I recently started writting some code to reset a Notes user’s password, and found out that there are at least 2 different passwords:
-
Notes ID password (Notes client password)
-
Internet password (HTTP password)
I believe what I was trying to do was what the Java API doc describes as a “HTTP password” change, but this isn’t what I need to do.
I am looking for a way to reset a Notes ID password, in the event for example, that a user forgets his or her password. I have been doing a lot of reading on Lotus Notes and Domino lately, and even contacted some people within IBM Lotus development group; The general consensus is that this might not be possible to accomplish, since my “program” would need to access a copy of each user’s Notes ID file before it can perform “ID Recovery”, of course assuming that such feature was enabled for all users. And I am still not clear on whether this can be done programmatically, which is how we must do it.
Does someone have any comments or input on this particular subject? I believe I read on some forum somewhere on the internet, that in the event that a user loses his or her ID file, there is no way to get access to their email or files on the server and they are lost forever? Is this true? Is the Lotus security model this strong?
Any suggestions are welcome…
Subject: Can a Notes ID file password be reset programmatically?
Yes, Notes security model is that strong! If you could alter the password programatically it would be pointless to have a password protected ID in the first place. we don’t mess with password recovery. Instead we choose to keep a copy of all user’s Notes ID’s with a known good password. If the user loses their ID or forgets their password we simply replace their ID with the one we have and give them the associated password.
Subject: RE: Can a Notes ID file password be reset programmatically?
Hi Raulfor same situations i’m using ID Manager software for Domino Its reaaly nice: this soft have ID vault and when it needed, you can regenerate ID without anything, additionally throught this software you can change passwords (ID and HTTP) and move users in ierarchy tree, if you want, i can upload trial version on my private internet page especially for you,
just FYI: in my domino network 49 domino servers and its delegated in too much countries, i’ve delegated access for request creation role to local admins and i’m just approving their request, then they receiving mail with reqsted ID or password
Subject: RE: Can a Notes ID file password be reset programmatically?
Hi Gennady,
Yes, I would be interested in seeing what this ID Manager does. Can you post a link to where I can download a copy? Thanks!
Subject: Can a Notes ID file password be reset programmatically?
To change password programmatically, search web and this forum for: SECKFMChangePasswordYou must of course have access to user’s ID file and know the user’s old password in order to change it to a new password. To somewhat automate the process, you can send out an email to the users, containing the code which prompts user for his old password and then changes it to a new password.
In case the user doesn’t remember his password, things get more difficult. I would not waste time and simply delete the user and then create a new user with the same name.
Try also to copy the database you want to open to your local Notes client and open it from there.
If you absolutely positively need to access an ENCRYPTED database, the only solution is to run a dictionary attack against the ID file hoping the user had a simple password, which can take more than 1 day and does not guarantee success.
/Andrei
http://dominounlimited.blogspot.com
Subject: Can a Notes ID file password be reset programmatically?
I’ll start with the easy part first. If someone loses their ID file or forgets the password the e-mail database is not locked out forever. Starting with Domino 6.0 you can configure “full access administration”, which gives an administrator access to every database on a server.
HOWEVER – if the user has a local replica of his mail and it is encrypted, the only way to recover that particular replica is with the ID file that was used to encrypt the file. If the ID is lost none of the databases encrypted with that ID can be accessed.
Okay, about the passwords. You are correct, there are two passwords. The Internet password is stored in the user’s Person document in the Domino Directory on the server. The user’s Notes password is in his or her ID file. You can easily alter the Internet password, but no facility exists to change the password in the ID file. You must use the “Extract Recovery Password” feature in Domino Administrator and enter it into the ID recovery dialog in the Notes client. As far as I know there is no way around this requirement and no way to automate it further.
Hopefully some will prove me wrong, though. I would love to make this more transparent for my users by offering them a website to go to that would at least give them the recovery password.