C.2 Global Configuration Values

Global configuration values (GCVs) allow you to specify settings for the Identity Manager features such as Password Synchronization and driver heartbeat, as well as settings that are specific to the function of an individual driver configuration. Some GCVs are provided with the drivers, but you can also add your own.

IMPORTANT:Password Synchronization settings are GCVs, but it’s best to edit them in the graphical interface provided on the Server Variables page for the driver, instead of the GCV page. The Server Variables page that shows Password Synchronization settings is accessible as a tab like other driver parameters, or by clicking Password Management > Password Synchronization, searching for the driver, and clicking the driver name. The page contains online help for each Password Synchronization setting.

In iManager:

  1. Click Identity Manager > Identity Manager Overview, then click Search to search for the driver set that is associated with the driver.

  2. Browse to the driver, then click the upper right corner of the driver icon.

  3. Click Edit Properties > Global Config Values. (See Table C-2.)

In Designer:

  1. Open a project in the Modeler, then right-click the driver line and select Properties > Global Config Values. (See Table C-2.)

For Password Configuration, you should only edit the first two settings listed in Table C-2. The others are GCVs regarding Password Synchronization that are common to all drivers. They should be edited by using iManager in Passwords > Password Synchronization, not here. Some of them have dependencies on each other that are represented only in the iManager interface. They are explained in Password Synchronization across Connected Systems in the Novell Identity Manager 3.5.1 Administration Guide .

Table C-2 Global Configuration Values > Password Configuration

Option

Description

Subscriber and Publisher Object Placement Settings

Subscriber: Default User sync source container in eDirectory

Specify the default user container in eDirectory where user changes are detected for synchronization in Lotus Notes. An example is Organization\OrgUnit\Users.

Publisher: Default User sync destination container in eDirectory

Specify the default user container in eDirectory where user changes are placed for synchronization in eDirectory. An example is Organization\OrgUnit\Users.

Subscriber: Default Group sync source container in eDirectory

Specify the default group container in eDirectory where group changes are detected for synchronization in Lotus Notes. An example is Organization\OrgUnit\Groups.

Publisher: Default Group sync destination container in eDirectory

Specify the default group container in eDirectory where group changes are placed for synchronization in eDirectory. An example is Organization\OrgUnit\Groups.

Lotus Notes Certifier Names and Parameter References

Fully Qualified Default Certifier Name

Specify the default Fully Qualified (typed) Notes Certifier name as found in the Notes Address Book. The root certifier can be used (an example is /o=acme).

Default Certifier Name

Specify the default Notes Certifier name as found in the Notes Address Book. The root certifier can be used (an example is /acme).

Default Certifier Driver Parameter Key

Specify the driver parameter key name that stores the default certifier ID file name. An example is cert-id-file.

Default Certifier Password Driver Parameter Key

Specify the driver parameter key name that stores the default certifier ID password. An example is cert-id-password.

Lotus Notes Add User Policy Settings

Add Notes User Certification Option

Select the desired Notes User Certification option. Select True to create a Notes Certification ID file for the user. Select False to not create the Notes Certification ID file. The default is True.

Add User: User ID File Creation

Select the desired Notes User ID file creation option. Select True to create an ID file when registering users. Select False to not create the ID file. The default is True.

Add User: Store User ID File in Address Book

Select the desired Notes User ID file option. Select True to place a Notes Certification ID file for the user in the Notes address book. Select False to not place the Notes Certification ID file in the address book. The default is False.

Add User: User ID Expire Term (in years)

Specify the expiration term (in years) for ID files created by the driver when certifying users who are added on the Subscriber channel. This number specifies how many years the user’s Certification ID file will be valid. The default is 2.

Add User: User ID Expiration Date

Specify an expiration date, or leave the field blank to ignore this setting. Specify the date when the user’s Certification ID file will expire. This entry has priority over the Expire Term entry.

Add User: Alternate Organization Unit

Specify an alternate Organizational Unit to be used for each registered user, or leave the field blank to ignore this setting.

Add User: Alternate Organization Unit Language

Specify an alternate Organizational Unit language to be used for each registered user, or leave the field blank to ignore this setting.

Add User: Notes Explicit Policy Name To Be Attached To User

Specify the desired Notes Explicit Policy Name to be attached to each registered user. When specified, registration policies are not executed.

Add User: Synchronize User’s Internet Password

Select the user’s Internet password option. Select True to synchronize the user password with the Web password. Select False to not synchronize user passwords. The default is True.

Add User: Notes User Password Check Setting

Select the desired option. Select Default to ignore this setting. Select Check Password to require users to enter a password when authenticating to servers that have password checking enabled. Select Don’t Check to not require users to enter a password when authenticating to other servers. Select Lockout to prevent users from accessing servers that have password checking enabled. The default is Check Password.

Add User: Notes User Password Change Interval (in days)

Specify the desired user password change interval in days. Specify a number to indicate the days a password is valid and before the user must supply a new password.

Add User: Notes User Password Grace Period (in days)

Specify the desired user password grace period in days. Specify a number to indicate the days the grace period is valid before the user must supply a new password.

Add User: Notes User’s Internet Password Change Required

Select the user’s Internet password change option. Select True to require users to change the password on the next login. Select False to not require users to change the password on the next login. The default is False.

Add User: Roaming Option

Select the desired Notes roaming user option. Select True to enable roaming for Notes users. Select False to disable roaming. The default is False. Selecting True brings up the next four options.

Roaming User: Roam Server Name

Specify the Domino server that will host this roaming user. An example is ( cn=ServerName/o=org)

Roaming User: Roam Server Subdirectory

Specify the Domino server subdirectory to store roaming user data. An example is Roaming\

Roaming User: Cleanup Setting

Select the Notes roaming user cleanup setting. Select Default to do nothing. Select Never to never delete roaming data. Select Every n Days to delete roaming data by the days specified by Roaming Cleanup Period. Select At Shutdown to delete Notes data when Notes shuts down. Select User Prompt to clean up roaming data when the user exits Notes; the user can also decline to be prompted in the future.

Roaming User: Cleanup Period (in days)

If Every n Days is selected as the Roaming User Cleanup Setting, specify the number of days before deleting roaming user data.

Add User: Create Unique Notes ShortName Field Value

If you want the Notes driver to generate a ShortName field value that is unique within the Notes Address Book, select True. Select False (default) to make no such attempt. ShortNames that are generated by selecting True use a combination of the Given Name and Surname and do not exceed eight characters in length.

Add User: Create Unique Notes InternetAddress Field Value

If you want the Notes driver to generate an Internet Address field value that is unique within the Notes Address Book, select True. Select False (default) to make no such attempt. Internet Address fields that are generated by selecting True use a combination of the Given Name, Surname, and the InternetDomainName GCV.

For example, if the user’s name is Glen Canyon and the InternetDomainName GCV is mycompany.com, the combinatioins will be GlenCanyon1@mycompany.com, GlenCanyon2@mycompany.com..., GlenCanyon10@mycompany.com, etc.

Lotus Notes E-mail Information

Internet Mail Domain

Specify the Internet Mail Domain to be used when generating Internet e-mail addresses. An example is mycompany.com.

Add User E-mail Box

Select the desired Notes user e-mail creation option. Select True to create a Notes e-mail account for a user. Select False to not create an e-mail account. The default is True.

Add User E-mail: Create Mail File in Background via AdminP

Select the desired Notes user e-mail creation option. Select True to create a mail file by issuing a request to the Domino administration process to create the mail file in the background through AdminP. Select False to create the mail file directly. AdminP support is required for this option. The default is False.

Add User E-mail: Inherit from Mail File Template

Select the desired Notes user e-mail database inheritance option. Select True in order for the user e-mail database to inherit changes from the specified creation template. Select False to not inherit changes. You specify the e-mail creation template through the Subscriber channel settings. The default is True.

Add User E-mail: E-mail Database ACL Setting

Select the desired Notes user e-mail database ACL option. Select Default to ignore this setting. Other options include Manager, Designer, Author, Editor, Reader, Depositor, and No Access. The default is Default.

Add User E-mail: Mail ACL Manager

Specify the Notes e-mail database Manager name. Leave this entry blank to allow e-mail access by the owner. If ACL access of the mail database is less than Manager, you need to specify an e-mail manager. Use the Plus icon to add names, the Minus icon to delete names, and the Pen icon to edit present entries.

Add User E-mail: Mail File Size Quota (in Kilobytes)

Specify the Notes e-mail database size quota in kilobytes. Leave blank to ignore this setting. The size specifies disk space that the server administrator allows for the e-mail database. If the Notes driver user is not a Domino server administrator, leave this value blank.

Add User E-mail: Mail FIle Size Warning Threshold (in Kilobytes)

Specify the mail file size warning threshold in kilobytes. Leave blank to ignore this setting. The size specifies disk space allowed before warning messages are sent to the database owner.

Add User E-mail: Mail File Replication

Select the desired Notes user e-mail file replication option. Select True to replicate the mail file of a user. Select False to not replicate the mail file. The default is False.

Lotus Notes Object Deletion Policy Settings

 

Lotus Notes Deny Access Group Name

Specify a Notes Deny Access Group as a placeholder for disabled users. An example is Deny Access.

Remove Notes Account

Select the method to remove Notes user accounts. Select Disable to place user into the Notes Deny Access Group. Select Delete to send the delete event to the Note server for deletion and removal from all groups (except for groups that are of the type Deny List). The default is Disable.

Selecting Delete brings up the next four options.

Remove User or Group Object from the Notes Address Book Immediately

Select whether to immediately delete the user or group object from the Notes address book. Select True to immediately remove the user or group from the address book. Select False to remove the user or group from the Notes address book through the background administration process. The default is True.

Add Deleted User Name To Deny Access Group

Select whether to add the deleted user name to the Deny Access Group. Select True to insert the user name into the group specified by DenyAccessGrpName. Select False to not insert the name. The default is True.

User Delete Mail File Action

Specify the mailfile deletion action when a user is deleted. Select All to have e-mail removed from the home mail server and all replica mail servers when the user object is deleted. Select Home to have e-mail removed from only the home mail server when the user object is deleted. Select None to preserve all e-mail when the user object is deleted. The default is None.

Delete Object: Tell AdminP Process Command

Specifies the Tell adminp Process command to immediately send to the Domino server after an object is deleted from the Domino Public Address Book. Options include No Action (default), All, New, Daily, Delayed, Interval, People, and Time.

Domino Administration Process Activation Command Settings

 

Add User: Tell AdminP Process Command

Select the AdminP process command to add a user. This specifies the Tell adminp Process command to send to the Domino server immediately after the user has been added to the Domino Public Address Book. Options include No Action (default), All, New, Daily, Delayed, Interval, People, and Time.

Modify User: Tell AdminP Process Command

Select the AdminP process command to add a user. This specifies the Tell adminp Process command to send to the Domino server immediately after the user has been modified using AdminP methods in the Domino Public Address Book. Options include No Action (default), All, New, Daily, Delayed, Interval, People, and Time.

User Password Policy Settings

 

Application accepts passwords from Identity Manager

If True, this option allows passwords to flow from Identity Manager to the connected system. The default is True.

Notify the user of password synchronization failure via e-mail

If True, notify the user by e-mail of any password synchronization failures. The default is False.

Selecting True brings up the next two options.

Default E-mail Notification User

Select the default user (administrator) to receive e-mail notifications. The user should have a valid Internet EMail Address attribute specified in the Identity Vault.

Password Synchronization policies are configured to send e-mail notifications to the associated user when password updates fail. The selected user receives a copy of each notification e-mail. Be sure to select a user who has proper authorization to review password update actions (such as a security administrator).

If the field is left blank, password synchronization notification e-mails are only sent to the affected user.

Connected System or Driver Name

Specify the name of the connected system, application, or Identity Manager driver. This value is used by the e-mail notification templates. An example is Notes.