Accounts are reverting back to their original names

hcl-bot · August 31, 2004, 10:45am

I have written some code to automate the name changes and section changes for our organization using the “NotesAdministrationProcess “class in lotus script.

Everything works fine for several weeks then some of the accounts are reverted back to their original names.

Anyone heard of this and better still have a fix?

Our servers are running 6.5.

If you need more info let me know.

Thanks,

C.J.

This is the code I am using.

Function UpdateUserAccount( strUser As String , strFName As String ,

strMName As String, strLName As String ,

strOrgUnit As String) As Boolean

'*** strUser 		= Full name as it is in address book now.  This is how admimp finds user

'*** strOrgUnit 	= New section



Print "******************	UpdateUserAcccout - Start"

Dim 	NoteID    As 		String

Dim 	session    As New 	NotesSession

Dim 	adminp    As 		NotesAdministrationProcess

Set 	adminp   		=   session.CreateAdministrationProcess(oServers.strAdmin1 )

Adminp.CertifierFile 		=  “C:\CertFile.id"

adminp.CertifierPassword 	=  "Password"



Call adminp.RenameNotesUser(strUser,  strLName,strFName,strMName, strOrgUnit)

Print "******* Called AdminP to Change Section or Name. - Org Unit is - " & oUser1.strOrgUnit



UpdateUserAccount = True



Print "******************	UpdateUserAccont - End"

End Function

hcl-bot · August 31, 2004, 12:49pm

Subject: Here is the technote on your problem from kbase

Title: Renamed Users are Reverted Back to Their Old Names After 21 Days

Product: Lotus Domino > Lotus Domino Server > 6.x, 5.x

Platform(s): Platform Independent

Date: 03/17/2004

Doc Number: 1139262

An administrator has renamed a user (using a Domino 6 Administration client), and the user has accepted the new name, however 21 days later, they are reverted to their original name (the name in use prior to the name change), and may be unable to access their mail files.

This issue may occur in either a multiple Domino Domain environment utilizing Directory Assistance (DA), also known as cascaded directories, or a single Domino Domain environment. For details, please consult the “Cause” section below.

NOTE: A Domino domain is a group of Domino servers that share the same Domino Directory. So a multiple Domain environment would have multiple Domino Directories, one for each Domain, and a single Domain environment would have just one Domino Directory. For more information on Domains, please consult the Domino Administrator’s Guide.

Further investigation reveals that:

After the name was accepted, the person document was updated with the new name, however 21 days later, the person document shows the old name again.
The ID properties for the user’s ID file show that the new name had indeed been accepted.
The Access Control List (ACL) log for the user’s mail file shows that the user’s new name was never populated into the ACL. After the “Rename in Domino Directory” is completed by AdminP a “Rename in Access control list” request is generated. It is the completion of this request that in turn populates the ACL log with entries specifying that the new name has been added and the old name has been deleted.

NOTE: In Domino releases prior to Domino 6, users were always prompted to accept name changes the first time they attempt to access a server. In Domino 6, an administrator can choose to have Domino prompt users to accept the change or have acceptance occur automatically, so users may not be prompted. For more information, please consult technical document, “After Executing a Name Change, You Are No Longer Prompted to Accept the Name Change” (document #: 1113537 - see link below)

The causes for this issue depends on whether the issue occurs in a single Domain environment or a multiple Domain environment.

An example of how this issue occurs in a multiple Domain environment is as follows:

A user belongs to Domain A, and the administrator renames this user in Domain A. After the rename is initiated, the user then accesses Server B in Domain B, Server B looks at the user’s updated Person document, and the authentication triggers the Accept Rename dialog window wherein the user accepts the name change. Server B, not knowing the user belongs to a different domain, erroneously generates the next document in the rename process (“Rename Person in Domino Directory”) in its own Admin4.nsf rather than the Admin4.nsf in Domain A. This is a problem because this document must be completed by the Administration Server in Domain A in order for the rename to complete successfully. The SPR for this issue is JNON5RHRKF

The exact cause of the issue in a single domain environment is still under investigation. Lotus software Quality Engineering is currently attempting to confirm whether or not a “Rename in Domino Directory” request is generated in the Admin4.nsf on the server with which the user authenticates while accepting the rename. The SPR for single domain occurrences is JNON5SRT6J

Note: The following download document contains a link to two views that will help provide the following information for customers experiencing the issue whereby changed user names revert to their original state after 21 days

Which users are potentially affected by the AdminPOld reversion fields.
How long have the ChangeRequests have been outstanding (Change Request Date). You can determine if the users fall in the 14 to 60 day range that is allowable.
The Home mail servers of the affected people. You can track down AdminP requests on these servers.

Download Document, “Views To Assist In Diagnosis of Name Reverting After 21 Days in Notes” (Document #: 4006431).

SPR #: JNON5RHRKF was reported to Lotus software Quality Engineering, and has been fixed in Domino Release 6.5.1.

Excerpt from the Lotus Notes and Domino Release 6.5.1 MR fix list (available at IBM Developer):

SPR# JNON5RHRKF - In a multi-domain configuration, replicas of the directory could exist on servers in both domains. When these servers replicate the change request will also exist in the replicated copy located in the other domain. If a user authenticated with a server in the other domain there was nothing to prevent the client from posting the “Rename Person in Domino Directory” request into the other domains admin4 database. This fix prevents the client from posting a “Rename Person in Domino Directory” request into another domains Administration Request database. The request is only posted when the “domain” field in the “Server Document”, the “Person Record”, and the “Client’s Location Record” match.

If upgrading to Domino 6.5.1 is not an immediate options, the only known workaround is to register the user with the desired name. The old ID should be retained so that it can be used to access fields, documents and or databases encrypted with its keys.

Supporting Information:

Note: You can rename a user with the Administration Process by selecting People > Rename from the Tools pane of the Domino Administrator.

The following is an excerpt from the “Rename Person” section of the Domino Administrator’s Guide that shows the expected progression of the execution of a Rename Request by AdminP:

"Initiate rename in Domino Directory

Triggered by: Choosing a rename action.

Carried out on: The administration server for the Domino Directory.

Carried out: According to the “Interval” setting for the Administration Process in the Server document.

Result: Adds the new name, certificate, and change request to the Person document. Prompts the person to accept the new name upon next server authentication.

Rename person in Domino Directory

Triggered by: Person accessing a server and accepting the new name.

Carried out on: The administration server for the Domino Directory.

Carried out: According to the “Interval” setting for the Administration Process in the Server document.

Result: Updates the person’s name in the Domino Directory – except for Person documents. Posts the “Rename in Person documents” and the “Rename person in Unread Lists” administration requests.

Rename in Person documents

Triggered by: Completion of the “Rename person in Domino Directory” request.

Carried out on: The administration server for the Domino Directory.

Carried out: According to the “Execute once a day requests at” setting for the Administration Process in the Server document.

Result: Updates the name in Domino Directory Person documents.

Rename person in unread list

Triggered by: Completion of the “Rename person in Domino Directory” request.

Carried out on: Each server in the domain.

Carried out: According to the “Execute once a day requests at” setting for the Administration Process in the Server document.

Result: Each server in the domain examines every database on the server and updates the person’s name in any unread lists.

Rename in Access Control List

Triggered by: Completion of the “Rename person in Domino Directory” request.

Carried out on: Each server in the domain.

Carried out: According to the “Interval” setting for the Administration Process in the Server document.

Result: Each server in the domain updates the person’s name in ACLs of databases for which it is an administration server.

Rename person in Free Time Database

Triggered by: Completion of the “Rename person in Domino Directory” request.

Carried out on: The person’s home server.

Carried out: Immediately

Result: The person’s name is changed in the Calendaring and Scheduling Free Time Database.

Rename person in calendar entries and profiles in mail file

Triggered by: Completion of the “Rename person in Free Time Database” request.

Carried out on: The person’s home server.

Carried out: Immediately

Result: The person’s name is changed in their mail file’s Calendar Profile and appointment documents. If the person’s common name was changed and the common name is in the title of the mail file, the mail file title changes to reflect the new name. If the person is the “chair person” of any future meetings, the name is changed in those appointment documents.

Rename in Reader / Author Fields

Triggered by: Completion of the “Rename in Person documents” request on the administration server for the Domino Directory.

Carried out on: Each server in the domain.

Carried out: According to the “Delayed Request” setting for the Administration Process in the Server document.

Result: Each server in the domain updates the person’s name in Reader / Author fields of databases for which it is an administration server and that have the advanced ACL option “Modify all Reader / Author fields” selected.

Delete Obsolete Change Requests

Triggered by: Expiration of the period in which a person can accept a new name, by default 21 days. When you rename the person, you can change the expiration period.

Carried out on: The administration server for the Domino Directory.

Carried out: According to the “Execute once a day requests at” setting for the Administration Process in the Server document.

Result: The Administration Process deletes the word “Pending” from the Change Request field from the Person document."

ND6 adminp person rename process flow and comments:

Request Processed

What happens

Initiate Rename in Domino Directory

Carried out on the administration server for the Domino Directory. This request adds the"AdminpOld" fields in person doc.

Fail ? → Rename Person in Domino Directory

Carried out on: The administration server for the Domino Directory. This Request is posted to the admin4.nsf of the server that is first accessed and must be replicated back to the admin server. Successful processing of this request triggers the creation of all subsequent requests.

Fail ? → Rename in Person Documents

Carried out on: The administration server for the Domino Directory. This request must be processed to remove “AdminpOld” fields in person doc.

Rename Person in Unread List

Carried out on: Each server in the domain.

Rename in Access Control List

Carried out on: Each server in the domain.

Rename Person in Free Time Database

Carried out on: The person’s home server.

Rename Person in Calendar Entries and Profiles in Mail File

Carried out on: The person’s home server.

Rename in Reader / Author Fields

Carried out on: Each server in the domain.

Delete Obsolete Change Requests*

Carried out on: The administration server for the Domino Directory. This Request checks for AdminpOld and Change Request fields in the person docs.

AdminP Old Fields in person docs:

“AdminpOldCertificate”

“AdminpOldFirstName”

“AdminpOldLastName”

“AdminpOldMI”

“AdminpOldFullName”

“AdminpOldOwner”

“AdminpOldAltFullName”

“AdminpOldAltFullNameLanguage”

“AdminpOldInternetAddress”

“AdminpOldShortName”