Agenda IBM Corporation

Transcription

1 ID Vault in SmartCloud Notes Open Mic November 9, 2016 Russell Norberg Staff Software Engineer IBM SmartCloud, Verse, and Connections Cloud support IBM Collaboration Solutions Powered by IBM SmartCloud Meetings 2016 IBM Corporation

2 Agenda ID Vault setup in the IBM SmartCloud Notes environment ID Vault management in the IBM SmartCloud Notes environment Troubleshooting ID Vault issues in the IBM SmartCloud Notes environment Additional Resource Links IBM Corporation

3 ID Vault setup in the IBM SCN environment Two IBM SmartCloud Notes environment options: Service-only = all users' data on IBM managed servers Hybrid = combination of on-premises Domino servers and IBM managed servers Two types of administrators: IBM Administrator manages the ID Vault, cloud-based mail files, and cloud-based environment off-site On-prem administrator local company administrator, who can execute some basic tasks related to users Three potential implementations: Users previously in an on-prem environment that had an ID vault, then migrated to the cloud Users previously in an on-prem environment WITHOUT an ID vault, then migrated to the cloud Users registered originally in a cloud service-only environment (never on-prem, no prior vault) IBM Corporation

4 ID Vault setup in the IBM SCN environment 1. IBM creates the new ID Vault database and Policy with Security settings document When users are migrated from on-premises to SCN their User ID files are stored there Admins should upload User ID files into the mail database before migrating if they need : Hybrid users need an ID file for encrypted documents in custom applications. Some apps required secure connections i.e. iphone mail app, Chrome web browser Technote : Limitations when Notes IDs are not in the vault tes_ids_c.dita?lang=en 2. During setup the on-premise Admin creates the ID Vault Trust Certificate. The Vault Trust Certificate certifies that the on-premise parent certifier ( cert.id ) trusts the SmartCloud ID vault to store the user's ID file. Example /NewYork/ACME Technote : Issuing vault trust certificate course IBM Corporation

5 ID Vault setup in the IBM SCN environment 3. Upload User ID file to the SCN ID Vault If User ID has been uploaded to mail database then ID will be automatically be uploaded to ID Vault The local User ID file is harvested from the Notes clients during authentication with the mail server The on-prem Admin can manually upload the User ID directly to the SCN ID Vault using the Admin UI web client \ IBM SCN \ Users \ Upload Notes ID File action 4. Should the on-premises ID Vault be kept? The Admin needs to keep the on-premises ID Vault if there are on-premise users. The on-premise ID Vault will not affect users in the SmartCloud. If the on-premise ID Vault is not needed it can be deleted or archived IBM Corporation

6 ID Vault Management in IBM SCN The on-prem administrator can: Reset user passwords Upload a user ID to the SCN ID Vault using the Admin UI web client Hybrid environments: Admins can manage some password settings using an onpremises security policy document Managing IBM SmartCloud Notes users with policies Policy settings restrictions Password Synchronization in IBM SmartCloud Noteshttps:// Enabling password synchronization The on-prem administrator cannot directly access the ID Vault or the Policy document in the IBM-managed environment Best practice: The on-prem admin should use separate Groups and Policy documents for on-premises vs. service-only users IBM Corporation

7 Troubleshooting ID Vault issues in IBM SCN The on-premises Admin can access the users' Notes client and local replica(s) and perform the following investigations. These steps similar to troubleshooting IDV issues for on-prem Notes clients: For suspected issues regarding ID file synch/out of synch: 1.) Check local notes.ini settings for server name and last synch time: IDVAULT_COUNT1=5 : set greater than 4 IDVAULT_STAMP1=01/01/ :30:00 PM : greater than 24 hours IDVaultLastServer=CN=server1/OU=SCN/O=IBM IDVaultLastFlushTime=06/24/ :18:02 PM The Notes client has two notes.ini settings that keep track of the last time the Notes client synchronized with the ID Vault. To force an immediate synch change the settings to greater than the cutoff time IBM Corporation

8 Troubleshooting ID Vault issues in IBM SCN 2.) Review local Notes client log.nsf for any errors: Miscellaneous Events view Security Events view 3.) Use Notespeek to verify that the User ID was uploaded to the mail database Technote : NotesPeek 1.53 tool for viewing Notes databases URL: The uploaded Notes ID is stored in a profile document called "$Shimmerid". Title: Where is the Notes ID file stored when it is imported into the DWA mail file? URL: IBM Corporation

9 Troubleshooting ID Vault issues in IBM SCN How is the Notes ID file uploaded to the mail database? This can be done at registration or the Web Mail user can upload their ID file manually from Preferences\security. You must be the mail file owner to see security folder. The ID files in the mail database and the ID vault are synchronized automatically after the user provides a password to perform a secure mail operation IBM Corporation

10 Troubleshooting ID Vault issues in IBM SCN 4.) Check the ($Policies) view in user's local names.nsf to verify that the SCN Security Policy has been downloaded: a.) From the Notes client open the local address book - names.nsf b.) Hold down the ctrl+shift keys and select View \ Go To... c.) Scroll down and select the ($Policies) view, then OK to open d.) Right-click on the PolicySecurity doc Document Properties. e.) Go to the second tab (Fields tab) Search for the VTName field on left This is the name of the ID Vault the Client is configured to synch with. Disregard the error popup cannot locate form IBM Corporation

11 Troubleshooting ID Vault issues in IBM SCN 5.) Manually sync with the ID Vault: 1) File Security User Security: "ID Vault Sync" button IBM Corporation

12 Troubleshooting ID Vault issues in IBM SCN 6.) If you wish to enable client-side Debug: Add these parameters to notes.ini Restart the Notes client and login into the home mail server. Manually synch the User ID file to the ID Vault. Collect the local console.log DEBUG_IDV_API=1 DEBUG_IDV_CONNECT=1 DEBUG_IDV_TRACE=1 DEBUG_IDV_SERVER_SELECTION=1 7.) Must Gather for IBM support: The local log.nsf to check for security events. The local names.nsf - check that the effective security policy points to an ID Vault. The local Notes.ini check for vault settings *IDV* The local console.log - after setting debug IBM Corporation

13 Additional Resource Links You can use this workaround procedure to download a copy of the ID file from the IBM SmartCloud Notes ID vault. This procedure applies to hybrid organizations only. How to set up an SCN Notes client when you do not have a local ID file Unable to connect to SCN after running the Notes client configuration tool What You Should Know Before You Change a SmartCloud Notes User's Name Managing Notes Ids (hybrid organizations only) IBM Corporation

14 Press *1 on your telephone to ask a question. Visit our Support Technical Exchange page or our Facebook page for details on future events. To help shape the future of IBM software, take this quality survey and share your opinion of IBM software used within your organization: IBM Collaboration Solutions Support page IBM Collaboration Solutions Support IBM Corporation