Due to forces beyond my control, I have become the de facto Domino administrator at my company. Unfortunately, my background is in Notes/Domino development, and I am only really familiar with the more mundane elements of Domino administration–namely user and group management and things like that. Unfortunately, in my current capacity I am also still expected to be the company’s Notes developer as well.
I have been trying to figure out how to set up the CA process so that I can try and move account creation and password recovery to our help desk staff and leave me more time for more important administrative tasks, as well as my development work. I have printed all of the documentation I can find, but I have found it to be a bit lacking. So I was wondering if you kind folks could answer some questions for me.
If I enable the CA process and have not yet migrated my certifiers to the process, will my users no longer be able to authenticate?
The documentation states that you have to migrate cert.id to the CA process. The section on migrating OU and O certifiers links back to the document about migrating cert.id. Like I said, my background is not in administration, so am I right in thinking that the process is the same for both O and OU certs, and that cert.id = the O cert?
How does the CA process work for my existing users that I did not create using the CA process? Will there be any ramifications for enabling this process? I am already swamped with work as it is…I don’t need to go creating problems for myself.
If anyone has any of the answers to these questions, or any additional advice for setting up/maintaining the CA process, I am all ears. Any advice would be truly appreciated, since I am trying to avoid getting an ulcer here…
I am also a ‘developer + admin’ and have wanted to set up things like pw recovery and the CA process. The wrinkle here is that we don’t use Notes for mail. Mail can be created in Notes but exits Notes and goes off to Exchange land. It seems to me that a ton of the automated user admin stuff uses built in Notes mail features for receiving in updated id files etc. Is this true or am I totally missing how all this stuff works?
Subject: RE: Different slant on the question at hand
Using the CA process for password recovery requires the Router task running on the server with the CA process loaded, and it requires clients connect to the Domino server with a Notes client that is authenticated with an ID based on a certifier that has been migrated to the CA process. whew
The short answer is no, you don’t have to use Domino for mail, but you do have to be running the Router task (which does not necessarily also include SMTP) and people have to be using the Notes client.
Subject: RE: Different slant on the question at hand
Excellent! The router is running, people are using the client, not sure about the CA process and will need to migrate certs to the CA (when I have time…like any day now…or not…)
Subject: RE: Developer thrust into admin role trying desperately to understand the CA process
Charles,
thanks for the link…I think it answers most of my questions…but the one that’s most important still eludes me…can i enable this without effecting my users during the testing phase?
I need to justify this to the CIO, and unfortunately, he’s the former Notes admin that I am replacing…
Subject: RE: Developer thrust into admin role trying desperately to understand the CA process
I’m not sure how you would back out of this process, but there are no end user changes to be concerned about. Everything happens on the server, they will never know about it unless you tell them.
One thing that is important is that updated ID’s are only sent back when users connect to the server directly. If you have users who work in a disconnected state and only replicate, changes in their ID will never be sent back to the server. They have to connect to the server periodically.
Subject: RE: Developer thrust into admin role trying desperately to understand the CA process
Charles,
We don’t have any users that fit that bill. They all authenticate as connected users. I only have one user that works offline significantly, and he is a dwa user only.
Thanks for the input. I think I know what I need to know going forward.