory for these services, do not choose this option.
If the domain specified in the "Domain name" field is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers use the directory for these three services automatically, even if you do not choose this option. If you are using a configuration directory server, you can then make this option equal to the primary address book domain and have the secondary address book available through directory assistance.
Choose "LDAP Clients" to enable the LDAP service running on servers to use the directory for search and write operation when processing LDAP requests. To use the directory for LDAP write operations, you must also enable the directory for write operations in the "All Servers" Configuration Settings document. By default, the option is enabled. To prevent the LDAP service from using the directory for search and write operation, do not choose this option.

Group Authorization Choose one:

Yes to search the members of groups in the directory when authorizing database access. You must also select "Make this domain available to: Notes Clients and Internet Authentication/Authorization."
No (default) to prevent searching the members of groups in the directory when authorizing database access.
You do not have to enable a rule that is "Trusted for Credentials."
Enable this option in only one Directory Assistance document, Notes or LDAP, in the directory assistance database.
If the domain specified in the "Domain name" field is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers use the directory to look up groups for database authorization automatically, even if you choose No for this option.
For more information, see the topic "Directory assistance and group lookups for database authorization."

Use exclusively for group authorization or credential authentication Note This item is only visible if Group Authorization has been enabled for this directory, or if at least one rule has "Trusted" enabled.
Choose Yes to allow directory assistance to use this directory exclusively for Group Authorization or Credential Authentication. Enabling this will minimize the number of non-authentication and non-authorization lookups to this directory.
For more information, see the topic "Limiting directories to authentication-only lookups."

Enabled Choose Yes to enable directory assistance for this directory.
Note You can enable or disable directory assistance from the main view of the Directory Assistance database by selecting the directory assistance record for the directory and, on the toolbar, click Enable/Disable.

Attribute to be used as name in an SSO token The default option for this field is LTPA_UserNm.
For more information about name mapping in the LTPA token used for single sign-on, see the topic "Configuring user name mappings in the SSO LTPA token."

8. Click the Naming Contexts (Rules) tab, and for each rule you want to define, complete the following fields. By default, an all-asterisk rule is enabled with "Trusted for Credentials" set to No.

Field Enter

N.C. # A naming context (rule) that describes names in the directory. For more information, see the topic "Directory assistance and naming rules."

Enabled Choose one:

Yes to enable a rule
No to disable a rule

Trusted for Credentials Choose one:

Yes to allow servers to use credentials in this directory to authenticate Internet clients whose distinguished names in the directory correspond to the rule.
No (default) to prevent servers from using this directory to authenticate Internet clients whose distinguished names correspond to the rule.
For more information, see the topic "Trusted naming rules."
If the domain specified in the "Domain name" field on the Basics tab is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers trust all user names in the directory for client authentication, even if you do not choose this option.

9. Click the Replicas tab. Use either the "Database links" field or the "Replica#" fields to specify replicas of the directory for servers to use. If you make any entry in a Replica# field, then directory assistance ignores all entries in the "Database links" field.

To set up directory assistance to use cluster failover to locate an available replica of the directory, specify only one replica of the directory within the cluster.

For more information on failover, see the topic "Directory assistance and failover for a Domino Directory or Extended Directory Catalog."

Field Enter

Database links For each replica you want to specify:

Open the replica of the directory, and choose Edit - Copy As Link - Database Link.
Select the "Database links" field, and choose Edit - Paste.
Using database links may delay server startup. When you restart a server that uses directory assistance, server tasks retrieve database information from the remote servers to which the links refer. Use database links only if the servers to which the links refer are consistently available.

Replica# The server name and file name of a replica of the directory -- for example:
Server Name: Mail1/West/Acme
Domino Directory File Name: EASTNAMES.NSF
Selected Enabled next to each replica you specify.

10. Click Save & Close.

Related topics

Directory assistance services

Directory assistance concepts

Directory assistance and domain names

How naming rules relate to directory search orders

Directory assistance and group lookups for database authorization

Creating and replicating a directory assistance database

Limiting directories to authentication-only lookups

Configuring user name mapping in the SSO LTPA token

Directory assistance and naming rules

Directory assistance and failover for a Domino Directory or Extended Directory Catalog

Shortcut for specifying local replicas of a Domino Directory or Extended Directory Catalog in a Directory Assistance document

Setting up directory assistance

Glossary

Feedback on Help or Product Usability?

Help on Help

All Help Contents

Glossary

Field	Enter
Domain type	Choose Notes.
Domain name	The name of the Domino domain associated with the directory. If the directory isn't associated with a Domino domain because you created it manually rather than through server setup, make up a unique domain name for it.
Company name	(Optional) The name of the company associated with this directory. Multiple Directory Assistance documents can use the same company name.
Search order	(Optional) A number affecting the order in which servers search this directory relative to other directories configured in the directory assistance database. For more information, see the topic "How naming rules relate to directory searcher orders."
Make this domain available to	Choose one or both: "Notes Clients and Internet Authentication/Authorization" "LDAP Clients" Choose "Notes Clients and Internet Authentication/Authorization" to use the directory for Notes mail addressing, Internet client authentication (including LDAP client authentication), or to look up the members of groups for database authorization. For group authorization, you must also enable "Group Authorization" (see below). By default, the option is enabled. To prevent servers from using the directory for these services, do not choose this option. If the domain specified in the "Domain name" field is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers use the directory for these three services automatically, even if you do not choose this option. If you are using a configuration directory server, you can then make this option equal to the primary address book domain and have the secondary address book available through directory assistance. Choose "LDAP Clients" to enable the LDAP service running on servers to use the directory for search and write operation when processing LDAP requests. To use the directory for LDAP write operations, you must also enable the directory for write operations in the "All Servers" Configuration Settings document. By default, the option is enabled. To prevent the LDAP service from using the directory for search and write operation, do not choose this option.
Group Authorization	Choose one: Yes to search the members of groups in the directory when authorizing database access. You must also select "Make this domain available to: Notes Clients and Internet Authentication/Authorization." No (default) to prevent searching the members of groups in the directory when authorizing database access. You do not have to enable a rule that is "Trusted for Credentials." Enable this option in only one Directory Assistance document, Notes or LDAP, in the directory assistance database. If the domain specified in the "Domain name" field is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers use the directory to look up groups for database authorization automatically, even if you choose No for this option. For more information, see the topic "Directory assistance and group lookups for database authorization."
Use exclusively for group authorization or credential authentication	Note This item is only visible if Group Authorization has been enabled for this directory, or if at least one rule has "Trusted" enabled. Choose Yes to allow directory assistance to use this directory exclusively for Group Authorization or Credential Authentication. Enabling this will minimize the number of non-authentication and non-authorization lookups to this directory. For more information, see the topic "Limiting directories to authentication-only lookups."
Enabled	Choose Yes to enable directory assistance for this directory. Note You can enable or disable directory assistance from the main view of the Directory Assistance database by selecting the directory assistance record for the directory and, on the toolbar, click Enable/Disable.
Attribute to be used as name in an SSO token	The default option for this field is LTPA_UserNm. For more information about name mapping in the LTPA token used for single sign-on, see the topic "Configuring user name mappings in the SSO LTPA token."

Field	Enter
N.C. #	A naming context (rule) that describes names in the directory. For more information, see the topic "Directory assistance and naming rules."
Enabled	Choose one: Yes to enable a rule No to disable a rule
Trusted for Credentials	Choose one: Yes to allow servers to use credentials in this directory to authenticate Internet clients whose distinguished names in the directory correspond to the rule. No (default) to prevent servers from using this directory to authenticate Internet clients whose distinguished names correspond to the rule. For more information, see the topic "Trusted naming rules." If the domain specified in the "Domain name" field on the Basics tab is the same Domino domain (the primary domain) of the servers that use directory assistance, the servers trust all user names in the directory for client authentication, even if you do not choose this option.