SmartCloud Notes

Administering SmartCloud Notes: Hybrid Environment March 2015



SmartCloud Notes

Administering SmartCloud Notes: Hybrid Environment March 2015

 Note Before using this information and the product it supports, read the information in Chapter 11, “Notices,” on page 305. Contents

Chapter 1. Overview of SmartCloud Certifier requirements in a hybrid environment . . 37 Notes ...... 1 Version requirements for on-premises Domino What's new in SmartCloud Notes ...... 1 servers ...... 38 What's new for SmartCloud Notes administrators 2 Administrators can be notified of directory Chapter 3. Preparing your environment 39 synchronization errors ...... 2 Creating a certifier for your mail servers.....39 Administrators can set policies for Notes client Preparing your network ...... 40 archiving ...... 2 Preparing passthru servers ...... 40 Administrators can restore deleted user Preparing the firewall ...... 41 accounts ...... 2 Configuring the firewall for inbound What's new for SmartCloud Notes users ....3 connections ...... 41 Invitee status viewable by meeting chair on Configuring the firewall for outbound Notes Traveler devices ...... 3 connections ...... 42 More Windows devices are supported for How NRPC connections are made in a hybrid Traveler ...... 3 environment ...... 44 Notes Traveler 9.0.1.1 features are available . . 3 Preparing for directory synchronization .....45 Notes Traveler 9.0.1.2 features are available . . 4 Setting up directory synchronization servers . . 45 Setup improvements for the Notes Traveler Preparing to replicate Domino directories . . . 47 Android client ...... 5 Preparing to replicate an extended directory Enhancements to supported email encoding catalog ...... 48 standards for inbound internet mail ....5 Preparing Global Domain documents...... 49 Accessibility ...... 5 Preparing for mail routing ...... 52 Using SmartCloud Notes in a hybrid environment. . 5 Setting up mail hub servers in the on-premises User experience in a hybrid environment ....7 hub domain ...... 52 Company administrator experience in a hybrid Preparing to route mail from service users . . . 53 environment ...... 8 Preparing to route mail from service users to SmartCloud Notes clients ...... 9 on-premises users and devices ...... 53 Web client ...... 10 Preparing to use a company SMTP server to Traveler devices ...... 10 route outbound Internet mail ...... 54 Notes client ...... 11 Preparing to route mail to service users ....55 IMAP client ...... 12 Preparing to route mail to service users BlackBerry devices with a Hosted BlackBerry registered in the on-premises hub domain . . 55 Services subscription ...... 12 Preparing to route mail to service users in a Feature differences between Notes and Domino and secondary domain ...... 57 the SmartCloud Notes service ...... 12 Examples: Routing internal mail ...... 60 Frequently asked questions about administering the Example: Routing mail between users in the service ...... 13 on-premises hub domain ...... 60 Information resources ...... 15 Example: Routing mail between users in a secondary domain ...... 62 Chapter 2. Planning to deploy the Example: Routing mail between users in service...... 17 different Domino domains ...... 65 Examples: Routing external mail ...... 68 Planning security ...... 17 Example: Routing mail from an external user Planning network connections ...... 19 to a service user ...... 69 Network capacity for the web client .....20 Example: Routing mail from a service user to Network capacity for the Notes client ....20 an external user using a service SMTP host. . 70 Planning directory services ...... 21 Example: Routing mail from a service user to Requirements for synchronized directories . . . 22 an external user using a company SMTP host . 71 How directory synchronization works ....26 Preparing for calendars and scheduling .....73 How the service resolves duplicate Person Example: Free-time requests between users in the documents...... 28 on-premises hub domain ...... 75 Planning mail routing and mail settings .....29 Example: Free-time requests between users in Planning calendars and scheduling ...... 31 different domains ...... 78 Planning free-time requests in a hybrid Helping service users connect to application servers environment ...... 35 in secondary domains ...... 81 Resource reservations in a hybrid environment 36

© Copyright IBM Corp. 2011 iii Chapter 4. Configuring the service. . . 83 Restricting the IP address range ...... 138 Roadmap to configuring a hybrid environment . . 83 Enabling application passwords ...... 139 Logging on as the first company administrator . . 86 Authentication methods by client...... 141 Completing a checklist to prepare for configuration 87 Password rules by authentication method . . . 141 Configuring your hybrid account settings ....89 Configuring the name finder ...... 142 Configuring directory synchronization ....89 Standard and Advanced Name Finder options 145 Specifying a mail routing server ...... 90 Adding photos to Person documents ....147 Creating a base name for your mail servers. . . 91 Basic name finder illustration ...... 148 Specifying one or more passthru servers....91 Basic Quick Search Only name finder Providing a certifier ID file ...... 92 illustration ...... 149 Using the Pre-configuration Test tool to check your Standard name finder illustration...... 151 environment ...... 93 Advanced name finder illustration .....152 Reviewing your setup and enabling your account 94 Browse corporate hierarchy name finder Downloading and running the Domain illustration ...... 153 Configuration tool ...... 94 Configuring mail settings ...... 154 Verifying Internet domains ...... 97 Changing the size limit for incoming messages 154 Activating your account ...... 99 Prevent automatic forwarding of messages . . 154 Running configuration tests ...... 99 Specifying how Notes links display in the web Completing the configuration ...... 100 client ...... 155 Checking network connections from Configuring how long mail remains in the Trash on-premises servers to the service .....100 folder ...... 156 Issuing a Vault Trust Certificate ...... 101 Deleting older email and meetings .....157 Enabling the ActiveX control for Internet Chapter 5. Customizing service Explorer users ...... 159 settings ...... 103 Specifying an SMTP server to route mail to the Internet ...... 160 Enabling the accessible experience for the web Preparing to use custom mail file templates . . . 161 client ...... 103 Handling execution security alerts caused by Setting up administration notifications .....103 custom templates ...... 162 Restricting access to groups ...... 104 Configuring mail file templates ...... 164 Using administrative policies ...... 105 Using extension forms files to customize the look Creating policies for service users .....105 of the web client ...... 165 Creating an archiving policy settings Extension forms file requirements .....167 document ...... 106 Preparing customized mail file ACLs .....168 Policy precedence ...... 112 Enabling busytime details in calendars .....170 Policy settings restrictions ...... 114 Configuring instant messaging ...... 171 Archiving Settings restrictions ...... 114 Configuring the web client to connect to an Desktop Settings restrictions ...... 114 on-premises Sametime community .....172 Registration Settings restrictions .....115 Manually configuring Notes clients to connect Mail Settings restrictions...... 115 to the service instant messaging community . . 175 Security Settings restrictions ...... 117 Instant messaging features ...... 176 Roaming Settings restrictions ...... 118 Configuring IMAP access ...... 178 Notes Traveler Settings restrictions ....118 IMAP client limitations ...... 180 Using Desktop Settings to configure managed Logging activity in journal files ...... 180 mail replicas...... 120 Downloading journal files ...... 181 Configuring logins ...... 124 Format of the Notes mail journal file ....182 Resetting service login passwords .....124 Format of the Notes client session journal file 184 Setting service login password expiration . . . 124 Managing Notes IDs ...... 125 Chapter 6. Onboarding users ....187 Resetting passwords for Notes IDs ....125 Setting password expiration for Notes IDs 126 Choosing a client deployment strategy .....187 Enabling password synchronization ....128 Deciding whether to use the Notes client . . . 188 Notes IDs and passwords ...... 130 Deciding whether to transfer mail files ....189 Limitations when Notes IDs are not in the Preparing for onboarding ...... 191 vault ...... 131 Preparing for the web client ...... 193 Setting up federated identity management. . . 132 Preparing for Notes Traveler devices ....195 SAML federated identity concepts ....133 Preparing for Notes clients ...... 196 Preparing for federated identity management 135 How the Client Configuration tool configures Enabling federated identity management . . 136 the Notes client...... 199 Configuring the Sametime rich client for Downloading Notes client software and other SAML and downloading ...... 136 entitled software ...... 201 iv SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Connecting to cloud Activities through the Viewing assigned mail file templates .....247 Notes client sidebar ...... 202 Language versions of the standard mail file Preparing for IMAP clients ...... 202 template ...... 248 Preparing to use BlackBerry devices .....203 Assigning extension forms files to users ....248 Settings enforced for BlackBerry smartphones 205 Setting a default extension forms file ....249 Preparing communications and training . . . 206 Explicitly assigning an extension forms file to Adding multiple Internet email addresses to many current users ...... 250 Person documents ...... 207 Explicitly assigning an extension forms file to Mail file quota ...... 207 individual current users ...... 251 Mail file delegation ...... 208 Resetting service login passwords ...... 252 Transferring mail files ...... 209 Resetting passwords for Notes IDs ...... 253 Preparing for mail file transfer ...... 209 Changing a Notes user name ...... 255 Preparing the staging server ...... 209 Rules to follow when you change a Notes name 257 Preparing mail file ACLs before mail file Changing an Internet email address ...... 258 transfer ...... 212 Removing a SmartCloud Notes subscription from a Preventing local database encryption in new user account...... 259 mail file replicas ...... 212 Suspending a user account ...... 260 Importing IDs into mail files ...... 212 Deleting a user account ...... 261 Scanning mail files for viruses ...... 213 Restoring a deleted user account ...... 263 Transferring mail files with help from an IBM Permanently deleting a user account .....263 partner ...... 213 Removing the SmartCloud Notes data for a deleted How the transfer manager creates a mail file user account or subscription ...... 264 transfer request...... 214 Moving users to different Domino directories . . 265 Transferring mail files to the service data Converting a service user to an on-premises user in center ...... 215 a hybrid environment ...... 267 Provisioning users...... 218 Uploading a Notes ID to the vault ...... 269 Provisioning users without transferring mail Viewing subscriptions ...... 271 files ...... 219 Viewing assigned subscriptions ...... 271 Registering a new user on-premises ....222 Managing IBM Notes Traveler devices .....272 Provisioning users and mail files ...... 224 Managing BlackBerry smartphones ...... 274 Deleting on-premises mail files .....228 Reactivating a user's BlackBerry smartphone 274 Decommissioning on-premises mail servers 228 Wiping a user's BlackBerry smartphone if it is Checking user provisioning status ...... 229 lost or stolen ...... 276 Helping users get started ...... 230 Setting a device password on a user's Providing account information to users....231 BlackBerry smartphone ...... 277 Getting started with the web client .....232 Removing a BlackBerry subscription from a user Getting started with the Notes Traveler devices 233 account ...... 278 Adding a Notes Traveler subscription to a Frequently asked questions about BlackBerry user account...... 234 smartphone administration ...... 278 Removing user accounts from on-premises Notes Traveler servers ...... 235 Chapter 8. Integrating a single domain Getting started with the Notes client ....237 (Example) ...... 281 Getting started with IMAP clients .....237 Preparing the on-premises environment (Example) 281 Getting started with BlackBerry devices . . . 238 Preparing the on-premises directory Accepting the Research In Motion terms of synchronization and mail hub servers (Example) 282 use...... 238 Preparing the on-premises passthru server Adding a BlackBerry subscription to a user domain (Example)...... 282 account ...... 238 Configuring firewalls (Example) ...... 283 Removing user accounts from an on-premises Preparing the Global Domain document BlackBerry Enterprise Server ...... 239 (Example) ...... 284 Activating a user's BlackBerry smartphone 239 Creating the certifier and names for mail servers Ensuring that mail encryption is available for (Example) ...... 285 BlackBerry smartphone users ...... 241 Configuring the service (Example) ...... 286 Providing documentation to your BlackBerry Completing an account settings worksheet smartphone users ...... 242 (Example) ...... 286 Configuring account settings (Example) . . . 287 Chapter 7. Administering user Downloading and running the Domain accounts ...... 243 Configuration tool (Example) ...... 287 Best practices for maintaining your on-premises Verifying the Internet domain name (Example) 288 environment...... 243 Testing network connections (Example)....289 Changing user mail file templates ...... 246 Issuing a Vault Trust Certificate (Example) . . 289

Contents v Example illustrations ...... 290 Finding troubleshooting tips in the Support Portal 303 Directory synchronization at Renovations . . . 290 Contacting Support ...... 303 Service user sending Notes mail to an on-premises user ...... 291 Chapter 11. Notices ...... 305 On-premises user sending Notes mail to a Trademarks ...... 306 service user ...... 292 Privacy policy considerations ...... 307 Service user receiving Internet mail .....294 Service user sending Internet mail .....294 Index ...... 309 Service user requesting the free time of an on-premises user ...... 295 On-premises user requesting free time of a service user ...... 296 Service user requesting the free time of a resource ...... 297 Service user reserving a resource ...... 299

Chapter 9. Integrating additional domains ...... 301

Chapter 10. Troubleshooting the service ...... 303 Using the Configuration Test tool...... 303

vi SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 1. Overview of SmartCloud Notes

IBM SmartCloud® Notes® is a multi-tenant cloud mail service. When you use the service, administrators at IBM® set up and maintain IBM Domino® mail servers for you in the cloud on external IBM servers. The service offers you the benefits of Domino mail server security features and architecture without the mail server maintenance overhead.

Using the following clients, users connect to the SmartCloud Notes service over the Internet to access their mail: v Web client through a browser interface available at http://www.ibmcloud.com/ social; v Notes; v Mobile devices.

Any combination of these clients can be used.

At least one person at a company is designated as a company administrator. A company administrator has a user account with the Administrator role and is responsible for configuring the service and administering user accounts.

The SmartCloud Notes service provides various options that are designed to help you deploy the service in a way that best satisfies your business needs. v You can deploy the service with the assistance of an IBM Software Services for Collaboration representative or a certified IBM Business Partner. Whether you choose this option depends on factors such as the type of SmartCloud Notes environment you deploy and your in-house IT expertise and priorities. v You can choose from a list of standard mail file templates that are available within the service by default, or develop a custom template for your company. You can develop a custom template in-house or contract with an IBM or a third-party representative to develop the template. Approval of a custom template requires a short service engagement with IBM Software Services for Collaboration. v A Notes Traveler subscription is available automatically. This subscription enables users to access the service through supported mobile handheld devices. Note that the ultra-light mode of the web client supports the use of some mobile devices for no additional purchase. v If you purchase a SmartCloud Notes for Hosted BlackBerry® Services subscription, users can access the service through BlackBerry® smartphones. To use BlackBerry® 10 devices, use Notes Traveler instead. v If you purchase the Connections Archive Essentials subscription, the content of user email can be captured and retained for later legal discovery. For more information about this service, see the Using Connections Archive Essentials documentation.

What's new in SmartCloud Notes The following features and enhancements are new in IBM SmartCloud Notes.

© Copyright IBM Corp. 2011 1 What's new for SmartCloud Notes administrators The following features are new for IBM SmartCloud Notes administrators. Administrators can be notified of directory synchronization errors Administrators can configure the service to send email notifications if directory synchronization errors occur.

Administrators specify the addresses of one or more people to receive the notifications. A notification describes the error and provides a link to information about how to resolve it. Related tasks: “Setting up administration notifications” on page 103 Set up the service to send email notifications that report when specific types of errors occur in the service. Administrators can set policies for Notes client archiving In hybrid environments, administrators can now use Archive Settings in policies to set standard archiving behavior for Notes client users.

Mail archiving is run on the Notes client. Users can archive local mail replicas or managed mail replicas and create the archives on the client or on-premises servers. Users cannot create archives on cloud servers.

For more information, see the section Customizing service settings > Using administrative policies.

Administrators can restore deleted user accounts Administrators have 30 days to restore user accounts after deleting them. The accounts are restored with complete functionality, including mail file access. Related tasks:

2 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 “Deleting a user account” on page 261 When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality. “Restoring a deleted user account” on page 263 After you delete a user account, you have up to 30 days to restore it if you change your mind. Restoring the account returns it to full functionality, including full mail file access. What's new for SmartCloud Notes users The following features are new for IBM SmartCloud Notes users. Invitee status viewable by meeting chair on Notes Traveler devices Invitee status display is now supported on Apple, BlackBerry 10, Windows Phone, Windows Tablet, and Android devices. The meeting chair can view the status of each invitee's response to the current version of the meeting. Possible statuses are accepted, tentative, declined, and no response. Additionally, the Android client can show a status of delegated. More Windows devices are supported for Traveler IBM SmartCloud Notes Traveler users can now use Windows Phone and Windows Tablet (Windows Pro and Windows RT) devices with the service. There is no need to install client software on these devices to use them with the service.

For device requirements, see the SmartCloud Notes client requirements. Related information:

SmartCloud Notes client requirements

Using Notes Traveler documentation Notes Traveler 9.0.1.1 features are available The IBM Notes Traveler 9.0.1.1 client provides the following new features:

Calendar improvements for Android clients Local calendar information displays in IBM Notes Traveler calendar You can now add the information from your local device calendars into your IBM Notes Calendar view. Create calendar events from mail messages You can now create a calendar event while viewing mail, using the overflow menu. Calendar events created from mail messages will form with the invitees populated with the message recipients, and the event details information pre-filled with the content of the mail.

Interface improvements for Android clients Action bar The action bar is a mobile feature that identifies your location within IBM Notes Traveler, as well as provides action icons and navigation modes. Navigation drawer for mail The navigation drawer is a panel that slides in from the left of the screen to display IBM Notes Traveler's main navigation options. For mail, the

Chapter 1. Overview of SmartCloud Notes 3 navigation drawer displays your user account and mail folders (inbox, outbox, sent, and personal). The navigation drawer is only available from the parent list view of a mail folder. Android Contacts application IBM Notes Traveler on Android now provides its own dedicated Contacts application, rather than utilizing the device Contacts application. New mail item list layout with thumbnail photos The mail item list has been redesigned to make it easier to consume the sender, subject, and message body where applicable. If the screen is wide enough, a person thumbnail image displays using the sender's mail address to search for available photos, either from local contacts, IBM Notes Traveler contacts, or from the new Sametime® Integration feature. New mail list selection mode A new selection mode overlays a 'Contextual Action Bar' over the existing action bar, showing the number of selected items. It also provides batch operations on the selected items, such as: Move to Folder, Discard, Mark as Read, or Mark as Unread. Only the actions which are applicable to all selected items displays. Gesture actions for mail and contacts To quickly act on mail items in a list or take action on a contact, you can now swipe the item from right to left to display a list of action buttons without having to open the mail or contact itself. Available on phones with Android 3.0 (Honeycomb) and above. Add to Contacts from mail When viewing a mail item, you can now add the sender to your contacts. Mail list person actions You can now tap a user photo from a mail message and see a list of possible actions to take with that person. The actions available depend on the information available for the person. If there is a mail address associated with the person, you can perform the following actions: v View the person's IBM Connections Profile (only if IBM Connections mobile is installed) v Chat with the person (only if IBM Sametime mobile chat is installed and connected) v Mail the person (opens the Android mail selection dialog). If there is at least one phone number associated with the person, and your device is a phone, you can also call and text the person directly. These options are only available where a person photo displays: mail, calendar and contacts. Notes Traveler 9.0.1.2 features are available The IBM Notes Traveler 9.0.1.2 client provides the following new features.

New reply options for mail messages in Android devices

When replying to a mail message on Android devices, you can now choose to reply with or without message history and attachments.

4 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Add Notes Traveler contact from a phone number

On Android phones that support the option, you can now choose to make a new Notes Traveler contact from a phone number. Setup improvements for the Notes Traveler Android client When setting up a new IBM Notes Traveler Android 9.0.1.3 client, you are no longer required to type in your datacenter URL to connect to the service. You are now automatically connected to the correct data center based on your login identity. Enhancements to supported email encoding standards for inbound internet mail IBM SmartCloud Notes web and IBM Notes Traveler clients now support the RFC 2231 standard for inbound Internet email.

This standard provides email improvements, including the correct display of attachment file names that are specified in character sets other than US-ASCII.

The service supports the new standard for incoming messages that are encoded to support RFC 2231. The RFC 2231 encoding is retained when a recipient replies to or forwards a message. The service does not use the new encoding in new outbound messages.

Accessibility IBM SmartCloud Notes Administration, the interface that is used to administer SmartCloud Notes, is accessible.

The version of this documentation that is in the Knowledge Center is accessible.

All OS level keystrokes for accessibility are recognized. For the best accessibility experience, use a version of Mozilla Firefox supported by the service and the latest version of the JAWS screen reader.

See the IBM Human Ability and Accessibility Center for more information about the commitment that IBM has to accessibility. Related tasks: “Enabling the accessible experience for the web client” on page 103 You can submit a request to enable the accessible experience for the web client for everyone in your organization. Mail, Calendar, Contacts, and Preferences features provided with this experience are all accessible. Related information:

System Requirements

Knowledge Center documentation

Using SmartCloud Notes in a hybrid environment When you deploy the IBM SmartCloud Notes service in a hybrid environment, it functions as a virtual extension of your on-premises IBM Domino domain configuration. With a hybrid environment, company administrators continue to manage users and groups using the on-premises tools with which they are familiar.

Chapter 1. Overview of SmartCloud Notes 5 Mail routing and directory synchronization between your on-premises servers and the SmartCloud Notes service occur through an on-premises hub domain. You designate at least one server in the domain as a directory synchronization server to handle replication of Domino directories in your environment to the service. You also designate at least one mail routing server to handle mail routing between on-premises servers and the service.

Note: Routing of incoming Internet mail addressed to users in the service is configured and done on-premises. The SmartCloud Notes service performs outbound Internet mail routing only.

You can have a combination of on-premises users (users with mail servers at the company site) and service users who use SmartCloud Notes mail servers. The two groups of users can communicate by Notes mail, look up each other's free time, reserve shared rooms and resources, and schedule meetings with each other.

If you have Domino application servers on-premises, service users can access Domino applications in the same way they did before using the service. A customer provides a unique organizational unit (OU) certifier ID to be used for their SmartCloud Notes mail servers. This OU certifier is within the trust hierarchy of both the service users and the on-premises Domino application servers. Therefore a service user's Notes ID provides access to both the SmartCloud Notes mail servers and the on-premises application servers.

In the following illustration, Dan Misawa is a service user at the fictional company Renovations. His Notes ID, which is certified under /Renovations, enables him to access his SmartCloud Notes mail servers, which are certified under the OU /SMC/Renovations. He can also continue to access an on-premises Domino application server which is certified under /Renovations.

6 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Inbound connections from the service to the customer's on-premises environment occur via a passthru server domain in the customer's demilitarized zone (DMZ). The passthru servers authenticate SmartCloud Notes servers and allow passthru connections only for those servers with IDs that are certified by the OU certifier you provide.

SmartCloud Notes provides a Domain Configuration tool that you configure and then download and run on-premises. The tool creates all the Domino Directory documents in the passthru domain and the on-premises hub domain that are required for communication between on-premises servers and the service. User experience in a hybrid environment In a hybrid environment, the experience of service users and on-premises users is similar.

Chapter 1. Overview of SmartCloud Notes 7 v A service user's IBM Notes ID provides access to both on-premises IBM Domino application servers and IBM SmartCloud Notes mail servers. A Location document and Connection document added to Notes clients enables the clients to connect to the mail servers. v Existing Notes client bookmarks and links to Domino application servers work without modification. v A service user can look up the people, groups, and mail-in databases in any on-premises Domino directory that has been replicated to the service through directory synchronization. v A service user can look up names in a Domino directory indirectly, for example, by clicking To in a mail memo. The user cannot use File > IBM Notes Application > Open to open the directory, however. Service users who use the Notes client and who have a collaboration subscription can access both service Activities and on-premises Activities through the client sidebar. Company administrator experience in a hybrid environment IBM administrators maintain user mail servers in the service. Company administrators administer service users.

Company administrators continue to perform many user administration tasks on-premises with familiar tools such as the Domino Administrator client. Some tasks are performed through web administration features in the service at http://www.ibmcloud.com/social. To use the administration features, a company administrator logs on to the service using an account name that is assigned the Administrator role. Table 1. Tasks to administer service users in a hybrid environment Task Where task is performed Additional information Adding users to the service On-premises and through “Provisioning users” on page http://www.ibmcloud.com/ 218 social

Deleting users from the On-premises and through v See the topic about service http://www.ibmcloud.com/ deleting a user in the social Domino documentation. v “Removing a SmartCloud Notes subscription from a user account” on page 259 v “Deleting a user account” on page 261 v “Removing the SmartCloud Notes data for a deleted user account or subscription” on page 264 Adding and managing On-premises See the topic about using groups groups in the Domino documentation. Changing the Notes names On-premises and through “Changing a Notes user of service users http://www.ibmcloud.com/ name” on page 255 social Configuring policies On-premises, with a few “Creating policies for service restrictions users” on page 105

8 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 1. Tasks to administer service users in a hybrid environment (continued) Task Where task is performed Additional information

Managing Notes ID On-premises through policies v “Resetting passwords for passwords. and through Notes IDs” on page 125 http://www.ibmcloud.com/ v social “Creating policies for service users” on page 105 v “Setting password expiration for Notes IDs” on page 126 Selecting mail file templates http://www.ibmcloud.com/ “Configuring mail file for mail files social templates” on page 164

Configuring service-specific http://www.ibmcloud.com/ v “Configuring mail mail settings social settings” on page 154 v “Specifying an SMTP server to route mail to the Internet” on page 160 Configuring IMAP access http://www.ibmcloud.com/ “Configuring IMAP access” social on page 178 Configuring instant http://www.ibmcloud.com/ “Configuring instant messaging social messaging” on page 171

Managing mobile devices if a http://www.ibmcloud.com/ v “Managing IBM Notes Notes Traveler for Notes social Traveler devices” on page subscription is purchased 272 v “Creating policies for service users” on page 105 Managing BlackBerry® http://www.ibmcloud.com/ “Managing IBM Notes smartphones if a SmartCloud social Traveler devices” on page Notes for Hosted 272 BlackBerry® Services subscription is purchased. Configuring mail archiving http://www.ibmcloud.com/ Using Connections Archive to allow email retrieval for social Essentials legal purposes if an IBM Connections Archive Essentials Cloud subscription is purchased

Related tasks: Chapter 4, “Configuring the service,” on page 83 After you have prepared your on-premises environment, configure the service to work with your environment. “Completing the configuration” on page 100 After you have completed the account setup for your organization, perform the tasks in this section to complete the configuration.

SmartCloud Notes clients IBM SmartCloud Notes clients provide mail, personal Information Management features such as calendars, contacts, and to do lists, and with some clients, integrated collaboration features, such as embedded chat.

Chapter 1. Overview of SmartCloud Notes 9 Web client The IBM SmartCloud Notes web client provides access to mail servers through a browser.

The web client is a hosted mail client; there is no client for users to install. Users simply log on to http://www.ibmcloud.com/social using their service login email address and password. The service authenticates the client and then the client is redirected to the mail file in the service. User can access the web client in either of these ways: v On a computer -- after logging on, users click Mail. v On a mobile device -- users point the browser on the device to the service, and then log on to the ultra-light mode.

Users need a subscription for either SmartCloud Notes or SmartCloud Notes Entry to use the web client. Each subscription provides a full mail client with mail, calendar, and contacts, as well as to do and notebook applications. Each subscription provides access to the service through either full or ultra-light mode. v Full mode -- The full mode offers the widest range of features including mail, contacts, calendar and scheduling, as well as notebook and to do tasks. v Ultra-light mode -- The ultra-light mode is available at no extra cost on a mobile device, and on a personal computer. There is no additional setup or client install on the mobile device required. Users simply point their device browser to https://www.collabserv.com to access their mail. The ultra-light mode supports Android, as well as Apple iPhone, iPod Touch, and iPad devices. See the client requirements for details on the supported levels of device operating systems. Decide which web client subscription best fits your needs. The SmartCloud Notes Entry subscription includes many of the same features that are available with the standard SmartCloud Notes subscription, but with the following limitations: v Users are provisioned with a new mail file. There is no data migration of an existing mail file. v Users cannot access mail using either the Notes client or an IMAP client. v Users cannot access mail using Blackberry smartphones. v User mail files havea1GBquota.

For a list of browsers supported for use with the web client, see the client requirements. Related tasks: “Preparing for the web client” on page 193 Before you provision users who will access IBM SmartCloud Notes using the web client, prepare for the web client. Related information:

SmartCloud Notes client requirements

Using the web client Traveler devices A Notes Traveler subscription supports Apple, Android, Windows Phone and Windows Tablets, Windows Mobile, and BlackBerry® 10 devices.

See the device requirements for details on the supported levels of device operating systems. To get started, users perform simple steps to install and configure Notes

10 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Traveler on their devices using the installation and configuration information in the SmartCloud Notes product documentation for their specific device. Related tasks: “Preparing for Notes Traveler devices” on page 195 Before enabling users to use IBM Notes Traveler mobile devices with the service, prepare your environment and the devices. Related information:

Notes Traveler device requirements

Using Notes Traveler Notes client Use of the IBM Notes to connect to the service is optional. A IBM SmartCloud Notes subscription entitles you to the Notes client license.

Users who access mail by using a Notes client can take advantage of the many collaboration features that are available through the client. As with the web client, the Notes client provides mail, calendar, and contacts, as well as to do and notebook applications. You can manage your Inbox using full-text search, delegation, mail filtering and sorting, conversation views, and flags.

The following features and applications are also available to you when you use the Notes client. v Activities - Beginning with Notes 8.5.2, if your organization has a collaboration subscription, then the sidebar is automatically configured to access Activities in the service without further authentication. v IBM Sametime - Use the embedded Sametime client to manage instant messaging contacts and initiate chats. v RSS feeds - Subscribe to RSS feeds that display in the sidebar. v Widgets - Add widgets to the sidebar. Widgets are available only in hybrid environments in which they are deployed through company servers. v Create and manage IBM Notes applications - Using Notes templates, create and manage Notes applications, such as teamrooms, or discussion databases. Notes applications on servers are only available through on-premises company servers.

Keep the following in mind if your users will use the Notes client: v SmartCloud Notes supports only the standard configuration of Notes, and not the basic configuration. v You should decide which supported version of the client to use in your environment. See the SmartCloud Notes client requirements for information on supported versions. Related tasks: “Preparing for Notes clients” on page 196 Use of the IBM Notes client to connect to the service is optional. If you want your users to use the Notes client, understand the steps to prepare. Related information:

SmartCloud Notes client requirements

Using Notes

Chapter 1. Overview of SmartCloud Notes 11 IMAP client If you enable IMAP access, users can configure third-party email clients to access mail in the service.

The following IMAP clients are supported: v Apple email v Microsoft Outlook 2003, 2007 v Thunderbird There is no additional charge or subscription required to use IMAP clients. Related tasks: “Preparing for IMAP clients” on page 202 If you plan to use IMAP clients, complete these tasks to prepare. BlackBerry devices with a Hosted BlackBerry Services subscription If your company has an IBM SmartCloud Notes for Hosted BlackBerry® Services subscription, users can use BlackBerry® smartphones to access mail and personal information management features.

IBM administrators set up and maintain BlackBerry Enterprise Servers for you on sites that they manage. The Blackberry subscription provides the following features: v Mail, Calendar, Task, To Do, and Contact applications v Corporate directory lookup v Smartphone management through http://www.ibmcloud.com/social. This subscription does not support BlackBerry® 10 devices. Those devices are supported by IBM Notes Traveler. Related tasks: “Preparing to use BlackBerry devices” on page 203 If you plan to use BlackBerry devices that are supported by a Hosted BlackBerry Services subscription, complete these tasks to prepare.

Feature differences between Notes and Domino and the SmartCloud Notes service Some features in IBM Notes, IBM iNotes®, and IBM Domino are unavailable or have limitations within the IBM SmartCloud Notes service.

For an explanation of the differences, see the following article in the IBM Connections Cloud wiki: Feature differences between Notes and Domino and the SmartCloud Notes service.

12 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Frequently asked questions about administering the service The following table provides answers to questions frequently asked about the tasks that company administrators perform in a IBM SmartCloud Notes environment. Table 2. Frequently asked questions about administering SmartCloud Notes Question Answer Do company administrators have access to By default, administrators do not have user mail files? access to user mail files. However, new users can be provisioned with mail files that have customized access control lists (ACLs). In addition, the mail delegation feature can be used to delegate management of a mail file to an administrator or to a group of administrators. For more information, see “Preparing customized mail file ACLs” on page 168 and “Mail file delegation” on page 208. Do mail files have a size limit? Currently a size limit (quota) of 25 GB is enforced on most mail files. An exception is the mail files of SmartCloud Notes Entry users, whose mail files havea1GBlimit.

For more information, see “Mail file quota” on page 207. What options are available for managing Company administrators can manage the mail file size? size of mail files by setting limits on the size of incoming messages. Additionally, they can specify how long mail remains in mail files by enabling automatic mail deletion for older mail. For more information, see “Configuring mail settings” on page 154. Can we use a customized mail file template? Yes, company administrators can apply a customized template to user mail files. This is done through SmartCloud Notes Administration. The template must meet specific design requirements. A representative of IBM Software Services for Collaboration must approve it as part of a short consulting services engagement. For more information, see “Preparing to use custom mail file templates” on page 161.

Chapter 1. Overview of SmartCloud Notes 13 Table 2. Frequently asked questions about administering SmartCloud Notes (continued) Question Answer Can users create local replicas of their mail In a hybrid environment, administrators can files? provide local access by using policies to enable the managed mail replica feature. This feature creates automatically a local cached version of user mail files. For more information, see “Using Desktop Settings to configure managed mail replicas” on page 120.

Although managed mail replicas are recommended, as an alternative, users can create local replicas of their mail files and schedule replication between the local replicas and the server replicas. For more information about creating local replicas, see Getting started with replication in the Notes documentation. Are company administrators responsible for No, compacting and other mail database mail database maintenance? maintenance tasks are handled within the service for you. In a hybrid environment, do company Yes, the tasks to administer service users administrators manage service users through and on-premises users primarily are the an on-premises IBM Domino Administrator same. Some differences are: client and on-premises Domino servers? v You must use explicit policies when applying policy settings to service users; v The ID vault tool in the Domino Administrator is not used to manage the Notes ID files of service users; v some administration tasks, for example, Notes ID file password resets, are done through the SmartCloud Notes Administration, which is accessed through the IBM Connections Cloud website at http://www.ibmcloud.com/social. For more information, see Chapter 7, “Administering user accounts,” on page 243. How does a company administrator change In a hybrid environment, company a user's Notes name? administrators change the Notes name in the on-premises Domino directory using the Domino Administrator client, as they do for on-premises users. The name change replicates to the service during directory synchronization. To change a user's service web login name, company administrators edit the user account in the service.

For more information, see “Changing a Notes user name” on page 255.

14 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 2. Frequently asked questions about administering SmartCloud Notes (continued) Question Answer How do I reset a user's password? There are two passwords. One is the service login password that is used to log on to the IBM Connections Cloud website at http://www.ibmcloud.com/social. Another is the Notes ID password used to log in to mail servers through Notes. Reset the service login password through the service user account. Reset the Notes ID password through the SmartCloud Notes Administration. For more information, see “Resetting service login passwords” on page 124 and “Resetting passwords for Notes IDs” on page 125

Information resources The following information resources are available for IBM SmartCloud Notes. Be sure to use these resources to keep up-to-date on technical content, known issues, and product news. Table 3. Information resources for SmartCloud Notes Resource Description IBM Connections Cloud wiki The wiki provides the following information: v Known issues and troubleshooting information v Getting started information v Technical articles by IBM employees and other community members v Links to other resources such as courseware and multi-media content SmartCloud Notes known issues This wiki article links to a comprehensive list of SmartCloud Notes technotes on the Support site. These technotes describe known issues and workarounds. The article also links to technotes about the Notes client. SmartCloud Notes Fix List This page shows a chronological list of fixes made to the SmartCloud Notes service. SmartCloud Notes Support newsletter This newsletter highlights important technotes and new technical articles and courseware. To receive automatic notification when a new edition of this newsletter is available, add SmartCloud Notes to your My Notifications subscription and include the “Product information and publications” document type in your subscription.

Chapter 1. Overview of SmartCloud Notes 15 Table 3. Information resources for SmartCloud Notes (continued) Resource Description My Notifications from SmartCloud Notes My Notifications enables you to receive daily Support or weekly announcements through e-mail, custom Web pages and RSS feeds. These customizable communications can contain important news, new or updated support content, such as publications, hints and tips, technical notes, product flashes (alerts). Support page Click Support > Technical Support from this page for information about how to contact SmartCloud Notes Support.

16 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 2. Planning to deploy the service

To plan for the IBM SmartCloud Notes service, understand the features it offers, the deployment options that are available, and the planning considerations.

Planning security Before you prepare your environment for the service, make decisions about implementing security in the service by answering questions described in this topic. About this task Table 4. Security questions Question Considerations Will you use federated identity Federated identity management allows users management? who are logged on to your company system to use the service without logging on again. To enable federated identity management, you register your organization as a trusted identity provider in the IBM Connections Cloud service. Before you register, you must implement and test a federated identity management system that uses Security Assertion Markup Language (SAML). While you are implementing your system, you must make some choices and prepare several artifacts.

For more information about this option and other login options, see “Configuring logins” on page 124.

© Copyright IBM Corp. 2011 17 Table 4. Security questions (continued) Question Considerations Do your company top-level organization There are some restrictions on organization certifiers comply with service requirements? certifier names. Your organization certifiers must be different from certifiers used by other companies in the service. In addition, specific organization certifier names are prohibited for use with the service.

If you use more than one organization certifier, decide which one to use for the following servers. All of these servers must be certified under the same organization certifier. v Passthru servers that the service uses to connect to your environment v Directory synchronization servers and mail hub servers in the on-premises hub domain v Your mail servers in the service, which are created for you in the service using the OU certifier that you provide

If there will be service users who are certified under a different organization certifier than the one used for these servers, you must create cross-certificates to establish trust between the two certifiers. The cross-certificates must be in a Domino directory that is synchronized with the service so that they replicate to the service. The cross-certificates allow the users to access their mail servers.

For more information, see “Certifier requirements in a hybrid environment” on page 37. What decisions do you need to make about Decide on a name for the OU certifier. A the OU certifier to use for your mail servers? short name is best. Consider carefully the name you choose; after you upload the OU certifier ID file to the service during service configuration, you cannot change to a certifier of a different name.

Decide who will create the OU certifier and who will upload the certifier ID file to the service. Uploading the ID file to the service requires physical access to the ID file. Companies often allow only specific people to create certifiers and to access certifier ID files, so account for this possibility in your planning.

18 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 4. Security questions (continued) Question Considerations Is public key checking enabled on If public key checking is enabled on the on-premises servers that the service will following servers, it must be disabled. connect to? v Passthru servers that the service uses to connect to your environment v Directory synchronization servers and mail hub servers in the on-premises hub domain What firewall changes are required? Your firewall must be opened to specific ports and host names. For more information, see “Planning network connections.”

Planning network connections Before preparing your environment, answer questions described in this topic to help you make decisions related to network connectivity with the service. About this task Table 5. Network planning questions Question Considerations What process does your company use to Your company might have a review and make network changes? approval process for making the network changes required by the service. Ensure that you understand the process and allow time to implement the required changes. Does your network have sufficient Clients and servers that connect to the bandwidth and Internet connectivity? service are likely to increase the amount of network traffic to the Internet and also change the load on particular parts of your network.

It is important to assess whether your current network has sufficient bandwidth and Internet connectivity to handle these changes. You may need to work with your Internet Service Provider to increase network bandwidth before you provision users for the service.

For information, see the topics about network capacity for the web and IBM Notes clients. What firewall changes are required? Port 1352 must be opened for inbound connections. Ports 1352 and 443 must be opened for outbound connections. You might need to open additional ports, depending on which features you use with the service. For complete information, see the topics “Configuring the firewall for inbound connections” on page 41 and “Configuring the firewall for outbound connections” on page 42.

Chapter 2. Planning to deploy the service 19 Table 5. Network planning questions (continued) Question Considerations Do you use a forward proxy to control user If so, you must allow network traffic to pass access to the Internet? transparently through the proxy over ports 1352 (NRPC) and 443 (HTTPS). Which servers will function as your All connections from the service to your on-premises passthru servers? on-premises environment occur through one or two on-premises Domino passthru servers. For security reasons, these servers must be set up in a unique Domino domain. Putting them in a network demilitarized zone (DMZ) between an inner and outer firewall is recommended. For more information, see “Preparing passthru servers” on page 40

Related tasks: “Preparing your network” on page 40 Prepare your network for connections between IBM SmartCloud Notes servers and on-premises servers. Configure inner and outer firewalls. Then set up a dedicated IBM Domino domain between the firewalls. The domain will function as a passthru server domain through which connections from SmartCloud Notes servers to your on-premises servers occur. Network capacity for the web client Before using the web client, have an understanding of the approximate network capacity that your Internet Service Provider will need to provide to support connections from the web clients to the service.

Use the following formula as a general guideline only: number_of_clients x 2.5 Kbps

where number_of_clients is the expected number of web clients and 2.5 Kbps is the average network kilobits per second required for each client to connect to the service.

This formula assumes an average level of client activity based on IBM Domino mail benchmarks for server-based mail files. Your actual network capacity requirements will depend on the client usage patterns in your environment. Network capacity for the Notes client Before configuring Notes clients to connect to the service, have an understanding of the approximate network capacity that your Internet Service Provider must provide to support those connections.

Use the following formula as a general guideline only: number_of_clients x 3.1 Kbps

where number_of_clients is the number of Notes clients used and 3.1 Kbps is the average network kilobits per second required for each client.

This formula assumes an average level of client activity based on IBM Domino mail benchmarks for server-based mail files. Your actual network capacity requirements will depend on the client usage patterns in your environment.

20 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Planning directory services Before preparing your environment, answer questions described in this topic to help you make decisions about directory services. About this task Table 6. Directory services questions Question Considerations How many directory synchronization servers Directory synchronization servers are will you use? on-premise hub servers that handle replication of Domino directories between your on-premises environment and the service. You can configure one or two directory synchronization servers. Using two to provide failover is recommended. For pilot deployments, one directory synchronization server might suffice. Which servers will be directory Use existing Domino servers or install and synchronization servers? set up new servers.

If a directory synchronization server is also the administration server for the on-premises hub domain, see the next row in this table for version requirements. Otherwise, a directory synchronization server can run any Domino version.

Directory synchronization servers must comply with certifier requirements for the service. For more information, see “Planning security” on page 17. Do you need to upgrade the administration The on-premises hub domain administration server for the on-premises hub domain? server must run Domino 8.5.2 Fix Pack 2 or a later version, with the corresponding Domino Directory template. The administration server is the server that handles administration process requests for the domain Domino Directory. Do you have directory servers in your These directories can be used in the service environment that access directories through only if they are a Domino directory or an the Lightweight Directory Access Protocol extended directory catalog that is replicated (LDAP)? to the service. Which directories will you replicate to the If a Domino directory contains services service? users, you must replicate the full directory to the service.

If a Domino directory contains only on-premises users but no service users, replicate the directory contents to the service if you want service users to address mail or schedule meetings with the on-premises users. In this case, you can replicate the full Domino directory to the service or you can aggregate the directory contents into an extended directory catalog and replicate the directory catalog to the service.

Chapter 2. Planning to deploy the service 21 Table 6. Directory services questions (continued) Question Considerations Do you want service users to be able to To enable service users to select the names select the names of users and devices in of users and devices associated with an internal foreign domains from the corporate internal foreign domain that is not a Domino directory? domain, add Person documents for the users and devices to a directory that is replicated to the service. In the Mail system field of the Person document, select Other Internet Mail to ensure that mail addressed to the names is routed to the on-premises hub domain.

If you do not create Person documents for users and devices in foreign domains, service users can still send mail to the users and devices if they know their addresses. If you replicate multiple directories to the A policy name must be unique across all service, are there policies with the same directories that are replicated to the service. name in two or more directories? If you replicate multiple directories to the It is a good practice to make group names service, are there groups with the same unique across directories that replicate to the name in two or more directories? service. Do you use the directory ACL feature The Extended Access feature is not Extended Access? supported for directories that are replicated to the service.

Related tasks: “Preparing for directory synchronization” on page 45 Set up at least one Domino server in the on-premises hub domain to be a directory synchronization server. Then prepare to replicate directories to the service. Requirements for synchronized directories Understand the requirements and limitations for directories that are synchronized with the service. General

Note the following general requirements for synchronized directories: v Each directory synchronization server must have a replica, not a copy, of each Domino directory to be synchronized. You must schedule regular replication of each synchronized directory between the directory synchronization servers and other servers in your environment. v Each synchronized directory database must inherit its design from the master template StdR4PublicAddressBook. This master template is the standard directory template used with any supported version of Domino. To determine whether a directory inherits from this template, click File > Application > Properties, click the fourth tab, and verify that StdR4PublicAddressBook is shown in the Template name field in the Inheritance section of the property page. v If you use two directory synchronization servers, each replica of a synchronized directory must have the same file path and file name on each server. v You must synchronize any Domino directory that contains Person documents of users to be provisioned for the service. The Access Control List (ACL) of the

22 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 directory must have the following entries. The Domain Configuration tool adds these entries and you must not modify them.

ACL entry Additional information Name: Explicit name of the on-premises This entry allows directory changes to directory synchronization server and any replicate to the service. backup directory synchronization server; for example, Dirhub1/Renovations, Dirhub2/Renovations

Access Manager

User type: Server

Privileges: Delete documents Name: LLNServers This entry allows the service to make some limited changes to the on-premises directory. Access Editor The UserModifier roles allows the service to User type Server group update the Mail file and Mail server fields in the Person documents of service users. Roles UserModifier, GroupCreator, GroupModifier The GroupCreator and GroupModifier roles allow the service to create and modify specific groups in the directory that are required for communication with the service. The service only modifies groups that it creates, never groups that you create. Name: SaaSLocalDomainServers SaaSLocalDomainServers is a group used within the service for replication of the Access Manager directory between servers in the service. It has a similar function to the Server group User type LocalDomainServers group used in on-premises Domino environments. Privileges: Delete documents Do not create a group of this name in your directory. v A directory that you synchronize must be a Domino directory replica on a directory synchronization server. A directory synchronization server cannot use directory assistance to access a synchronized directory on another server. v A synchronized directory’s primary Notes mail domain must be specified in the Domain defined by this Domino Directory field in the Directory Profile. The Directory Profile is found by opening the directory and clicking Actions > Edit Directory Profile. v The Access Control List (ACL) setting Enable Extended Access is not supported for use with synchronized directories. This setting, which is found by clicking Advanced in the Access Control List box, must be disabled if it is not currently disabled. v Do not delete any directory that is configured for synchronization from the on-premises directory synchronization servers. Person documents

Note the following requirements and recommendations for Person documents in a synchronized directory: v Do not change the names of service users in Person documents by manually editing the documents. Instead always initiate name changes through the

Chapter 2. Planning to deploy the service 23 Domino Administrator client. When the Domino Administrator client is used, the Administration Process can then make the changes throughout your environment including replicating the change to your on-premises directory synchronization servers. v A SmartCloud Notes user does not require a first name if provisioned through the SmartCloud Notes Administration interface. If a user is registered on-premises with a last name only, that one name will be correctly displayed in the SmartCloud Notes directory and in the mail file after user provisioning. In the Connections Cloud account settings and user accounts however, the last name is also used as the first name. For example, if you register a user with the last name HelpDesk, when you log on to the service as an administrator and click User Accounts, the user’s name is HelpDesk HelpDesk.

Note: A user requires both a first name and last name if provisioned through the Connections Cloud integration server. v The first two values in the FullName field (labeled User name) can only be a standard Notes hierarchical or flat name. For example, Samantha Daryn and Samantha Daryn/Renovations are allowed but not [email protected]. v The Internet address field in the Person documents of service users must contain a full valid Internet address for a domain that has been verified by the service. An example of an Internet address is [email protected]. v The Short name/UserID field can also contain a valid Internet address for a domain that has been verified by the service. You cannot specify an Internet address in this field during user registration. You can add an Internet address to this field after user registration is complete. If you do, add it as a secondary entry in the Short name/UserID field; do not add the Internet address as the first entry in this field. v You can add Person documents for external users at another company to a synchronized Domino directory. Then service users within your company can use type-ahead and other addressing features to address mail to the external users. You can add Person documents for these external users in any way that you want. However, service users within your company must always have Person documents created through the normal Domino Administrator client user registration. v Set the field Format preference for incoming mail to Keep in sender’s format for best performance and message fidelity. Group documents

Note the following information about groups: v Do not use the following names for groups that you create. These names are reserved for the service. – LLNServers – LLNMailHubs – Names that begin with Certifiers_ or SAAS v Do not delete or edit the following groups. These are created and maintained by the service. – LLNServers – LLNMailHubs

24 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Multiple directories

If you synchronize multiple directories, they are combined into a single directory on servers in the service. As a result, keep in mind the following requirements and recommendations: v Each policy name must be unique across directories. If two policies have the same name, the service uses one only, which can cause unexpected, incorrect results. v It is a good practice to make group names unique across synchronized directories. Unique group names are important for security if groups are used in the ACLs of mail files being transferred to the service. If a name that matches two customer-created groups is used in a mail file ACL, the ACL determines access for members of both groups. If there are mail groups that have the same name, users must choose which one to use each time they send mail to the group name. Using unique group names avoids this step. v If you use Resource Reservations as part of calendar scheduling, it is best, but not required, to make site names unique across Domino domains. If two sites have the same name, the service lists resources from both sites under one site name. This situation can lead users to reserve resources at the wrong site. See Technote 1473022 for instructions on making site names unique. Extended Directory Catalog

Using an extended directory catalog (EDC) in the service in which multiple directories are aggregated is optional. Note the following important points about EDC use: v The content of the following directory fields must be aggregated into the directory catalog: – FirstName – MiddleInitial – LastName – Location – MailAddress – Shortname – MailDomain – InternetAddress – MessageStorage – Members – AltFullName – AltFullNameLanguage – GroupType To support resource reservations, Mail-in Database documents and the following fields must also be aggregated – ResourceFlag – ResourceType – ResourceCapacity v Aggregate all the directories to be used by the service in the EDC, including the directories in which service users are registered. v Only Person, Group, and Mail-in Database documents in an EDC replicate to the service. To replicate Policy, Policy Settings, Certifier, Cross-certificate, or Domain

Chapter 2. Planning to deploy the service 25 documents to the service, the documents must be in a full Domino directory that is synchronized with the service and used for provisioning. v The service has read-only access to an EDC and does not change the on-premises EDC replica during directory synchronization. Any users to be provisioned for the service must therefore have Person documents in an individual Domino directory that the service can update. v The primary Domino directory of your directory synchronization servers cannot be configured as an EDC. If the primary directory is currently configured this way, you must remove the EDC configuration from it before configuring your environment to connect to the service. To do so, open the directory, go to the Configuration > Directory > Extended Directory Catalog view, and delete all the documents from the view. Then build the EDC in a separate database. Related tasks: “Downloading and running the Domain Configuration tool” on page 94 The Domain Configuration tool configures your on-premises servers to connect to your hosted IBM SmartCloud Notes servers. The server configuration information that you provide in the Account Settings of SmartCloud Notes Administration is the data that is used to configure the connections. Related information:

Technote 1473022 How directory synchronization works A server in the service connects regularly to an on-premises directory synchronization server to replicate on-premises directories.

To provide failover, you can set up two directory synchronization servers in the on-premises hub domain. When you configure the service, you configure one as the primary directory server and the other as the optional secondary directory server. After the service replicates successfully with the primary directory server, it continues to use that server as long as it is available. If the server becomes unavailable, the service attempts to replicate with the optional secondary directory server. When the primary directory server becomes available, the service switches back to it.

The frequency of replication varies, depending on server load. The service always initiates the replication.

When you configure directory synchronization in IBM SmartCloud Notes Administration, you specify whether a directory is used for provisioning. A directory that is used for provisioning is a full Domino directory in which service users are registered on-premises. When the service replicates a directory that is designated as used for provisioning, it pulls on-premises information from a specific set of documents. The service can also push information to the on-premises directory. For example, it pushes the service users' mail server and mail file names to the on-premises Person documents.

You can select the option Do not use this Domino Directory for user provisioning when you configure a directory in SmartCloud Notes Administration. In this case, the service pulls the contents of Person, Group, and Mail-in Database documents from the on-premises directory, but never pushes changes to the directory. An Extended Directory Catalog is an example of a directory that is not used for provisioning.

26 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 The following tables provide additional information about documents replicated in directories that are used for provisioning. Table 7. Documents pulled from on-premises directories that are used for provisioning Document Comments

Person v Person documents for both on-premises users and users in the service are pulled. v The service does not pull the contents of the Mail server and Mail file fields in the Person documents of users in the service because the service controls the content of these fields. Note: All users in the service must have an address specified in the Internet address field in their Person documents, for example, [email protected]. A user cannot be provisioned for the service without an Internet address.

Group v On-premises administrators manage all groups on-premises except the server groups created by the service operations within the service. See the following table for more information about server groups created by the service. Mail-in database

Policies and Policy Settings v Some settings are controlled by the service. For information, see the topic “Using administrative policies” and “Policy settings supported in a hybrid environment.” Certifier Cross Certificate ECL Domain Vault Trust Certificate Account

Table 8. Documents pushed to on-premises directories used for provisioning Document Comments

Person v Only the content of the Mail server and Mail file fields in the Person documents of users in the service are pushed on-premises.

LLNServers group v This group contains the names of the mail and directory servers in the service.

LLNMailHubs group v This group contains the names of mail hub servers in the service that route mail to user mail servers in the service and to the primary mail hub servers on-premises.

Chapter 2. Planning to deploy the service 27 Table 8. Documents pushed to on-premises directories used for provisioning (continued) Document Comments

CustomerMailHubs group v This group contains the names of the primary mail hub servers on-premises. v If you change a mail hub server, do not edit this group. Instead, change the server through the Account Settings > Mail Routing Server administration page. Then download and run the Domain Configuration Tool to update your on-premises configuration.

Vault v This is the document for the ID vault on the ID vault server in the service. The ID vault is used for ID backup and recovery.

The initial directory synchronization also creates Connection documents in the directory of your primary mail hub servers to enable the servers to route mail to mail servers in the service. The Connection documents are not replicated to the service. How the service resolves duplicate Person documents The service can encounter duplicate Person documents within or across synchronized directories. In this case, the service picks one to be the authoritative version.

To determine whether two Person documents are duplicates, the service first compares their unique identifier (UNID) values. If their UNID values are the same the service treats the documents as duplicates. If their UNID values are not the same but the distinguished name values are the same, the service also treats the documents as duplicates.

When duplicate Person documents are found, the service chooses one to be the authoritative document to use in the service. If a duplicate Person document occurs between an extended directory catalog (EDC) and a Domino directory, the service uses the document in the Domino directory. If the EDC document replicates to the service first, it is the temporary authoritative version. The Domino directory document becomes the authoritative version when it replicates to the service.

If a duplicate Person document occurs within or across Domino directories, the service chooses the Person document with a Domain field value that matches the domain in the Directory Profile of its directory. If the Domain field in each document matches its Directory Profile domain, the service uses the first Person document that it encounters.

Note: If you aggregate Person documents that contain identical distinguished names into an EDC, the service uses only the first one it encounters. Therefore each Person document in an EDC that represents a distinct user should have a unique distinguished name. Select Yes for the Remove duplicate users setting to prevent the aggregation of duplicate user names into an EDC. For more information, see the topic in the Domino documentation about removing duplicate user entries from a directory catalog. Related information:

28 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Domino documentation

Planning mail routing and mail settings Answer the questions in this topic to help you make decisions about mail routing and mail settings. About this task Table 9. Mail routing and mail settings questions Question Considerations Which servers will function as your mail Mail hub servers in the on-premises hub hub servers in the on-premises hub domain? domain handle the routing of all mail that service users send to on-premises users and devices. The servers must have sufficient hardware and network resources to handle this mail routing load.

If service users send mail to on-premises users who are registered in a different domain than the on-premises hub domain, the mail hub servers in the on-premises hub domain must be able to route mail to the other domains.

You can use one or two mail hub servers. Use two for high availability. For pilot deployments, one mail hub server might suffice.

Mail hub servers in the on-premises hub domain must be certified under the same parent organization certifier as your directory synchronization servers, passthru servers, and user mail servers in the service.

Public key checking must be disabled on the mail hub servers in the on-premises hub domain. For more information, see the topic

For more information, see “Setting up mail hub servers in the on-premises hub domain” on page 52. Do you need to upgrade any mail servers? Mail hub servers in each Domino domain in which service users are registered handle routing mail from your on-premises environment to the service users in the domain.

Each on-premises server that routes mail to the service must run Domino 8.5.1 Fix Pack 2 or a later version.

Chapter 2. Planning to deploy the service 29 Table 9. Mail routing and mail settings questions (continued) Question Considerations What Internet domains do you want to You use at least one Global Domain define in the service? document to define the Internet domains that your company owns and that you want to use in the service. Global Domain documents replicate to the service during directory synchronization. The service uses Global Domain documents only to determine the domains that a company owns.

As part of service configuration, you will verify ownership of the domains specified in Global Domain documents. Verification involves creating a CNAME record in your domain DNS record. If you don’t have access to the DNS record, you will need to allow time for your Internet Service Provider (ISP) to create the required CNAME record for you

You can route mail between service users and on-premises users or devices in foreign domains not associated with Domino mail servers. To define a foreign domain, you must create a Global Domain document in a new Domino directory that is not the primary Domino Directory of a Domino domain.

For more information, see the topics “Preparing Global Domain documents” on page 49 and “Verifying Internet domains” on page 97. Note: The service does not support using Foreign Domain documents to route mail to external Internet domains through the service. Do you use Internet domain aliases in Domains specified in the Global Domain Global Domain documents? document field Alternate Internet domain aliases are not handled as alias domains by the service. Instead, each domain in this field is listed and verified in the service as a separate domain, similar to the domain specified in the Local primary Internet domain field. To enable a user to receive mail addressed to a domain in the Alternate Internet domain aliases field, you must specify the user’s address for the domain in the Person document.

For more information, see “Adding multiple Internet email addresses to Person documents” on page 207.

30 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 9. Mail routing and mail settings questions (continued) Question Considerations When service users send mail to external By default, the service routes mail that users on the Internet, do you want to use an service users address to external users. You on-premises SMTP server to route the mail? can use a company-controlled SMTP server to route the mail, instead. When you use your own server, you can perform actions such as filtering and auditing before routing the mail. For more information, see the topic “Preparing to use a company SMTP server to route outbound Internet mail” on page 54

You are responsible for routing inbound SMTP mail that is addressed to service users. The mail must be routed to a mail hub server in the Domino domain in which the service user is registered. Do you want to use any of the optional mail You can limit the size of incoming messages, settings the service provides? prevent auto-forwarding of external messages, customize the display of IBM Notes document links in web client mail, configure mail retention in the trash folder, and control the deletion of older email. For more information, see “Configuring mail settings” on page 154

Related concepts: “Certifier requirements in a hybrid environment” on page 37 It is important to understand the following certifier requirements when planning a hybrid environment. “Version requirements for on-premises Domino servers” on page 38 This topic describes the IBM Domino version requirements for on-premises Domino servers. Related tasks: “Preparing for mail routing” on page 52 To prepare for mail routing between the service and your on-premises environment, first set up at least one mail hub server in your on-premises hub domain. Then prepare to route mail from service users and to service users. Related information:

Domino documentation

Planning calendars and scheduling Answer the questions in this topic to help you understand and plan for the use of calendars and scheduling in the service.

Chapter 2. Planning to deploy the service 31 About this task Table 10. Calendars and scheduling questions Question Considerations Do you want on-premises users to look up When an on-premises user requests the the free-time of service users? free-time of a service user, the request is sent to the service user’s mail server. The following on-premises configuration is required: v The on-premises user’s mail server must run the Calendar Connector (CalConn) server task. v An on-premises server in the service user’s domain must send the request to the service. This server must be Domino 8.5.1 Fix Pack 2 or a later version and must run the CalConn server task. v If the on-premises user making the request is in a different Domino domain than the service user, the Calendar server in the on-premises user’s domain must be able to send the request to the Calendar server in the service user’s domain. The Calendar server in the service user’s domain then sends the free-time request to the service user’s mail server. v If the service user is not in the on-premises hub domain, you must create a Connection document that enables servers in the domain to connect to the service to send the free-time request. This same Connection document is also required to connect to the service to route mail. This step is unnecessary for the on-premises hub domain because the Domain Configuration tool creates the required Connection document.

32 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 10. Calendars and scheduling questions (continued) Question Considerations Do you want service users to look up the When a service user requests the free-time of free-time of on-premises users? an on-premises user, the service user’s mail server sends the request to a mail hub server in the on-premises hub domain. The following on-premises configuration is required to process the request: v The CustomerMailHubs group, which includes the names of the on-premises mail hub servers, must replicate to the service. This step provides the service user’s mail server with the information necessary to connect to the mail hub servers. The Domain Configuration tool creates the group in the primary directory of the on-premises hub domain. If you do not synchronize this directory, you must copy the group to a directory that you do synchronize. v If the on-premises user’s domain is not the on-premises hub domain, a Calendar server in the hub domain must be able to connect to the Calendar server in the on-premises user’s domain to forward the request. v If the on-premises user information is available in the on-premises hub domain only through an extended directory catalog, the mail hub servers in the on-premises hub domain must use directory assistance to look up names in the directory catalog.

Chapter 2. Planning to deploy the service 33 Table 10. Calendars and scheduling questions (continued) Question Considerations Do you want service users to reserve rooms A service user can schedule rooms and and resources when scheduling meetings? resources in on-premises Resource Reservations databases. The following on-premises configuration is required to process the request: v You must synchronize the directory of the domain in which a Resource Reservations database is located. Synchronization replicates the Mail-in database documents that are required to route the reservations on-premises. v When a service user reserves a room or resource, the reservation is mailed to a mail hub server in the on-premises hub domain. If the Resource Reservations database that contains the room or resource is in another domain, you must configure mail routing to the other domain. This requirement is similar to the requirement for routing mail to an on-premises user in another domain. v To enable a service user to look up the free-time of a room or resource, the service user’s mail server must be able to connect to a mail hub server in the on-premises hub domain. An on-premises server must be able to look up the free-time in the Resource Reservations database and return it to the service. These requirements are similar to the requirements to look up free-time of on-premises users. v You can replicate the directory of the domain that contains a Resource Reservation database to the service through a directory catalog. In this case, specific fields required for resource reservations must be aggregated in the catalog. v Avoid the use of duplicate site names that are used for rooms and resources. If two sites have the same name, the service lists resources from both sites under one site name. This situation can lead users to reserve resources at the wrong site.

Related concepts: “Example: Free-time requests between users in the on-premises hub domain” on page 75 This example illustrates how free-time requests occur between a service user and an on-premises user who are both registered in the on-premises hub domain. “Example: Free-time requests between users in different domains” on page 78 This example illustrates how free-time requests occur between an on-premises user in a secondary domain and a service user in the on-premises hub domain. Related tasks:

34 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 “Preparing for calendars and scheduling” on page 73 You can prepare for on-premises users and service users to look up each others’ free time when scheduling meetings. You can also prepare for service users to reserve resources in on-premises Resource Reservations databases. Planning free-time requests in a hybrid environment When an on-premises user requests the free time of service user, the on-premises user’s mail server makes a free-time request to the service user’s mail server. When a service user requests free time for an on-premises user, the service user’s mail server makes a free-time request to an on-premises primary mail hub server. Steps that occur when a service user looks up free time for an on-premises user

The following steps occur when a service user looks up free time for an on-premises user whose mail server is in the same domain as a primary mail hub server: 1. The service user’s client sends a free-time request to the service users mail server. 2. The service user’s mail server sends the free-time request to a primary mail hub server on premises. 3. The primary mail hub server sends the free-time request to the on-premises user’s mail server. 4. The on-premises user’s mail server looks up the on-premises users free time in its Free Time database. 5. The on-premises user's mail server returns the free time to the service user's mail server. 6. The service user's mail server returns the free time to the service user's client.

The following steps occur when a service user looks up free time for an on-premises user whose mail server is in a different Domino domain than a primary mail hub server: 1. The service user's client sends a free-time request to the service user's mail server. 2. The service user's mail server sends the free-time request to a primary mail hub server on premises. 3. The primary mail hub server sends the free-time request to the Calendar server for the Domino domain of the on-premises user. 4. The Calendar server looks up the on-premises user's free time in its Free Time database. 5. The Calendar server returns the user’s free time to the primary mail hub server. 6. The primary mail hub server returns the free time to the service user's mail server. 7. The service user's mail server returns the free time to the service user's client. Related concepts: “Version requirements for on-premises Domino servers” on page 38 This topic describes the IBM Domino version requirements for on-premises Domino servers. “Example: Free-time requests between users in the on-premises hub domain” on page 75 This example illustrates how free-time requests occur between a service user and

Chapter 2. Planning to deploy the service 35 an on-premises user who are both registered in the on-premises hub domain. “Example: Free-time requests between users in different domains” on page 78 This example illustrates how free-time requests occur between an on-premises user in a secondary domain and a service user in the on-premises hub domain. Related tasks: “Preparing for calendars and scheduling” on page 73 You can prepare for on-premises users and service users to look up each others’ free time when scheduling meetings. You can also prepare for service users to reserve resources in on-premises Resource Reservations databases. Resource reservations in a hybrid environment Room and resource Mail-in Database documents replicated to the service allow service users to reserve rooms and resources in an on-premises Resource Reservations database.

Note: Each site in all the room and resource databases across all domains should have a unique name. If multiple sites have the same name, their resources are listed together under that name and users may inadvertently reserve a resource at an unintended site. For information on making site names unique, see Technote 1473022.

The following steps occur when a service user reserves a room or resource: 1. To display sites, and the rooms and resources in each site, the service user's mail server looks up room and resource Mail-in Database documents in its directory. The Mail-in Database documents have replicated from the on-premises Domino directory during directory synchronization. 2. To display the free time for the rooms and resources, the client submits a free time request for the period of the meeting to the service mail server. 3. The service mail server sends the free time request to a primary mail hub server on-premises. 4. The primary mail hub server looks up the available free time for the room or resource in its Resource Reservations database, or if the database is not local, routes the lookup to another server. 5. The available times are returned to the service mail server, which returns them to the client. 6. When the user reserves a room or resource, the service mail server mails the reservation to the corresponding on-premises Mail-in Database document, which creates the reservation in the on-premises Resource Reservations database. Related concepts: “Version requirements for on-premises Domino servers” on page 38 This topic describes the IBM Domino version requirements for on-premises Domino servers. “Service user requesting the free time of a resource” on page 297 This picture illustrates a service user requesting the free time of a resource at Renovations. “Service user reserving a resource” on page 299 This picture illustrates a service user reserving a resource. Related tasks: “Preparing for calendars and scheduling” on page 73 You can prepare for on-premises users and service users to look up each others’ free time when scheduling meetings. You can also prepare for service users to

36 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 reserve resources in on-premises Resource Reservations databases.

Certifier requirements in a hybrid environment It is important to understand the following certifier requirements when planning a hybrid environment. v The OU certifier you provide for your service mail servers must be under the same organization certifier as the passthru servers, directory synchronization servers, and primary mail hub servers. It can be at any level below the organization certifier. This OU certifier must be unique and used only for the service mail servers; the OU certifier cannot be used on-premises. v It is important that you choose and create your service mail server OU certifier carefully. After you upload the OU certifier ID to the service, you cannot change to an ID with a different certifier name. v The certifier used for service users must trust the service mail server OU certifier, and vice versa. If any users are certified under a different organization than the OU certifier, you must create the required cross-certificates to establish trust. The cross-certificates must be replicated to the directory synchronization servers. v The names of organization certifiers must be unique to a company; two companies in the service cannot use the same organization certifier name because of the multi-tenant messaging architecture of a cloud environment. The use of generic organization certifier names is discouraged. v The names of the on-premises passthru servers, directory synchronization servers, and primary mail hub servers must all be under one organization certifier. Cross-certificates cannot be used to establish trust between these servers. It is acceptable to name these servers under organizational units (OUs) below the organization certifier. v Though the passthru servers must be under the same organization certifier as the directory synchronization and primary mail hub servers, they should be in a separate Domino domain from those servers. You may be accustomed to using the same name for a Domino domain and an organization certifier, but there is no relationship between the two names. So it is acceptable to certify the passthru servers under your main corporate certifier (often the name of your company) but name the domain of the passthru servers something else.

For example, the company Renovations initially has one, top-level organization certifier, /Renovations. They create the on-premises passthru servers, directory synchronization servers, and mail hub servers under this certifier, for example: Passthru/Renovations, Dirhub/Renovations, Mailhub/Renovations. The passthru servers are in a unique Domino domain.

They also create the OU certifier /SCN/Renovations to use as their service mail server certifier. This OU certifier is under the same organization certifier as the passthru, directory synchronization, and mailhub servers, as required.

The company then purchases a second company that uses a different top-level organization certifier, /Acme. They create cross-certificates to establish trust between the two certifiers.

For more information on certifiers and cross-certificates, see the Domino documentation. Related information:

Chapter 2. Planning to deploy the service 37 Domino documentation

Version requirements for on-premises Domino servers This topic describes the IBM Domino version requirements for on-premises Domino servers. Table 11. Version requirements for on-premises Domino servers On-premises server type Supported versions

Mail routing servers that connect directly to v IBM Domino 8.5.1 Fix Pack 2 or later fix service mail servers for mail routing. pack v IBM Domino 8.5.2 or later v IBM Domino 9 Social Edition

Administration server (used by the v IBM Domino 8.5.1 Fix Pack 2 or later fix Administration Process) for the Domino pack directory of the on-premises hub domain. v IBM Domino 8.5.2 or later v IBM Domino 9 Social Edition Note: The Domino directory template must be at least the version provided with IBM Domino 8.5.1 Fix Pack 2. Directory synchronization servers (if not the Any version of Domino supported by IBM. administration server)

Mail servers that request the free time of v IBM Domino 8.5.1 Fix Pack 2 or later fix service users pack v IBM Domino 8.5.2 or later v IBM Domino 9 Social Edition Passthru domain servers Any version of Domino supported by IBM. Use IBM Domino 8.5.2 or later for fastest response time for connections from servers in the service to on-premises servers.

Related tasks: “Preparing passthru servers” on page 40 Install and set up at least one Domino server to be used as a passthru server through which the service connects to servers in your on-premises hub domain. “Setting up directory synchronization servers” on page 45 In the on-premises hub domain, set up at least one Domino server to be a hub server for directory synchronization with the service. “Preparing for mail routing” on page 52 To prepare for mail routing between the service and your on-premises environment, first set up at least one mail hub server in your on-premises hub domain. Then prepare to route mail from service users and to service users.

38 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 3. Preparing your environment

Perform the steps in this section to prepare your on-premises servers for a hybrid environment. Perform these steps after you have planned for the service and before you configure the service. Related tasks: Chapter 2, “Planning to deploy the service,” on page 17 To plan for the IBM SmartCloud Notes service, understand the features it offers, the deployment options that are available, and the planning considerations.

Creating a certifier for your mail servers Create an IBM Domino organizational unit (OU) certifier to use for certification of your IBM SmartCloud Notes mail servers.

Create an OU certifier that is unique in your company. For example, if you use the organization certifier /Renovations, you could create the OU certifier /SCN/Renovations. Then your mail servers have names such as Mail1/SCN/Renovations and Mail2/SCN/Renovations. The certifier name is part of the mail server names that IBM Notes client users see, so keep it short for better readability. Before you begin

To ensure that the certifier you create complies with the general certifier requirements in a hybrid environment, read the topic Certifier requirements in a hybrid environment. Procedure 1. Create an OU certifier. For information, see the topic about creating an organizational unit certifier in the Domino documentation. 2. The certifiers of your service users must trust the Organization certifier of the OU certifier you create, and vice versa. If some service users are certified under a different Organization certifier, create each necessary cross certificate on the directory synchronization server to establish trust. The cross-certificates replicates to the service during directory synchronization. For information, see the topic about creating a cross-certificate from a Notes certifier in the Domino documentation. Related tasks: “Providing a certifier ID file” on page 92 As a part of preparing your on-premises environment for a hybrid deployment, you create an IBM Domino organizational unit (OU) certifier for your IBM SmartCloud Notes servers. In this task, you provide an OU certifier ID file and password when you set up the hybrid environment. Related information:

Domino documentation

© Copyright IBM Corp. 2011 39 Preparing your network Prepare your network for connections between IBM SmartCloud Notes servers and on-premises servers. Configure inner and outer firewalls. Then set up a dedicated IBM Domino domain between the firewalls. The domain will function as a passthru server domain through which connections from SmartCloud Notes servers to your on-premises servers occur. Preparing passthru servers Install and set up at least one Domino server to be used as a passthru server through which the service connects to servers in your on-premises hub domain. About this task v To provide failover, install and set up two servers. If the service is unable to connect to one server, it tries the other. After the service is successful in connecting to one server, it continues to use it as long as it remains available. If a server becomes unavailable, the service attempts to connect to the other server, and if successful, then continues to use that server as long as it is available. The service does not use Domino cluster failover. v Passthru servers handle the transfer of network packets and do not perform mail routing or replication. As such, they do not require significant disk space or processing speed. v For security reasons, do not set up passthru servers in the on-premises hub domain that holds your directory synchronization servers and mail hub servers. Instead, install and set up the servers in a new unique Domino domain. The servers can be in separate unique domains. v For optimum security, configure your corporate firewalls so that connections to the passthru servers occur in your corporate demilitarized zone. v A passthru server must be certified under the same parent organization certifier as the following servers: – Directory synchronization servers in the on-premises hub domain – Mail hub servers in the on-premises hub domain – Your mail servers in the service v For the fastest response time for connections from the service, install Domino 8.5.2 or later servers. To optimize passthru server performance, Domino 8.5.2 provides the notes.ini setting passthru_connect_wait=1. This setting is useful for improving the response time when service users request the free time of on-premises users. The Domain Configuration tool enables this setting on the Domino 8.5.2 passthru servers for you. v Public key checking should not be enforced on the passthru servers. Public key checking, which is controlled through the Compare public keys field in the Security tab of the Server document, is disabled on Domino servers by default. Procedure 1. Install and set up at least one IBM Domino server. v Set up the server as the first server in the domain. v During server setup, select the option I want to use an existing certifier ID file. Then certify the new server under the same organization certifier that is used to certify the directory synchronization servers and the mail hub servers in the on-premises hub domain. A certifier name is independent of a Domino domain name. In this case, the certifier name and the domain name are likely to be different.

40 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v For more information on installing and setting up servers, see the Domino documentation, 2. If required, create LAN Connection documents that enable the passthru server to connect to the directory synchronization servers and mail hub servers in the on–premises hub domain. For more information, see the topic on creating LAN Connection documents in the Domino documentation. What to do next

Test that each passthru server can resolve the host name of each directory synchronization server and mail hub server in the on-premises hub domain. If a passthru server cannot resolve a host name, verify that required Connection documents are in place. Also verify that your firewall rules allow the passthru server to access the servers.

Record the Domino hierarchical name, DNS host name (recommended) or IP address, and Domino domain name of each passthru server. You provide this information later when you configure the service. Related concepts: “Certifier requirements in a hybrid environment” on page 37 It is important to understand the following certifier requirements when planning a hybrid environment. Related tasks: “Planning network connections” on page 19 Before preparing your environment, answer questions described in this topic to help you make decisions related to network connectivity with the service. Related information:

Domino documentation Preparing the firewall Configure the corporate firewall to allow connections to and from the service. About this task

When configuring the firewall, specify the host names as described to minimize the risk of network attacks from the Internet. The risk of attack increases if you relax the host name rules. Configuring the firewall for inbound connections Configure the firewall to allow inbound connections from the service to servers in your on-premises environment.

About this task Table 12. Firewall settings for inbound connections Protocol Port Source Target NRPC 1352 The IBM SmartCloud Notes Passthru server host names, addresses generated by the outer for example: firewall of the service. pthru1.renovations.com pthru2.renovations.com Contact your IBM Customer Service Representative for this information.

Chapter 3. Preparing your environment 41 Table 12. Firewall settings for inbound connections (continued) Protocol Port Source Target NRPC 1352 Passthru server host names, Host names of the on-premises for example: directory synchronization servers pthru1.renovations.com and mail hub servers, pthru2.renovations.com for example: dirhub.renovations.com mailhub.renovations.com SMTP 25 The IBM SmartCloud Notes Optional SMTP host that routes addresses generated by the outer mail to the Internet. The host is firewall of the service. specified in SmartCloud Notes Administration at Account Contact your IBM Customer Service Settings > Email Management > Representative for this information. Manage Routing to External Internet Domains.

Related tasks: “Preparing to use a company SMTP server to route outbound Internet mail” on page 54 You can configure a company SMTP host server to route mail that service users send to external users. Configuring the firewall for outbound connections Configure the firewall to allow outbound connections to the service.

About this task

The following table describes the firewall settings required to allow connections from on-premises servers and clients to specific hosts in the service. You can substitute *.collabserv.com for the host names to represent all hosts in the service.

If your current firewall settings reference the original service domain name, lotuslive.com, retain those settings and add the settings described in the table.

In addition to allowing connections over HTTPS port 443, you can allow connections over HTTP 80. If you do, connections over HTTP are redirected to HTTPS. Table 13. Firewall settings for outbound connections Applicable Protocol Port Host name server or client NRPC 1352 North American data center: Domino servers notes.na.collabserv.com Asia Pacific data center: IBM Notes notes.ap.collabserv.com clients European data center: notes.ce.collabserv.com HTTPS 443 North American data center: IBM notes.na.collabserv.com SmartCloud mail.notes.na.collabserv.com Notes web Asia Pacific data center: notes.ap.collabserv.com mail.notes.ap.collabserv.com European data center: notes.ce.collabserv.com mail.notes.ce.collabserv.com

42 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 13. Firewall settings for outbound connections (continued) Applicable Protocol Port Host name server or client HTTPS 443 North American data center: Web browser admin.notes.na.collabserv.com access to Asia Pacific data center: SmartCloud admin.notes.ap.collabserv.com Notes European data center: Administration admin.notes.ce.collabserv.com HTTPS 443 North American data center: IBM Notes traveler.notes.na.collabserv.com Traveler apps.na.collabserv.com devices Asia Pacific data center : accessing the traveler.notes.ap.collabserv.com service via apps.ap.collabserv.com WiFi European data center: traveler.notes.ce.collabserv.com apps.ce.collabserv.com IMAP 993 North American data center: IMAP clients imap.notes.na.collabserv.com (receiving mail) Asia Pacific data center: imap.notes.ap.collabserv.com European data center: imap.notes.ce.collabserv.com IMAP 465 North American data center: IMAP clients submit.notes.na.collabserv.com (sending mail) Asia Pacific data center: submit.notes.ap.collabserv.com European data center: submit.notes.ce.collabserv.com VP (Virtual 1533 North American data center: IBM Notes Places - im.na.collabserv.com clients that used for Asia Pacific data center: connect to the instant im.ap.collabserv.com instant messaging) European data center: messaging im.ce.collabserv.com community in the service VP (Virtual 1533 North American data center: IBM Places - webchat.na.collabserv.com SmartCloud used for Asia Pacific data center: Notes web instant webchat.ap.collabserv.com clients that messaging) European data center: connect to the webchat.ce.collabserv.com instant messaging community in the service SMTP 25 North American data center: SMTP servers smtp.notes.na.collabserv.com that route Asia Pacific data center: Internet mail to smtp.notes.ap.collabserv.com service users European data center: smtp.notes.ce.collabserv.com

Chapter 3. Preparing your environment 43 Table 13. Firewall settings for outbound connections (continued) Applicable Protocol Port Host name server or client FTP 990 North American data center: Temporary PASV (FTP) 60000 - 61000 ftp.notes.na.collabserv.com requirement for Asia Pacific data center: clients that ftp.notes.ap.collabserv.com transfer mail European data center: files to the ftp.notes.ce.collabserv.com service over FTP

Hybrid environments only FTP 990 North American data center: Client that PASV (FTP) 60000 - 61000 ftp.na.collabserv.com downloads Asia Pacific data center: journal files ftp.ap.collabserv.com European data center: ftp.ce.collabserv.com

How NRPC connections are made in a hybrid environment Connections from on-premises Notes clients and Domino servers to IBM SmartCloud Notes mail servers occur via a proxy server in the service. Connections from SmartCloud Notes servers to on-premises servers occur via a passthru server in the on-premises passthru server domain.

For information on on-premises server version requirements, see Version requirements for on-premises Domino servers. How on-premises servers and clients connect to the service

All Notes Remote Procedure Call (NRPC) connection requests that on-premises clients and servers make to servers in the service occur over TCP/IP port 1352. The requests are made via a proxy server in the service, notes.na.collabserv.com or notes.ap.collabserv.com, depending on the data center your company uses. The proxy server authenticates the requesting on-premises users and servers and then "proxies" the connection requests to the target mail servers in the service. The proxy server authenticates using the organizational unit (OU) certifier that you have provided for certification of your mail servers.

When you run the Domain Configuration tool on-premises, the tool creates a Connection document in the Domino directory of the on-premises hub domain that enables connections to the proxy server. The Connection document contains the following values for the Source and Destination fields: v Source server:* v Source domain On-premises hub domain, for example, Renovations v Destination server: mail servers in the service, for example, */SCN/Renovations. v Optional network address: notes.na.collabserv.com or notes.ap.collabserv.com (proxy)

44 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 How servers in the service connect to on-premises servers

All connection requests that servers in the service make to on-premises servers are handled by servers in the on-premises passthru server domain. The passthru server domain is a dedicated domain with its own Domino directory situated inside your corporate network demilitarized zone (DMZ). The passthru servers authenticate servers in the service and allow passthru connections only for those servers with IDs that are certified by the OU certifier you provide.

To optimize the speed of connections from the service to on-premises servers, running Domino 8.5.2 or later on the server or servers in the passthru server domain is recommended. Domino 8.5.2 provides the notes.ini setting passthru_connect_wait=1 to optimize passthru server performance. This setting is particularly useful for improving the response time of freetime requests from users in the service to on-premises users. The Domain Configuration tool enables this setting on the passthru servers for you.

When the Domain Configuration tool is run on-premises, the tool adds the following field values to the Server document of each passthru server in the passthru server domain Domino Directory. These values enable connections from authenticated mail servers in the service to pass through to directory synchronization servers and mail hub servers on-premises. v Security - Passthru Use - Route through: mail servers in the service, for example, */SCN/Renovations. v Security - Passthru Use / Destinations allowed: On-premises directory synchronization servers and primary mail hub servers, for example, Directory1/Renovations; Mail1/Renovations

The Domain Configuration tool also creates a Connection document in the Domino directory to each on-premises directory synchronization and primary mail hub servers follows: v Source server: Passthru servers, for example, Passthru1/Renovations; Passthru2/Renovations v Source domain Passthru server domain, for example, SCNPassthru v Destination server: Directory synchronization server or primary mai hub server, for example, Directory1/Renovations or Mail1/Renovations

All tasks and schedules are disabled in each Connection document.

Preparing for directory synchronization Set up at least one Domino server in the on-premises hub domain to be a directory synchronization server. Then prepare to replicate directories to the service. Before you begin

Before you prepare for directory synchronization, make the directory services decisions described in the topic “Planning directory services” on page 21. Setting up directory synchronization servers In the on-premises hub domain, set up at least one Domino server to be a hub server for directory synchronization with the service.

Chapter 3. Preparing your environment 45 About this task

To provide failover, you can set up two directory synchronization servers in the on-premises hub domain. When you configure the service, you configure one as the primary directory server and the other as the optional secondary directory server. After the service replicates successfully with the primary directory server, it continues to use that server as long as it is available. If the server becomes unavailable, the service attempts to replicate with the optional secondary directory server. When the primary directory server becomes available, the service switches back to it.

Perform this procedure for each directory synchronization server you plan to use. Procedure 1. Install and set up a Domino server in the on-premises hub domain, or use an existing server. The server must comply with the following requirements: v If the server is the administration server for the domain, the server must be Domino 8.5.1 Fix Pack 2 or a later version with the corresponding Domino Directory template. If the server is not the administration server, any supported version of Domino is allowed. v The server must be certified under the same top-level Notes certifier as the mail hub servers in the on-premises hub domain, the passthru servers, and the mail servers in the service. 2. Perform the following steps to disable public key checking on the server and to give the server access to the LLNServers group: a. Open the Server document in the Domino Directory in edit mode. b. Click the Security tab. c. In the Compare public keys field in the Security Settings section, select Do not enforce key checking and click OK. d. Perform one of the following steps to give the server access to the LLNServers group: v Add LLNServers to the Access server field. v Clear the users listed in all trusted directories check box and make sure that the Not access server does not prevent access to LLNServers. When you configure the service, the LLNServers group is created in the Domino Directory of the on-premises hub domain when you run the Domain Configuration tool. e. Click Save & Close. Related concepts: “Version requirements for on-premises Domino servers” on page 38 This topic describes the IBM Domino version requirements for on-premises Domino servers. “Certifier requirements in a hybrid environment” on page 37 It is important to understand the following certifier requirements when planning a hybrid environment. Related tasks: “Configuring directory synchronization” on page 89 A directory server in the service has a replica of one or more on-premises IBM Domino directories. To support directory synchronization, provide the name of the primary server and file path of at least one on-premises directory that you want to synchronize. The directory server performs a regular pull and push replication of the directories to keep the contents of both the service and the on-premises replicas

46 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 synchronized. “Using the Pre-configuration Test tool to check your environment” on page 93 After you prepare your on-premises environment but before you run the Domain Configuration tool to configure it to connect to the IBM SmartCloud Notes service, download and run the SmartCloud Notes Hybrid Pre-configuration tool. This tool runs a series of tests to determine if the servers in your environment are set up correctly. The tool provides a report that identifies any issues that might prevent communication between your environment and the service. The tool does not change your configuration. Preparing to replicate Domino directories Prepare to replicate Domino directories in which service users are registered. You might also want to replicate other Domino directories. Before you begin

Read the topics “Planning directory services” on page 21 and “Requirements for synchronized directories” on page 22 About this task

You must replicate to the service Domino directories in which users are registered whom you plan to provision for the service.

You can also replicate Domino directories that contain only Person documents of non-service users. When you replicate these directories, service users can look up the names and addresses of the non-service users in the service directory. The non-service users can be: v On-premises users registered in a Domino domain v On-premises users in a foreign mail domain for whom you manually create Person documents v External users in an external Internet domain for whom you manually create Person documents

To define an internal foreign mail domain in the service, you must create a Global Domain document. The document must be in a directory that is not the primary directory of the on-premises hub domain, and you must replicate this directory to the service.

If there are multiple directories of non-service users, you might want to aggregate the directories into an extended directory catalog. Then you can replicate the directory catalog rather than each directory.

To prepare to replicate a Domino directory to the service, perform the steps in this procedure on each directory synchronization server. Procedure 1. If the directory is not the primary directory of the on-premises hub domain, perform the following steps: a. Create a replica of the directory on each directory synchronization server. Each replica of the directory must use the same path and file name on both directory synchronization servers.

Chapter 3. Preparing your environment 47 b. If you created the replica from a source replica on another server, schedule regular replication of the directory between each directory synchronization server and the source server. v If the directory contains users to be provisioned for the service, schedule two-way replication. v If the directory does not contain users to be provisioned for the service, schedule one-way replication from the source server to the directory synchronization server. Scheduling replication from the directory synchronization server to the source server is optional. 2. Verify that a unique Domino domain is specified in the directory profile: a. Open the Domino Directory. b. Click Actions > Edit Directory Profile. c. Verify that the Domain defined by this Domino Directory field specifies a Domino domain that is unique within your company.

Note: The Pre-configuration Test tool that you run to check your on-premises environment during service configuration also verifies the domain name. 3. If a directory contains users to be provisioned for the service, make sure that the Internet address field in their Person documents has a valid address, for example, sdaryn@renovations. A valid Internet address contains the name of an Internet domain that is owned by your company, defined in a Global Domain document, and validated by the service. 4. If a directory contains users or devices from an internal foreign domain, make sure that Other Internet Mail is selected in the Mail system field of their Person documents. This setting is required for the service to route messages addressed to these users to the on-premises mail hub servers. Related tasks: “Preparing Global Domain documents” on page 49 Prepare at least one Global Domain document to define the Internet domains that your company owns. Preparing to replicate an extended directory catalog An extended directory catalog (EDC) can be used to aggregate entries from multiple Domino directories and replicate the entries to the service. An EDC is supported for read-only use in the service. This procedure is useful only for companies that have more than one Domino directory. About this task

In an environment with multiple Domino directories, aggregating the directories into an EDC improves directory lookup performance.

Aggregating a Domino directory that contains service users into an EDC is recommended for directory lookup performance. However, you must also replicate the full Domino directory to the service, separately.

Although the use of multiple EDCs is supported, for ease of management, use one.

To prepare to replicate an EDC to the service during directory synchronization, perform the following steps.

48 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Procedure 1. Set up the EDC to aggregate all the directories that you want to make available in the service. For more information, see the topic on setting up an extended directory catalog in the Domino documentation.

Note: The EDC must comply with the requirements specific to the service. For example, specific fields must be aggregated into an EDC. For information, see the information about the EDC described in the topic “Requirements for synchronized directories” on page 22. 2. Create a replica of the EDC on each directory synchronization server and on each mail hub server in the on-premises hub domain. Also make sure that the directories aggregated in it are kept up-to-date by the Dircat task. 3. Verify that a unique Domino domain is specified in the directory profile: a. Open the EDC. b. Click Actions > Edit Directory Profile. c. Verify that the Domain defined by this Domino Directory field specifies a unique Domino domain for the directory. If necessary, add a domain name that is unique in your environment to this field.

Note: The Pre-configuration Test tool that you run to check your on-premises environment during service configuration also verifies the domain name. 4. To enable the EDC to be used for free-time lookups, set up your mail hub servers in the on-premises hub domain to use directory assistance to find the EDC. Directory assistance is not required on the directory synchronization servers or passthru servers. For information on directory assistance, see the Domino documentation. a. Create a directory assistance database on one primary mail hub server. b. Create a directory assistance document in that database for the extended directory catalog. Configure the document to point to at least one replica of the EDC on a directory synchronization server or primary mail hub server. Configure the document to point to additional EDC replicas to provide failover. c. If you use an additional primary mail hub server, replicate the directory assistance database to that server. Schedule regular replication of the directory assistance database between the two mail hub servers. Related information:

Domino documentation

Preparing Global Domain documents Prepare at least one Global Domain document to define the Internet domains that your company owns. About this task

The Global Domain documents must be in synchronized Domino directories that replicate to the service. When you configure the service, you verify ownership of the domains that are defined in the replicated Global Domain documents. Global Domain documents are used in the service only to define your Internet domains and not to route mail.

Chapter 3. Preparing your environment 49 Usually you can use Global Domain documents that already exist in production Domino directories. Follow the procedure in this topic to verify that they are configured correctly for the service.

In some situations, you must create a new Domino Directory manually from the pubnames.ntf template, add a new Global Domain document to it, and replicate the new directory to the service. Otherwise, if you put the Global Domain document in the primary Domino directory for a domain, it can prevent proper on-premises mail routing in the domain.

Put a Global Domain document in a manually-created Domino directory to define a Foreign Domain that includes devices, such as printers or faxes. Typically, a Foreign Domain document is used on-premises to route requests to the devices.

Also put a Global Domain document in a manually-created Domino directory if you want to use an asterisk (*) wildcard to define multiple subdomains below one root domain. The root domain is defined in a separate Global Domain document. When you verify the root domain during service configuration, the subdomains are automatically verified, too. This approach is useful if there are many subdomains that do not include service users.

Note: If service users are in a subdomain, you must specify the complete subdomain name in a Global Domain document. The subdomain can also be defined through a wildcard entry.

Domains specified in the Global Domain document field Alternate Internet domain aliases are not handled as alias domains by the service. Instead, each domain in this field is listed and verified in the service as a separate domain, similar to the domain specified in the Local primary Internet domain field. To enable a user to receive mail addressed to a domain in the Alternate Internet domain aliases field, you must specify the user’s address for the domain in the Person document.

If multiple Global Domain documents specify the same domain, the service removes the duplicate domain occurrences.

Perform the following steps to create or verify at least one Global Domain document. Procedure 1. Open the Domino directory in which you want to add or verify a Global Domain document. 2. Click Configuration and then expand the Messaging section. 3. Click Domains and perform one of the following steps: v To verify an existing Global Domain document, select the document and click Edit Domain. v To create a new Global Domain document, click Add Domain. 4. Specify the following fields on the Basics tab. Table 14. Basics tab of Global Domain document Field Step Domain type Select Global Domain. Global domain name Type any descriptive name.

50 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 14. Basics tab of Global Domain document (continued) Field Step Global domain role Select R5/R6/R7/R8. Use as default Global Domain Select if you use more than one Global Domain document and you want this domain to be the default.

5. Ignore the Restrictions tab. The service does not use information in this tab. 6. Verify that the following fields on the Conversions tab correctly define an Internet domain. Ignore the other fields in this tab; the service does not use them. Table 15. Conversions tab of Global Domain document Field Step Local primary Internet domain Type a domain name, for example, renovations.com.

To specify multiple subdomains at once, use an asterisk (*) as a wildcard. For example, if your company owns these subdomains: west.renovations.com east.renovations.com north.renovations.com

type: *.renovations.com

If you use a wildcard, you must specify the root domain in a separate Global Domain document. Note: If a service user is in a subdomain, you must specify the complete subdomain name in a separate Global Domain document. Alternate Internet domain aliases Type any additional domain names, separated by a comma (,). For example, type renovations.org, renovations.net. Note: When you configure the service, each domain in this field is listed as a separate domain to be verified.

7. Click Save & Close. 8. Restart the server. This step is not necessary if the Global Domain document is in a new directory created only for use with the service. What to do next

Prepare to replicate the directory that contains the Global Domain document to the service. Related tasks: “Adding multiple Internet email addresses to Person documents” on page 207 You can include multiple Internet email addresses in a Person document.

Chapter 3. Preparing your environment 51 Preparing for mail routing To prepare for mail routing between the service and your on-premises environment, first set up at least one mail hub server in your on-premises hub domain. Then prepare to route mail from service users and to service users.

No configuration is required to route mail sent between service users at your company. This mail is routed automatically within the service. Setting up mail hub servers in the on-premises hub domain In the on-premises hub domain, set up at least one IBM Domino server to be a hub server for mail routing with the service. Before you begin

Make the mail routing decisions described in the topic “Planning mail routing and mail settings” on page 29. About this task

When any service user sends mail to any on-premises user or device, the service routes the mail to a mail hub server in the on-premises hub domain. The mail hub server then routes the mail to the final destination or next hop to the final destination, if required.

To provide failover, set up two mail hub servers in the on-premises hub domain. The service attempts to route to the primary mail hub server first, which is the server with the name that comes first in alpha-numeric order. For example, if the two server names are MailA/Renovations and MailB/Renovations, the primary server is MailA/Renovations. If the two servers are Mail1/Renovations and Mail2/Renovations, the primary server is Mail1/Renovations.

If the service is unable to route to the primary mail hub server due to network or server unavailability, it attempts to use the secondary server. When the primary mail hub server becomes available, the service begins using it again after a period of time. The service may use both servers simultaneously for brief intervals.

If there are service users registered in the on-premises hub domain, the mail hub server handles routing their mail to the service.

For information on installing and setting up Domino servers, see the Domino documentation. Procedure 1. Install and set up a Domino server in the on-premises hub domain, or use an existing server. The server must comply with the following requirements: v Domino version requirement: 8.5.1 Fix Pack 2 or later version. v Notes certifier requirement: The same top-level organization certifier as the directory synchronization servers, passthru servers, and mail servers in the service. 2. Perform the following steps to disable public key checking on the server and to give the server access to the LLNServers group: a. Open the Server document in the Domino directory in edit mode. b. Click the Security tab.

52 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 c. In the Compare public keys field in the Security Settings section, select Do not enforce key checking and click OK. d. Perform one of the following steps to give the server access to the LLNServers group: v Add LLNServers to the Access server field. v Clear the users listed in all trusted directories check box and make sure that the Not access server does not prevent access to LLNServers. When you configure the service, LLNServers group is created in the Domino directory of the on-premises hub domain when you run the Domain Configuration tool. e. Click Save & Close. What to do next

Prepare for mail routing. Related concepts: “Version requirements for on-premises Domino servers” on page 38 This topic describes the IBM Domino version requirements for on-premises Domino servers. “Certifier requirements in a hybrid environment” on page 37 It is important to understand the following certifier requirements when planning a hybrid environment. Related information:

Domino documentation Preparing to route mail from service users Prepare to route mail from service users to on-premises users and devices or to external users. Preparing to route mail from service users to on-premises users and devices When service users send mail to on-premises users or devices, the mail is routed to a mail hub server in the on-premises hub domain. If recipients are in a different domain, you configure the routing to the final destination.

Before you begin

Make sure that you have set up at least one mail hub server in the on-premises hub domain.

About this task

When service users address mail to any on-premises user or device, the service routes the mail to a mail hub server in the on-premises hub domain. This routing is done automatically using Connection documents created when the Domain Configuration tool is run during service configuration.

If recipients are in a different domain, you are responsible for configuring routing to that domain. Recipients might be: v On-premises users in other Domino domains. v On-premises users in foreign domains who do not use Domino mail servers. v On-premises devices in foreign domains, such as printers and faxes.

Chapter 3. Preparing your environment 53 For more information, see the topic “Setting up Notes routing” in the Domino documentation. Related concepts: “Examples: Routing internal mail” on page 60 These examples illustrate mail routing between service users and on-premises users and devices. Related tasks: “Preparing Global Domain documents” on page 49 Prepare at least one Global Domain document to define the Internet domains that your company owns. Related information:

Domino documentation Preparing to use a company SMTP server to route outbound Internet mail You can configure a company SMTP host server to route mail that service users send to external users.

About this task

Skip this procedure if you want the service to handle routing the mail that is sent to external users. In this case (default behavior), the service filters the messages for virus and spam before routing them to the Internet.

By using a company SMTP host server for external routing, you can act on messages before routing them, for example, filter or audit messages. When you use this feature, the service filters messages for viruses and spam and then routes them directly to your designated SMTP host server. Messages addressed to any domain that is not an internal, service-verified domain are routed to the SMTP host server.

The service uses Transport Layer Security (TLS) to route mail to the SMTP host server if the host server uses TLS. The connection is made using STARTTLS over SSL TCP/IP port 25.

Procedure 1. Configure your SMTP host server to accept mail from one of the following SMTP host servers in the service: v If you use the United States data center: smtp.notes.na.collabserv.com v If you use the Asia Pacific data center: smtp.notes.ap.collabserv.com v If you use the European data center: smtp.notes.ce.collabserv.com For more information on this step if you use a Domino SMTP server, see the topic about enabling a server to receive mail sent over SMTP routing in the Domino documentation. 2. Configure the corporate firewall to allow inbound connections over port 25 from the service SMTP host server specified in the previous step. For more information, see the topic Configuring the firewall for inbound connections. 3. If specifying a maximum message size, configure your SMTP host server to accept messages up to 100 MB in size, the maximum message size allowed by the service. For more information on this step if you use a Domino SMTP server, see the topic about restricting mail routing based on message size in the Domino documentation.

54 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 4. Configure your SMTP host server to relay mail to external Internet domains. For more information on this step if you use a Domino SMTP server, see the topic about setting inbound relay controls in the Domino documentation. 5. Configure your SMTP host server to route mail to the Internet. For more information on this step if you use a Domino SMTP server, see the topic about setting up SMTP routing to external Internet domains in the Domino documentation.

What to do next

When you complete the service configuration, perform the procedure “Specifying an SMTP server to route mail to the Internet” on page 160. Related concepts: “Example: Routing mail from a service user to an external user using a service SMTP host” on page 70 This example illustrates how mail is routed from a service user to an external user on the Internet when the service manages the routing. “Example: Routing mail from a service user to an external user using a company SMTP host” on page 71 This example illustrates how mail is routed from a service user to an external user on the Internet when a company SMTP server routes the mail. Related information:

Domino documentation Preparing to route mail to service users Prepare mail servers in the Domino domains in which service users are registered to route mail to the users. Preparing to route mail to service users registered in the on-premises hub domain If service users are registered in the on-premises hub domain, prepare to route mail to those users through the mail hub servers in the domain.

Before you begin

Prepare your on-premises mail hub servers.

About this task

If there are no service users in the hub domain, skip this procedure.

The mail hub servers in the hub domain route mail to service users who are registered in the domain. Connection documents that the Domain Configuration tool creates when you configure the service are used to route the mail. You specify settings for the mail hub servers to optimize mail routing performance.

Mail sent from on-premises users in the on-premises hub domain to service users in the domain is routed automatically. To route mail from on-premises users in other domains to the service users in the on-premises hub domain, configure mail routing from the other domains to the on-premises hub domain. You can route mail from other Domino domains or foreign domains that do not include Domino mail servers. For more information, see the topic “Setting up Notes routing” in the Domino documentation.

Chapter 3. Preparing your environment 55 To route mail from external users on the Internet to the service users in the on-premises hub domain, configure an SMTP server to accept the mail. Then route the mail to a mail hub server in the on-premises hub domain. You are responsible for configuring virus scanning and spam filtering on mail received from the Internet. For more information, see the topic “Configuring Domino to send and receive mail over SMTP” in the Domino documentation.

Perform the steps in this procedure to optimize mail routing for each mail hub server in the on-premises hub domain.

Procedure 1. Customize the routing retry interval by performing the following steps on each mail hub server: a. From the Domino Administrator client, open a server in the domain. b. Click Configuration > Server > Configurations. c. Create or edit a Configuration Settings document that applies to the mail hub server. d. Click Router/SMTP > Restrictions and Controls > Transfer Controls. e. In the Initial transfer retry interval field, specify 1 minutes. 2. To allow the use of multiple transfer threads for mail routing, perform the following steps on each mail hub server: a. Add the following setting to the server notes.ini file: RouterAllowConcurrentXferToAll=1 b. Perform the following steps to limit the number of transfer threads used for routing to any single destination. This setting reduces the chance that routing to one destination over a slow connection will monopolize transfer threads and prevent routing to other destinations. 1) From the Domino Administrator, click Configuration > Server > Configurations 2) Add or edit a Configuration Settings document that applies to the mail server. 3) Click Router/SMTP > Restrictions and Controls > Transfer Controls. 4) In the Maximum concurrent transfer threads field, specify 4.

Note: These steps allow the use of multiple transfer threads when routing mail to any destination, not only to the service. After users are provisioned for the service, monitor mail routing. Ensure that the setting does not negatively affect the performance of routing to destinations other than the service. Related concepts: “Examples: Routing internal mail” on page 60 These examples illustrate mail routing between service users and on-premises users and devices. “Examples: Routing external mail” on page 68 These examples illustrate routing mail between service users and external users over the Internet. Related information:

Domino documentation

56 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Preparing to route mail to service users in a secondary domain If service users are in a secondary Domino domain (a domain that is not the on-premises hub domain) prepare to route mail to the users through mail hub servers in the secondary domain.

About this task

Skip this procedure if all service users are in the on-premises hub domain.

To configure mail routing to service users in a secondary domain, create required Connection documents in the Domino directory of the domain, as described in this procedure. Also configure settings to optimize mail routing performance, as described in this procedure.

The steps in this procedure enable mail sent from on-premises users in the secondary domain to be routed to service users also in the domain. To route mail from on-premises users in other domains to the service users in the secondary domain, configure mail routing from the other domains to the secondary domain. You can route mail from other Domino domains or foreign domains that do not include Domino mail servers. For more information, see the topic “Setting up Notes routing” in the Domino documentation.

To route mail from external users on the Internet to the service users in the secondary domain, configure an SMTP server to accept the mail. Then route the mail to a mail hub server in the secondary domain. For more information, see the topic “Configuring Domino to send and receive mail over SMTP” in the Domino documentation. You are responsible for configuring virus scanning and spam filtering on mail received from the Internet.

Procedure 1. Install and set up at least one Domino server in the domain to be a mail hub server, or use an existing server. Servers that route mail to the service must be Domino 8.5.1 Fix Pack 2 or a later version. 2. Create the following Connection documents in the Domino directory of the service user domain. These Connection documents enable servers to connect and route mail to the service. Table 16. Connection document used to connect to the service Field Value Additional information Basics - Connection type Local Area Network None Basics - Source server * None Basics - Source domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations domains. Basics - Use the ports Appropriate TCP/IP port None Basics - Usage priority Normal None Basics - Destination server *mail_server_certifier For example, if your service mail server certifier is /SCN/Renovations, specify */SCN/Renovations. Basics - Destination domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations domains.

Chapter 3. Preparing your environment 57 Table 16. Connection document used to connect to the service (continued) Field Value Additional information Basics - Optional network notes.na.collabserv.com or DNS host name of the proxy address notes.ap.collabserv.com, server in the service. depending on the data center that your company uses. Replication/Routing - Disabled None Replication task Replication/Routing - None None Routing task Schedule Disabled None

Table 17. Connection document used to route mail from mail servers in the on-premises domain to mail hub servers in the service. Field Value Additional information Basics - Connection type Local Area Network None Basics - Source server Name of a local mail hub If you specify a group: server or mail hub server v The group name must group in a service user occur before the name domain to route mail to the LLNMailHubs alphabetically. service, for example, For example, use Mailhub2/Renovations or HubMailGroup but not HubMailGroup. MailGroupHub. v Other servers in the domain The group name should must be able to route mail to not be CustomerMailHubs, this server or group. which is a group that already exists for use in the service. v The group type must be Servers only. v The members must be the names of servers to route mail to the service. Basics - Source domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations domains Basics - Usage priority Normal None Basics - Destination server LLNMailHubs None Basics - Destination domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations. domains Basics - Optional network notes.na.collabserv.com or DNS host name of the proxy address notes.ap.collabserv.com, server in the service. depending on the data center that your company uses. Replication/Routing - Disabled None Replication task Replication/Routing - Mail routing None Routing task Schedule Enabled None

58 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 18. Connection document used to messages from mail hub servers in the service to service user mail servers Field Value Additional information Basics - Connection type Local Area Network None Basics - Source server LLNMailHubs This is the group of mail hub servers in the service. Basics - Source domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations domains. Basics - Usage priority Normal None Basics - Destination server LLNServers This is the group of mail and directory servers in the service. Basics - Destination domain Name of the service user Specify the same value for domain, for example, the Source and Destination PowerRenovations domains. Basics - Optional network Leave blank None address Replication/Routing - Disabled None Replication task Replication/Routing - Mail routing None Routing task Schedule Enabled None

3. Perform the followings steps to give each server access to the LLNServers group. a. Open the Server document in the Domino Directory for the domain. b. Click the Security tab. c. Perform one of the following steps: v Add LLNServers to the Access server field. v Clear the users listed in all trusted directories check box and make sure that the Not access server does not prevent access to LLNServers. 4. Customize the routing retry interval by performing the following steps on each mail hub server: a. From the Domino Administrator client, open a server in the domain. b. Click Configuration > Server > Configurations. c. Create or edit a Configuration Settings document that applies to the mail hub server. d. Click Router/SMTP > Restrictions and Controls > Transfer Controls. e. In the Initial transfer retry interval field, specify 1 minutes. 5. To allow the use of multiple transfer threads for mail routing, perform the following steps on each mail hub server: a. Add the following setting to the server notes.ini file: RouterAllowConcurrentXferToAll=1 b. Perform the following steps to limit the number of transfer threads used for routing to any single destination. This setting reduces the chance that routing to one destination over a slow connection will monopolize transfer threads and prevent routing to other destinations.

Chapter 3. Preparing your environment 59 1) From the Domino Administrator, click Configuration > Server > Configurations 2) Add or edit a Configuration Settings document that applies to the mail server. 3) Click Router/SMTP > Restrictions and Controls > Transfer Controls. 4) In the Maximum concurrent transfer threads field, specify 4.

Note: These steps allow the use of multiple transfer threads when routing mail to any destination, not only to the service. After users are provisioned for the service, monitor mail routing. Ensure that the setting does not negatively affect the performance of routing to destinations other than the service. Related concepts: “Examples: Routing internal mail” These examples illustrate mail routing between service users and on-premises users and devices. “Examples: Routing external mail” on page 68 These examples illustrate routing mail between service users and external users over the Internet. Related information:

Domino documentation Examples: Routing internal mail These examples illustrate mail routing between service users and on-premises users and devices. Example: Routing mail between users in the on-premises hub domain This example illustrates how mail is routed between a service user and on-premises user when both are registered in the on-premises hub domain. Table 19. Servers used in this example Server Description Mail1/Renovations On-premises user’s mail server in the on-premises hub domain, Renovations Mailhub/Renovations Mail hub server in the Renovations domain Passthru1/Renovations On-premises passthru server in the SCNPassthru domain used for inbound connections from the service. Mail1/SCN/Renovations Service user’s mail server in the Renovations domain.

How mail is routed from the on-premises user to the service user

When the on-premises user addresses mail to the service user, the following steps occur to route the mail. 1. The on-premises users’s mail server, Mail1/Renovations, routes the mail to the on-premises hub server, Mailhub/Renovations. 2. Mailhub/Renovations routes the mail to a mail hub server in the service, connecting through a proxy server in the service. Connection documents created by the Domain Configuration tool are used to route the mail.

60 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 3. The mail hub server in the service routes the mail to the service user’s mail server, Mail1/SCN/Renovations. A Connection document created by the Domain Configuration tool is used to route the mail.

.

Routing mail from an on-premises user to a service user when both users are in the on-premises hub domain

How mail is routed from the service user to the on-premises user

When the service user sends mail to the on-premises user, the following steps occur to route the mail. 1. The service user’s mail server, Mail1/SCN/Renovations, routes the mail to a mail hub server in the service. 2. The mail hub server in the service routes the mail to the on-premises mail hub server, Mailhub/Renovations. The mail hub server connects through the on-premises passthru server, Passthru1/Renovations, in the SCNPassthru domain. 3. The on-premises mail hub server, Mailhub/Renovations, routes the mail to the on-premises user’s mail server, Mail1/Renovations.

Chapter 3. Preparing your environment 61 .

Routing mail from a service user to an on-premises user when both users are in the on-premises hub domain

Example: Routing mail between users in a secondary domain This example illustrates how mail is routed between a service user and an on-premises user when both users are registered in a Domino domain that is not the on-premises hub domain. Table 20. Servers used in this example Server Description Mail2/Renovations On-premises user’s mail server in the PowerRenovations domain Mailhub2/Renovations Mail hub server in the PowerRenovations domain Mailhub/Renovations Mail hub server in the on-premises hub domain, Renovations Passthru1/Renovations On-premises passthru server in the SCNPassthru domain used for inbound connections from the service

62 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 20. Servers used in this example (continued) Server Description Mail2/SCN/Renovations Service user’s mail server in the PowerRenovations domain

How mail is routed from the on-premises user to the service user

When the on-premises user sends mail to the service user, the following steps occur to route the mail. 1. The on-premises users’s mail server, Mail2/Renovations, routes the mail to the mail hub server in the PowerRenovations domain, Mailhub2/Renovations. 2. Mailhub2/Renovations routes the mail to a mail hub server in the service. v Mailhub2/Renovations connects through a proxy server in the service. v Connection documents that a company administrator creates in the PowerRenovations directory are used to route the mail. 3. The mail hub server in the service routes the mail to the service user’s mail server, Mail2/SCN/Renovations. v A Connection document that a company administrator creates in the PowerRenovations directory is used to route the mail.

Chapter 3. Preparing your environment 63 .

Routing mail from an on-premises user to a service user when both users are in a secondary Domino domain.

How mail is routed from the service user to the on-premises user

When the service user sends mail to the on-premises user, the following steps occur to route the mail. 1. The service user’s mail server, Mail1/SCN/Renovations, routes the mail to a mail hub server in the service. 2. The mail hub server in the service routes the mail to the mail hub server in the Renovations domain, Mailhub/Renovations. v The mail hub server in the service connects through the on-premises passthru server, Passthru1/Renovations, in the SCNPassthru domain. 3. Mailhub/Renovations routes the mail to the mail hub server in the PowerRenovations domain, Mailhub2/Renovations.

64 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v A Connection document created by the company administrator is used to route the mail. 4. Mailhub2/Renovations routes the mail to the on-premises user’s mail server, Mail2/Renovations.

.

Routing mail from a service user to an on-premises user when both users are in a secondary domain.

Example: Routing mail between users in different Domino domains This example illustrates how mail is routed between a service user registered in the on-premises hub domain and an on-premises user registered in a secondary domain.

Chapter 3. Preparing your environment 65 Table 21. Servers used in this example Server Description Mail2/Renovations On-premises user’s mail server in the PowerRenovations domain Mailhub2/Renovations Mail hub server in the PowerRenovations domain Mailhub/Renovations Mail hub server in the Renovations domain, which is the on-premise hub domain and the service user’s domain. Passthru1/Renovations On-premises passthru server in the SCNPassthru domain used for inbound connections from the service Mail1/SCN/Renovations Service user’s mail server in the Renovations domain

How mail is routed from the on-premises user to the service user

When the on-premises user sends mail to the service user, the following steps occur to route the mail. 1. The on-premises users’s mail server, Mail2/Renovations, routes the mail to the mail hub server in the PowerRenovations domain, Mailhub2/Renovations. 2. Mailhub2/Renovations routes the mail to the mail hub server in the service user’s domain, in this case, the server Mailhub/Renovations in the Renovations domain. v Connection documents created by a company administrator are used to route the mail. 3. Mailhub/Renovations routes the mail to a mail hub server in the service. v Mailhub/Renovations connects to the service through a proxy server in the service. v Connection documents that the Domain Configuration tool created in the Renovations domain directory are used to route the mail. 4. The mail hub server in the service routes the mail to the service user’s mail server, Mail1/SCN/Renovations. v A Connection document that the Domain Configuration tool creates in the Renovations domain directory is used to route the mail.

66 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 .

Routing mail from an on-premises user in a secondary domain to a service user in the on-premises hub domain.

How mail is routed from the service user to the on-premises user

When the service user sends mail to the on-premises user, the following steps occur to route the mail. 1. The service user’s mail server, Mail1/SCN/Renovations, routes the mail to a mail hub server in the service. 2. The mail hub server in the service routes the mail to the on-premises mail hub server in the Renovations domain, Mailhub/Renovations. v The mail hub server in the service connects through the on-premises passthru server, Passthru1/Renovations, in the SCNPassthru domain.

Chapter 3. Preparing your environment 67 3. The on-premises mail hub server, Mailhub/Renovations, routes the mail to the mail hub server in the PowerRenovations domain, Mailhub2/Renovations. v Connection documents that the company administrator creates are used to route the mail. 4. Mailhub2/Renovations routes the mail to the on-premises user’s mail server, Mail2/Renovations.

.

Routing mail from a service user in the on-premises hub domain to an on-premises user in secondary Domino domain.

Examples: Routing external mail These examples illustrate routing mail between service users and external users over the Internet.

68 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Example: Routing mail from an external user to a service user This example illustrates how mail is routed from an external user on the Internet to a service user.

In this example: v The external user is in the zetabank.com domain. v The external SMTP server is smtp.zetabank.com. v The on-premises SMTP server is smtp.renovations.com. v The service user is in the renovations.com Internet domain and in the Renovations Domino domain. v The on-premises hub domain is Renovations. v The on-premises mail hub server is Mailhub/Renovations. v The service user’s mail server is Mail1/SCN/Renovations.

When the external user from the zetabank.com domain sends mail to the service user in the internal domain renovations.com, the following steps occur to route the mail. 1. The external SMTP server, smtp.zetabank.com, routes the mail to the on-premises SMTP server, smtp.renovations.com, over the Internet. 2. smtp.renovations.com receives the mail, scans it for viruses and spam, and then routes the mail to the on-premises mail hub server, Mailhub/Renovations, in the Renovations Domino domain. v A company administrator configures the routing to Mailhub/Renovations. 3. Mailhub/Renovations routes the mail to a mail hub server in the service over NRPC. v Mailhub/Renovations connects through a proxy server in the service. v Connection documents created by the Domain Configuration tool are used to route the mail. 4. The mail hub server in the service routes the mail to the service user’s mail server, Mail1/SCN/Renovations. v A Connection document created by the Domain Configuration tool is used to route the mail.

Chapter 3. Preparing your environment 69 .

Routing mail from an external user to a service user

Example: Routing mail from a service user to an external user using a service SMTP host This example illustrates how mail is routed from a service user to an external user on the Internet when the service manages the routing.

In this example: v The external user is in the zetabank.com domain. v The external SMTP server is smtp.zetabank.com. v The service user is in the renovations.com Internet domain. v The service user’s mail server is Mail1/SCN/Renovations.

70 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 When the service user sends mail to the external user in the zetabank.com domain, the following steps occur to route the mail. 1. The service user’s mail server, Mail1/SCN/Renovations, routes the mail to an SMTP server in the service. 2. The SMTP server in the service routes the mail to a mail hygiene server in the service. 3. The mail hygiene server scans the mail for viruses and spam and then routes the mail to the external SMTP server, smtp.zetabank.com, over the Internet.

.

Service routing mail from a service user to an external user

Example: Routing mail from a service user to an external user using a company SMTP host This example illustrates how mail is routed from a service user to an external user on the Internet when a company SMTP server routes the mail.

In this example: v The external user is in the zetabank.com domain.

Chapter 3. Preparing your environment 71 v The external SMTP server is smtp.zetabank.com. v The on-premises SMTP server is smtp.renovations.com. v The service user is in the renovations.com domain. v The service user’s mail server is Mail1/SCN/Renovations.

When the service user addresses mail to the external user in the zetabank.com domain, the following steps are taken to route the mail. 1. The service user’s mail server, Mail1/SCN/Renovations, routes the mail to an SMTP server in the service. 2. The SMTP server in the service routes the mail to a mail hygiene server in the service. 3. The mail hygiene server in the service scans the mail for viruses and spam and then routes the mail to the on-premises SMTP server, smtp.renovations.com. 4. The on-premises SMTP server, smtp.renovations.com, filters and audits the mail, and then routes the mail to the external SMTP server, smtp.zetabank.com.

72 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 .

Company-controlled SMTP server routing mail from a service user to an external user

Preparing for calendars and scheduling You can prepare for on-premises users and service users to look up each others’ free time when scheduling meetings. You can also prepare for service users to reserve resources in on-premises Resource Reservations databases. Before you begin

Read “Planning calendars and scheduling” on page 31 to understand how calendars and scheduling works in the service and the requirements to use it.

For more information on IBM Domino scheduling, see the Domino documentation.

Chapter 3. Preparing your environment 73 Procedure 1. Perform the following tasks to prepare for free-time requests between service users and on-premises users: v Make sure that any on-premises server that will request free-time of service users runs Domino 8.5.1 Fix Pack 2 or a later version. v Disable public key checking on any on-premises server that will request free-time of service users. On the Security tab of the Server document, in the Compare public keys field, select Do not enforce key checking. v Verify that the CalConn server task is specified in the ServerTasks line in the notes.ini file of each on-premises mail server and Calendar server that will request free time of service users. The task uses CPU or memory resources only when handling free-time requests. v In a multi-domain environment, perform the following additional steps to enable service users to request free-time of on-premises users: – If on-premises users are not in the on-premises hub domain, make sure the primary directory of the on-premises hub domain has a domain document that specifies a Calendar server for the domain of the on-premises users. – If a directory catalog is used in the on-premises hub domain, make sure that mail hub servers in the domain are configured to use directory assistance to look up names in it. – If you do not synchronize the primary Domino directory of the on-premises hub domain, copy the CustomerMailHubs group in it to a synchronized directory. Keep the group type as Servers only. This step must be done after you configure the service and run the Domain Configuration tool, because the tool creates the group initially. v In a multi-domain environment, perform the following additional steps to enable on-premises users to request the free-time of service users: – If the service users are not in the on-premises hub domain, create a Connection document in the primary directory of the service users’ domain that enables mail servers in the domain to connect to the service to send the free-time request. If you configure mail routing from the service user domain to the service, this step is complete as part of that configuration. – If the on-premises users are in a different domain than the service users, make sure the primary directory of the on-premises user domain has a domain document that specifies the Calendar server for the domain of the service users. 2. Perform the following steps to prepare for service users to reserve rooms and resource in an on-premises Resource Reservations database: v Synchronize the directory of the domain in which a Resource Reservations database is located. v If a Resource Reservations database is not in the on-premises hub domain, configure mail routing from the on-premises hub domain to the other domain. v To enable a service user to look up the free-time of a room or resource, make sure a server in the on-premises hub domain can look up free-time in the Resource Reservations database or can connect to a server that can. v If the directory of the domain that contains the Resource Reservations database is aggregated in a directory catalog, specify the following settings in the Extended Directory Catalog configuration document:

74 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 – Include the following field names in the Additional fields to include field: ResourceFlag, ResourceType, and ResourceCapacity – In the Include Mail-In Databases field, select Yes. v Remove duplicate site names that are used for rooms and resources across directories. If two sites have the same name, the service lists resources from both sites under one site name. This situation can lead users to reserve resources at the wrong site. See Technote 1473022 for instructions on making site names unique. What to do next Related tasks: “Preparing to replicate an extended directory catalog” on page 48 An extended directory catalog (EDC) can be used to aggregate entries from multiple Domino directories and replicate the entries to the service. An EDC is supported for read-only use in the service. This procedure is useful only for companies that have more than one Domino directory. “Downloading and running the Domain Configuration tool” on page 94 The Domain Configuration tool configures your on-premises servers to connect to your hosted IBM SmartCloud Notes servers. The server configuration information that you provide in the Account Settings of SmartCloud Notes Administration is the data that is used to configure the connections. Related information:

Domino documentation

Technote 1473022

Example of integrating a secondary domain with the service Example: Free-time requests between users in the on-premises hub domain This example illustrates how free-time requests occur between a service user and an on-premises user who are both registered in the on-premises hub domain. Table 22. Servers used in this example Server Description Mail1/Renovations On-premises user’s mail server in the on-premises hub domain, Renovations Mailhub/Renovations Mail hub server in the Renovations domain Passthru1/Renovations On-premises passthru server in the SCNPassthru domain used for inbound connections from the service. Mail1/SCN/Renovations Service user’s mail server in the Renovations domain.

On-premises user requesting free time of service user

When the on-premises user requests the free-time of the service user, the following steps occur to process the request: 1. The on-premises user’s mail server, Mail1/Renovations, looks up the name of the service user’s mail server, Mail1/SCN/Renovations, in the Renovations directory.

Chapter 3. Preparing your environment 75 2. Mail1/Renovations sends the free-time request to Mail1/SCN/Renovations. v Mail1/Renovations runs the CalConn server task. v A Connection document created by the Domain Configuration tool in the Renovations domain directory enables Mail1/Renovations to send the request through the proxy server in the service. 3. Mail1/SCN/Renovations looks up the user’s free time in its Free Time database and returns it to Mail1/Renovations.

.

On-premises user requesting free-time of service user when both are in the on-premises hub domain.

Service user requesting free time of on-premises user

When the service user requests the free-time of the on-premises user, the following steps occur to process the request: 1. The service user’s mail server, Mail1/SCN/Renovations, looks up the name of the on-premises user in the service directory and determines that the user’s mail server is on-premises. 2. Mail1/SCN/Renovations sends a free-time request to the mail hub server, Mailhub/Renovations, in the on-premises hub domain.

76 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v Mail1/SCN/Renovations finds the names of all servers in the CustomerMailHubs and attempts to fetch free-time for each one until it succeeds when trying Mailhub/Renovations. The Domain Configuration tool creates the group in the directory of the on-premises hub domain and the group replicates to the service during directory synchronization. v Connection documents created in the service at time of customer creation enable Mail1/SCN/Renovations to connect to Mailhub/Renovations through the server Passthru1/Renovations. 3. Mailhub/Renovations sends the request to the on-premises user’s mail server, Mail1/Renovations. 4. Mail1/Renovations looks up the user’s free time in its Free Time database and returns it to Mailhub/Renovations. 5. Mailhub/Renovations returns the free time to Mail1/SCN/Renovations.

.

Service user requesting free-time of on-premises user when both are in the on-premises hub domain.

Chapter 3. Preparing your environment 77 Example: Free-time requests between users in different domains This example illustrates how free-time requests occur between an on-premises user in a secondary domain and a service user in the on-premises hub domain. Table 23. Servers used in this example Server Description Mail2/Renovations On-premises user’s mail server in the PowerRenovations domain Mailhub2/Renovations Calendar server for the PowerRenovations domain Mailhub/Renovations Mail hub server and Calendar Server for the on-premises hub domain, Renovations Passthru1/Renovations On-premises passthru server in the SCNPassthru domain used for inbound connections from the service Mail2/SCN/Renovations Service user’s mail server in the Renovations domain

On-premises user requesting free time of service user

When the on-premises user requests the free-time of the service user, the following steps occur to process the request: 1. The on-premises user’s mail server, Mail2/Renovations, looks up the service user’s mail server in a local directory catalog. 2. Mail2/Renovations sends a free-time request to Mailhub2/Renovations, the Calendar Server for the PowerRenovations domain. v Both servers run the CalConn server task. 3. Mailhub2/Renovations sends the request to Mailhub/Renovations, the Calendar Server for the Renovations domain. v Mailhub/Renovations runs the CalConn server task. 4. Mailhub/Renovations sends the requests to the service user’s mail server, Mail1/SCN/Renovations. v A Connection document created by the Domain Configuration tool in the Renovations domain directory enables Mailhub/Renovations to send the request through the proxy server in the service. 5. Mail1/SCN/Renovations looks up the user’s free time in its Free Time database and returns it to Mailhub/Renovations. 6. Mailhub/Renovations returns the free time to Mailhub2/Renovations. 7. Mailhub2/Renovations returns the free time to Mail2/Renovations.

78 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 .

On-premises user in secondary domain requesting free-time of service user in on-premises hub domain

Service user requesting free time of on-premises user

When the service user requests the free-time of the on-premises user, the following steps occur to process the request: 1. The service user’s mail server, Mail1/SCN/Renovations, looks up the name of the on-premises user in the service directory and determines that the user’s mail server is on-premises. 2. The service user’s mail server, Mail1/SCN/Renovations, sends a free-time request to the mail hub server, Mailhub/Renovations, in the on-premises hub domain. v Mail1/SCN/Renovations finds the names of all servers in the CustomerMailHubs and attempts to fetch free-time for each one until it succeeds when trying Mailhub/Renovations. The Domain Configuration tool

Chapter 3. Preparing your environment 79 creates the group in the directory of the on-premises hub domain and the group replicates to the service during directory synchronization. v Connection documents created in the service at time of customer creation enable Mail1/SCN/Renovations to connect to Mailhub/Renovations through the server Passthru1/Renovations. 3. Mailhub/Renovations, the Calendar Server for the Renovations domain, sends the request to Mailhub2/Renovations, the Calendar Server for the PowerRenovations domain. 4. Mailhub2/Renovations sends the request to Mail2/Renovations, the on-premises user’s mail server. 5. Mail2/Renovations looks up the user’s free time in its Free Time database and returns it to Mailhub2/Renovations. 6. Mailhub2/Renovations returns the free time to Mailhub/Renovations. 7. Mailhub/Renovations returns the free time to Mail1/SCN/Renovations.

80 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 .

Service user in on-premises hub domain requesting free-time of on-premises user in a secondary domain.

Helping service users connect to application servers in secondary domains Service users can connect to on-premises IBM Domino servers to open applications. If the application servers are in the same Domino domain as your primary mail hub servers, service users see them listed in the Open Application window in IBM Notes. If the application servers are in a secondary domain, use an External Domain Network Information (EDNI) document. Then run the GETADRS program to enable the secondary domain servers to be listed in the Open Application window. In this case, users click Other in the window to see the servers listed.

Chapter 3. Preparing your environment 81 Create an EDNI document for each secondary domain in the Domino directory of the primary mail hub server domain. Then schedule the GETADRS program to run regularly on one server in the primary mail hub server domain. GETADRS pulls the names and addresses of each server from the secondary domain into Response documents to the EDNI document. To determine how to connect to a server in the secondary domain, a server in the service uses the Response document for that server. The EDNI document and Response documents do not replicate to the mail servers in the service. Rather, the servers in the service look them up on one of your primary mail hub servers.

EDNI documents make it easier for users to connect to application servers, but they are not required. If you do not use EDNI documents, Connection documents and bookmarks used previously to connect to the servers still work after users are provisioned for the service. Users can also connect to the servers by typing the server names in the Open Application window.

For more information, see the topic on setting up external domain lookups in the Domino documentation. Related information:

Domino documentation

82 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 4. Configuring the service

After you have prepared your on-premises environment, configure the service to work with your environment. Related tasks: Chapter 3, “Preparing your environment,” on page 39 Perform the steps in this section to prepare your on-premises servers for a hybrid environment. Perform these steps after you have planned for the service and before you configure the service.

Roadmap to configuring a hybrid environment When you configure a hybrid environment, you establish connections between your on-premises IBM Domino servers and IBM SmartCloud Notes servers. To help you accomplish this task, a Domain Configuration tool is provided for you that makes the necessary configuration changes to your environment, based on information you provide. During configuration you also provide a certifier ID for your SmartCloud Notes mail servers and you enable the service to verify ownership of at least one Internet domain. Before you begin

Before you configure a hybrid environment, perform the procedures in Preparing your environment. Also make sure that IBM has created the SmartCloud Notes account for your company, and that you have completed the task Logging on as the first company administrator.

The following table describes the tasks required to configure a hybrid environment and includes links to topics that describe the corresponding procedures. Table 24. Tasks to configure a hybrid environment Task Estimated time to complete How to confirm completion Complete a checklist to make Varies, depending how many Review the worksheet for sure all prerequisite tasks are required tasks are complete. accuracy and completeness. done and to record information you will provide to configure account sesttings. For more information, see “Completing a checklist to prepare for configuration” on page 87.

© Copyright IBM Corp. 2011 83 Table 24. Tasks to configure a hybrid environment (continued) Task Estimated time to complete How to confirm completion Configure account settings 15-30 minutes, total Confirm that there is a by performing the following checkmark next to each tasks in any order. Account setting in the Account Setup settings provide the window in SmartCloud information about your Notes Administration. on-premises environment that is required by the Domain Configuration tool. v Providing a certifier ID v Specifying a passthru server v Specifying a mail routing server v Creating a base name for your mail server v Specifying a Domino Directory synchronization server Use the Pre-configuration 5-15 minutes, after you have A report displays, listing the Test tool to check that your completed the form. Time tests that were performed, on-premises environment is depends on how many tests and identifying issues that prepared to be configured for run, which varies according need to be resolved. the SmartCloud Notes to the amount of information service. provided. Check that the account 10 minutes Confirm that the Account settings are accurate and Setup window in the then enable the settings. SmartCloud Notes Administration interface This information is used displays the text Prepare for when the Domain account activation and the Configuration tool runs, so it text Select Domain is important that it is Configuration Tool. accurate. Download and run the 15-30 minutes Confirm that the tool Domain Configuration tool. displays a success message. Note: If the tool does not The tool uses the information run successfully, you must provided in account settings investigate and resolve any to edit the Domino issues before continuing. Do directories of the on-premises not proceed until the tool hub domain and the runs successfully. on-premises passthru domain. The edits allow the servers in the service and your on-premises servers to connect to each other and to perform directory synchronization and mail routing.

84 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 24. Tasks to configure a hybrid environment (continued) Task Estimated time to complete How to confirm completion Confirm that directory The time for the initial Confirm that the Account synchronization has directory synchronization to Setup window in the completed. complete varies depending SmartCloud Notes on the number of directories Administration interface Directory synchronization replicated and the network displays the message replicates to the service some bandwidth. Directory synchronization is of the documents in the complete. Domino directories that are For example, replicating one configured for directory over a fast synchronization. These connection might take 2-6 include Global Domain hours. Replicating multiple documents, at least one of directories or replicating over which is required by the slower connections might service for Internet domain take 3-5 days. verification. . The corporate firewall must allow inbound connections over port 1352 so that the service can connect to a directory synchronization server and initiate replication. After directory It can take from a few Confirm that the Internet synchronization has minutes or a few hours to as Domain Verification window completed, verify at least one long as 48 hours to verify in the SmartCloud Notes Internet domain name by domain ownership. Administration interface creating a CNAME record for indicates that at least one it to which the SmartCloud If you do not have the domain is verified. Notes service can connect. authority to create a CNAME record for your domain, extra time may be required to contact your domain hosting service and have them create the record for you.

After the CNAME record is created, it may take time for your hosting service to replicate it to the Internet. The CNAME record must replicate to the Internet so that the service can connect to it. After you have verified at 5 minutes Confirm that the Account least one Internet domain, Setup window in the Activate your account. SmartCloud Notes Administration interface indicates that the account has been successfully activated. Run configuration tests to 2 - 5 minutes Confirm that no errors are verify that your on-premises shown in the Configuration environment is configured Test window. correctly to work with the service.

Chapter 4. Configuring the service 85 Table 24. Tasks to configure a hybrid environment (continued) Task Estimated time to complete How to confirm completion Check network connections 5 - 10 minutes Confirm a successful from on-premises servers to authenticated connection to a SmartCloud Notes servers. mail server.

The corporate firewall must allow outbound connections over TCP/IP port 1352. Issue a Vault Trust Certificate 5 - 10 minutes After a user is provisioned to enable the Notes IDs of for SmartCloud Notes, provisioned users to be confirm that the Notes ID of uploaded to a SmartCloud the user is uploaded to the Notes ID vault. ID vault.

Logging on as the first company administrator An IBM Customer Service Representative creates the IBM SmartCloud Notes account for your company. This step creates a company administrator account under a name and email address provided by your company. IBM sends an email to the address confirming your purchase. To activate the account for your company, follow the URL link in this email and log on to the IBM Connections Cloud website as the company administrator. About this task

Perform the following steps to activate the account for your company and log on as the first company administrator. Procedure 1. Open the email that was sent to the company administrator email address confirming your purchase. 2. Click the URL link in the email, to open the Registration page. 3. Perform the following steps on the Registration page: a. Create and confirm a service logon password.

Important: The email address that is shown is the logon name for the company administrator account. Be sure to remember it and the new password. b. Select a country, language, and time zone. c. Read the terms of use and privacy practices information, and if you agree to them, click I accept the Terms of Use. d. Click Submit. e. Log on using the company administrator email logon and new password. Results

You are now logged on to your home page. To log on in the future, go to http://www.ibmcloud.com/social. What to do next

Configure the SmartCloud Notes service, if IBM is not configuring it for you.

86 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Completing a checklist to prepare for configuration Before you prepare account settings and configure the service, complete the checklist in this topic to verify that all prerequisite tasks are complete. About this task Table 25. Tasks to complete before you configure the service Corresponding information to provide in account Task settings Complete? Configure the corporate Not applicable firewall to allow connections to and from the service. For information, see “Preparing the firewall” on page 41. Prepare a primary The hierarchical server name synchronization server, and of each server, for example, optionally, a secondary Dirhub/Renovations synchronization server. For information, see “Setting up directory synchronization servers” on page 45. Prepare at least one Domino The file path to the directory directory to replicate to the file name, relative to the data service. For information, see directory on the “Preparing to replicate synchronization server, for Domino directories” on page example, dir\names.nsf 47. Optionally, prepare an The file path to the EDC file Extended Directory Catalog name, relative to the data (EDC) to replicate to the directory on the service. For information, see synchronization server, for “Preparing to replicate an example, dir\edc.nsf extended directory catalog” on page 48.

Prepare a primary passthru v The host name or IP server, and optionally, a address of a server, for secondary passthru server. example, For information, see passthru.renovations.com “Preparing passthru servers” v The hierarchical name of on page 40. the server, for example, Passthru/Renovations v The Domino domain of the server, for example, SCNPassthru

Chapter 4. Configuring the service 87 Table 25. Tasks to complete before you configure the service (continued) Corresponding information to provide in account Task settings Complete?

Prepare a primary mail hub v The host name or IP server, and optionally, a address of a server, for secondary mail hub server. example, For information, see “Setting mailhub.renovations.com up mail hub servers in the v The hierarchical name of on-premises hub domain” on the server, for example, page 52. Mailhub/Renovations v The Domino domain of the server, for example, Renovations Create an OU certifier to use A local file path to the to name your mail servers in certifier ID file the service. For information, see “Creating a certifier for your mail servers” on page 39. Decide on a base name for The base name, for example, users’ mail servers in the Mail, which is the default service. The base name value combines with the mail server OU certifier to form the server names. Prepare Global Domain Not applicable A list of Internet domains to documents to define the be verified is generated from Internet domains owned by the documents and displayed your company. For in SmartCloud Notes information, see “Preparing Administration. Global Domain documents” on page 49. Determine who will create Not applicable the CNAME records in your domain hosting service that are used to verify ownership of your company Internet domains. For information, see “Verifying Internet domains” on page 97 To prepare to use the Not applicable Domain Configuration tool, find an IBM Notes client or IBM Domino Administrator client that can connect to each directory synchronization server, mail hub server, and passthru server. Make sure the ID file you use with the client has Administrator access to these servers. For information, see “Downloading and running the Domain Configuration tool” on page 94.

88 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Configuring your hybrid account settings Perform the tasks in this section to configure a hybrid environment, one in which the IBM SmartCloud Notes service is integrated with IBM Domino servers at your company site. About this task

Make sure that IBM has created the SmartCloud Notes account for your company and that you have activated it by logging on to the service as the first company administrator. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. In the "Welcome to SmartCloud Notes!" window, select Hybrid Environment, and then click Set Up My Account. 5. In the next window, click Continue. Results

You are now ready to begin completing the information in the hybrid Account Settings. Configuring directory synchronization A directory server in the service has a replica of one or more on-premises IBM Domino directories. To support directory synchronization, provide the name of the primary server and file path of at least one on-premises directory that you want to synchronize. The directory server performs a regular pull and push replication of the directories to keep the contents of both the service and the on-premises replicas synchronized. About this task

In addition to specifying a primary server, you can specify a secondary server that you synchronize for high availability purposes. Each directory synchronization server must have a local replica of each Domino directory that you provide.

You can also specify an extended directory catalog (EDC) to be synchronized. However, if you do, make sure to select the option Do not use this directory for user provisioning. The EDC is a read-only composite of information from your other directories; the service receives information from it but does not update it.

For additional information about how Domino directories remain synchronized in a hybrid environment, read Planning directory synchronization. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings.

Chapter 4. Configuring the service 89 4. In the navigation pane, click Directory Sync Server. 5. Click Add Domino Directory. The name of the directory is displayed in the Directory server column. 6. In the field Primary directory server name, specify the name of the server on which your Domino directory resides, such as Directory1/Renovations.Ifyou are adding a secondary server, specify the name of the server in the field Optional: Secondary directory server name instead. 7. In the field Domino Directory database file name, specify the file path of the Domino directory or EDC. 8. If the directory is an EDC or any other directory that is not used for user provisioning, select Do not use this Domino Directory for user provisioning. 9. Repeat steps 5 through 8 for each additional Domino directory that you want to synchronize with hosted directory servers. You can return to this window to add subsequent directories after you have saved this information. 10. Click Save. 11. Optional: To edit the name of a directory server, return to this window and click the server link. What to do next

Complete the task Specifying a mail routing server. Specifying a mail routing server IBM SmartCloud Notes servers and on-premises IBM Domino servers route mail to each other. Provide the name of one or more Domino servers to use as the on-premises mail routing server. You can use the same servers to perform mail routing and directory synchronization or use separate servers for each function. Although only one server is required, for high availability designate two servers. Both the primary and the secondary mail servers must be in the same domain. About this task

To provide failover, set up two mail hub servers in the on-premises hub domain. The service attempts to route to the primary mail hub server first, which is the server with the name that comes first in alpha-numeric order. For example, if the two server names are MailA/Renovations and MailB/Renovations, the primary server is MailA/Renovations. If the two servers are Mail1/Renovations and Mail2/Renovations, the primary server is Mail1/Renovations.

If the service is unable to route to the primary mail hub server due to network or server unavailability, it attempts to use the secondary server. When the primary mail hub server becomes available, the service begins using it again after a period of time. The service may use both servers simultaneously for brief intervals. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. From the navigation pane, click Mail Routing Server. 5. In the field Primary Domino mail server name, specify the name of your on-premises Domino mail server, such as Mail1/Renovations.

90 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 6. Optional: In the field Optional Secondary Domino mail server name, provide the name of a second mail server, such as Mail2/Renovations. 7. In the field Domino domain name, specify the name of the on-premises Domino domain. Remember, both the primary and the secondary mail servers must be in the same domain. 8. Click Save. What to do next

Complete the task Creating a base name for your mail server. Creating a base name for your mail servers IBM SmartCloud Notes server names are created with a name that you provide as a base name, and are then numbered sequentially. For example, if your base name is Mail, and your organizational unit (OU) certifier is SCN/Renovations, then your SmartCloud Notes server names are Mail1/SCN/Renovations, Mail2/SCN/Renovations, and so on. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. From the navigation pane, click Mail Server Base Name. 5. Enter a base name for your mail servers. 6. Click Save. What to do next

Complete the task Specifying a passthru server. Specifying one or more passthru servers All connections from the service to on-premises servers are directed through an IBM Domino passthru server. For high availability, set up at least two passthru servers for failover to prevent mail routing delays if a server is unavailable. Before you begin

Make sure that you have installed and set up one or more passthru servers by following the steps in the topic Preparing the passthru server domain. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. From the navigation pane, click Passthru Server. 5. In the Primary passthru server name field, specify the passthru server, such as PassthruMain/Renovations.

Chapter 4. Configuring the service 91 6. In the Internet host name or IP address field, specify the Internet host name, such as pthru1.renovations.com. Specify a host name rather than an IP address, if possible. Then if the IP address changes, you do not need to reconfigure this setting. 7. In the Domino domain name field, specify the name of the Domino domain, such as RenovationsFirewall. 8. Optional: In the Optional secondary passthru server name field, provide the name of a server to use in the case of failover. 9. Optional: Provide the Internet host name or IP address for the secondary server. 10. Click Save. What to do next

Complete the task Providing a certifier ID. Providing a certifier ID file As a part of preparing your on-premises environment for a hybrid deployment, you create an IBM Domino organizational unit (OU) certifier for your IBM SmartCloud Notes servers. In this task, you provide an OU certifier ID file and password when you set up the hybrid environment. Before you begin

Make sure that you have created a unique first-level organization unit (OU) certifier using the steps in Creating a certifier for your mail servers.

Before you upload an ID file, make sure that you have selected the correct file. After you upload the ID file, you cannot switch to an ID with a different certifier name.

Make sure that you have read the topic Certifier requirements in a hybrid environment. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. From the navigation pane, click Certifier ID File. 5. Browse to the certifier ID file you created for your hybrid environment. 6. If this file has a password, type the password in the Certifier password field. 7. Click Upload. What to do next

Complete the task “Using the Pre-configuration Test tool to check your environment” on page 93.

92 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Using the Pre-configuration Test tool to check your environment After you prepare your on-premises environment but before you run the Domain Configuration tool to configure it to connect to the IBM SmartCloud Notes service, download and run the SmartCloud Notes Hybrid Pre-configuration tool. This tool runs a series of tests to determine if the servers in your environment are set up correctly. The tool provides a report that identifies any issues that might prevent communication between your environment and the service. The tool does not change your configuration. Before you begin v To perform this task you must have Administrator access and Full Remote Console access to the servers you are testing. v The thoroughness of this test depends on the completeness of the information you provide. However, if you do not know the answer, you can leave fields blank . v Do not use a virtual private network (VPN) connection. This tool performs firewall tests, so you must run it from an IBM Notes client computer inside your firewall. About this task

When you download this tool, it contains the information that you have entered in your Hybrid Account Setup up to this point. For instance, it might list your mail hubs, but not your passthru servers, if you have not yet entered that information. You can update the information using the IBM Notes client. However, if you update the information this way, the information is used only when you run the test; it is not passed back to the SmartCloud Notes servers. You will have to return to the Hybrid Account Setup to enter the information there as well. Alternatively, you can update the information in the Hybrid Account Setup and then download a fresh copy of the tool that includes all of the updated information.

The more information you provide, the more complete your test results are. However, you can leave a field blank if you do not know the correct information. Run the tool as many times as needed, resolving issues identified before running it again. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. From the navigation pane, click Pre-configuration Test Tool. 5. Click Download to download the file. 6. Agree to the terms and conditions for the pre-configuration test application, and then click Continue. 7. Follow the steps in the resulting screen to download the file liveservercheck.nsf and save it in your local Notes data directory. 8. From the Notes client, open the tool by clicking File > Open > IBM Notes Application, and then selecting liveservercheck.nsf. 9. Follow the on-screen instructions that the tool displays, including checking the information displayed there. 10. Click Run Test.

Chapter 4. Configuring the service 93 11. Review the report and address any on-premises issues reported by the tool. 12. Optional: If you change your environment, rerun the test. 13. Optional: Make any necessary changes to the information in the tool, and then click Run Test. What to do next

After you are satisfied that your environment is prepared, complete the task “Reviewing your setup and enabling your account.”

Reviewing your setup and enabling your account Before you can download and run the Domain Configuration tool, all of the required hybrid account setup information must be complete. When you check the status of the information you provided, any incomplete items are identified. Before you begin

Complete these tasks in any order. v Specifying the Domino directory server v Specifying a mail routing server v Creating a base name for your mail server v Specifying a passthru server v Providing a certifier ID Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. In the navigation pane, click Account Setup. 5. For any items that have not been configured, click the corresponding task in the navigation pane, and provide the information that is requested. 6. When the status of all items shows successful completion, click Enable my account. What to do next

Complete the task “Downloading and running the Domain Configuration tool.”

Downloading and running the Domain Configuration tool The Domain Configuration tool configures your on-premises servers to connect to your hosted IBM SmartCloud Notes servers. The server configuration information that you provide in the Account Settings of SmartCloud Notes Administration is the data that is used to configure the connections. Before you begin

Before you can download and run the Domain Configuration tool for the first time, all of the required Account Settings information must be complete. To confirm that

94 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 all of the required information is available, complete the task Checking the status of your hybrid account setup. If any information is incomplete, provide the missing information.

The IBM Notes client from which the tool is run must be able to connect to the passthru servers in the passthru domain. The client must also be able to connect to the directory synchronization and mail hub servers in the on-premises hub domain. Firewall rules at your company might prevent connections from systems inside the firewall to the passthru servers. In this case, use a Notes client running on a system connected outside the firewall. Allow a direct connection to the passthru servers, and through them, connect to the servers in the on-premises hub domain.

If you are configuring the service for the first time, to make sure your on-premises environment is prepared, complete the task Using the pre-configuration tool to check your environment. About this task

You run the Domain Configuration tool when you first configure the service to interoperate with your on-premises environment.

You also run the tool after the initial configuration. Run the tool again if you change a server configuration in Account Settings or if you correct a configuration problem in your on-premises environment.

If you are performing the initial service configuration, the Domain Configuration tool includes pre-configuration options you can use to test your on-premises environment before you actually configure it. No changes are made to your environment as a result of these tests. v Pre-configuration Test - Runs the same series of pre-configuration tests as the SmartCloud Notes Hybrid Pre-configuration tool (liveservercheck.nsf). If you did not complete the task Using the pre-configuration tool to check the status of your hybrid account setup, you can run those tests now. The tool then provides a report that identifies configuration issues that you can address before configuration. v Pre-configuration Report - Simulates the configuration, and provides a report of the configuration changes that would be made to your environment during the actual configuration process.

After you run the Domain Configuration tool, a detailed report lists the changes that were made to your on-premises server configuration. Typical changes include: v Allowing SmartCloud Notes servers sufficient access to your Domino directories to perform directory synchronization v Creating connection documents to support server passthrough and mail routing to SmartCloud Notes servers v Modifying server configuration documents to allow passthrough access to these servers v Setting a server environment variable

Note: Do not edit the directory content added by the tool. For example, do not edit changes to the ACL or to Connection documents. Doing so prevents proper operation of the service. Refer to the report generated by the tool to see the exact directory changes the tool makes

Chapter 4. Configuring the service 95 Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. In the navigation pane, click Domain Configuration Tool. 5. Follow the steps in the window that opens to download the file liveserverconfig.nsf, and save it in your local Notes data directory. If you are trying to overwrite a previously downloaded copy, and you get the error message File is in use from your browser, it means that the IBM Notes client has the old copy of liveserverconfig.nsf open. If that does not seem to be the case, close Notes or use a different filename. 6. From the Notes client using an ID that has Manager access to your Domino directory, click File > Open > IBM Notes Application, and then select the liveserverconfig.nsf file. 7. Optional: Select Pre-configuration Test to run a series of pre-configuration tests based on information provided in the Hybrid Account Settings. a. Make any changes to your configuration environment, based on information in the report. b. To correct any account settings information, return to the SmartCloud Notes Administration windows where you first entered the hybrid account setup information, and make the corrections. c. Repeat steps 4 and 5 to download a new copy of liveserverconfig.nsf. 8. Optional: Select Run a Pre-configuration Report to simulate the configuration that will occur. No changes are made to your environment. 9. If all of the information is correct, select Configure Servers, and then click Begin. 10. Review the resulting detailed report so that you know the changes that the tool made to your on-premises server configuration. Optionally, print the report for reference later.

Note: If you failed to save the original report, the file liveserverconfig.log in your Notes data directory contains the same information. This log file is in English only. Running the tool again does not produce an identical report because the report lists the changes that were made when the tool runs. During a second run no changes are made. 11. Allow time for the Domino directory changes to replicate to other servers in your environment. What to do next

If you must run the tool again to make sure that your setup is still correct, perform steps 1-5 to get a new copy of liveserverconfig.nsf. When troubleshooting any communication issues with the service, running the tool is a good way to check whether anything has been changed, and whether you must return to the previous settings.

When you are satisfied that your environment is set up correctly after the initial service configuration, complete the task Verifying Internet domain names in a hybrid environment.

96 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Verifying Internet domains Internet domain name verification is a standard industry practice among domain hosting services to confirm domain name ownership and to prevent abuse of user accounts. You need to verify only the domain names that correspond to Internet addresses of users that you are provisioning. Before you begin

Complete the tasks Downloading and running the Domain Configuration tool and Preparing Global Domain documents. Also make sure that directory synchronization has completed to replicate the Global Domain documents to the service. About this task

There are different methods to verify domain names. The service uses a CNAME record for this purpose by requiring you to create a CNAME record to prove ownership. Your domain hosting service should provide instructions for creating a CNAME record; however, if they do not, contact them directly.

A CNAME record is an entry in the Domain Name System that is used to define a host name alias for an Internet domain. To prove ownership of a domain, you sign in to your domain hosting service and use the DNS Management settings to create a temporary CNAME record for the domain. Then the service uses the alias in the CNAME record to query your domain. A successful query proves that you were able to create the CNAME record and therefore that you own the domain.

If you do not have the authority to create a CNAME record for your domain, extra time may be required to contact your domain hosting service and have them create the record for you.

Verifying a root domain also verifies any subdomains of it that are listed. For example, verifying renovations.com verifies west.renovations.com if listed in the Internet Domain Verification window. After you verify a root domain, no other company can use it or any subdomain of it.

You can perform this procedure even if you are in the process of switching domain hosting services.

The list of Internet domain names that populate the Internet Domain Verification window is derived from your on-premises Global Domain documents. These documents replicate during directory synchronization of your on-premises server with the service servers. If the list is incomplete or includes unwanted Internet domains, edit your Global Domain documents on premises to include the correct domain name information. After directory synchronization has completed, return to this window and verify that the correct domain names are listed. Procedure 1. Log on to http://www.ibmcloud.com/social using the email address and password of a user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. In the navigation pane, click Internet Domain Verification.

Chapter 4. Configuring the service 97 5. In the Internet Domain Verification window, click Verify Ownership next to the domain to verify. 6. Sign in to your domain hosting service and use the DNS management settings to create a new CNAME record. Use the information that is shown in the Internet Domain Verification window to create the CNAME record. v Put the unique key that is shown into the first field of the CNAME record. The name of this field varies by vendor, but it is sometimes named prefix or alias. v Put collabserv.com into the second field of the CNAME record. This field is sometimes named destination or target host. 7. After you create the CNAME record, click Begin Verification to begin verification of the domain. The unique key continues to be shown in the Internet Domain Verification window until verification completes successfully. Results

To verify domain ownership, the service uses the alias in the CNAME record to query your domain. For example, if the CNAME key is domino-1jkkiaojd-rules and your domain name is renovations.com, the service queries domino-1jkkiaojd-rules.renovations.com.

If verification is not successful, check that the unique key shown exactly matches the one added to the CNAME record. If the values are different, do not restart verification. Rather, update the CNAME record with the correct key and simply wait again for verification to complete.

Domain verification can take up to 48 hours, although usually it takes much less time. If after 48 hours domain verification has not completed, click Restart Verification. Restarting verification generates a new unique key and you must then replace the old key with the new key in the CNAME record. Only restart verification if 48 hours have passed since you clicked Begin Verification.

After a domain is verified, you can remove the CNAME record you created. What to do next

Perform the task “Activating your account” on page 99. Related tasks: “Downloading and running the Domain Configuration tool” on page 94 The Domain Configuration tool configures your on-premises servers to connect to your hosted IBM SmartCloud Notes servers. The server configuration information that you provide in the Account Settings of SmartCloud Notes Administration is the data that is used to configure the connections. “Preparing Global Domain documents” on page 49 Prepare at least one Global Domain document to define the Internet domains that your company owns.

98 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Activating your account After you have set up and configured your on-premises environment by downloading and running the Domain Configuration tool, you must activate your account. When your account is activated, your on-premises servers can connect to the IBM SmartCloud Notes servers, and the SmartCloud Notes servers can connect to your on-premises servers. Before you begin

Ensure that you have completed the task Verifying Internet domain names. Procedure 1. Log on to http://www.ibmcloud.com/social using the email address and password of a user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. Click Activate My Account. What to do next

Make sure that the servers in the service can connect to your on-premises servers by completing the task Checking network connections from the service to on-premises servers.

Running configuration tests After you run the Domain Configuration tool, verify that servers in the service can connect to your on-premises servers. Before you begin

Make sure that you have completed Downloading and running the Domain Configuration tool and Activating your account. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. In the navigation pane, click Configuration Test, and then click Run Tests. 5. Correct any problems that are reported and click Run Tests again. What to do next

If your network connections are not working: v Make sure that the information that you provided in the Account Settings is correct, and that there are no typographical errors. v Make sure that you completed all of the preparation tasks in the section Preparing your environment for a hybrid deployment. v Make sure that all of your on-premises servers are running.

Chapter 4. Configuring the service 99 Completing the configuration After you have completed the account setup for your organization, perform the tasks in this section to complete the configuration. Checking network connections from on-premises servers to the service After you run the Domain Configuration tool, check that your on-premises servers are reaching the IBM SmartCloud Notes servers by using the trace command. Before you begin

Make sure that you have completed these tasks: v Downloading and running the Domain Configuration tool v Checking network connections from the service to on-premises servers About this task

To determine the name of your SmartCloud Notes servers, use the format basename1/ou/o, using the base name you provided when you completed the account settings. Remember that if you used Mail (the default) as the base name, then your mail servers are named Mail1, Mail 2, and so on. When you run this trace, you get an authentication error, which is an expected error. Review the lines that follow the error to determine if the connection was successful. Procedure 1. From an on-premises primary mail hub server, type the following command into the Domino server console, based on the mail base name, your organizational unit, and organization name: trace basename1/ou/o For example: trace Mail1/scn/renov 2. Review the results of the trace command to make sure that they include the confirmation Connected to server basename1/ou/o. Results

The following sample output shows a successful trace. > trace Mail1/scn/renov Determining path to server MAIL1/SCN/RENOV Available Ports: TCP Checking normal priority connection documents only... Allowing wild card connection documents... Local network connection document found for */scn/renov Verifying address ’9.12.123.456’ for LMAIL1/SCN/RENOV on TCP Connected to server MAIL1/SCN/RENOV Connecting to MAIL1/SCN/RENOV over TCP Using address ’9.12.123.456’ for MAIL1/SCN/RENOV on TCP Error connecting to server MAIL1/SCN/RENOV: Server error: You are not authorized to use the server Connected to server MAIL1/SCN/RENOV Attempting Authenticated Connection Compression is Disabled Encryption is Enabled

In the sample output, the error received when attempting to connect to MAIL1/SCN/RENOV is the expected response because SmartCloud Notes servers

100 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 do not allow unauthenticated connections. However, these lines show that the subsequent authenticated connection was successful and indicates that the on-premises servers are successfully communicating with SmartCloud Notes: Connected to server MAIL1/SCN/RENOV Attempting Authenticated Connection Compression is Disabled Encryption is Enabled Issuing a Vault Trust Certificate You must issue a Vault Trust Certificate from a parent certifier of service users’ Notes ID files to the certifier of the service ID vault. This step is a prerequisite for user provisioning. Before you begin

After you have configured your company account settings, wait for directory synchronization to replicate the service ID vault document to your on-premises directory. You can confirm that replication has completed in SmartCloud Notes Administration. Click Account Settings, and then click Directory Sync Server. Under Sync Status, the status should be OK.

Make sure you have a local copy of the certifier ID file of the parent certifier that you will use to create the Vault Trust Certificate. For example, to issue a Vault Trust Certificate that applies to the user Samantha Daryn/Renovations, make sure you have a local copy of the certifier ID file for the /Renovations certifier. About this task

If users are certified under an organizational unit (OU) certifier, you can use either the OU certifier or the top-level certifier to issue the Vault Trust Certificate. For example, if users are certified under the OU /North/Renovations, issue a Vault Trust Certificate from either /North/Renovations or /Renovations.

If your service users are certified under different top-level organization certifiers, you must issue a Vault Trust Certificate for each organization. For example, if some service users are certified under the organization /Renovations and others are certified under the organization certifier /ZetaBank, issue a Vault Trust Certificate from both organizations.

The Vault Trust Certificate certifies that the parent certifier of Notes user ID files trusts the service ID vault to store the ID files. ID files must be in the vault for administrators to reset the ID passwords for Notes client users. ID files must also be in the vault for web client users and mobile client users to be able to sign, encrypt, and decrypt messages.

Although all user IDs under the parent certifier that issues the Vault Trust Certificate are authorized for storage in the service ID vault, only the IDs of service users can be uploaded to the vault.

For more information about Vault Trust Certificates, see the information about ID vault trust in the IBM Domino documentation.

Perform the following steps to issue a Vault Trust Certificate.

Chapter 4. Configuring the service 101 Procedure 1. Log on to a Domino Administrator client that you use for on-premises Domino server administration. 2. Open an on-premises hub server that you use for directory synchronization. 3. Click the Configuration tab and then click Security > ID Vaults.

Note: If you do not see the ID Vaults view, you must upgrade the Domino directory on the server to the template version for 8.5.1 fix pack 2 or later. 4. Select the ID Vault document for the service ID vault. The format of the document name is /IDVault_customernumber, for example /IDVault_15679841. 5. Click Tools > ID Vaults > Manage. If a window that describes the ID vault is shown, click Next. 6. Select the task Add or remove organizations that trust the vault and then click Next. 7. Click Add or Remove. 8. Under Available organizations, select a certifier of your service users. 9. Click Add to add the certifier to Organizations that trust the ID vault, and click OK. The certifier is now shown under Organizations. 10. Click Next and click Configure to confirm the change. 11. At the Choose a Certifier prompt, browse for and select the certifier ID file of the certifier, for example cert.id, and click OK. 12. Provide the certifier password and click OK. 13. In the You have successfully completed the management of the Notes ID vault window, click Done. 14. From the Configuration tab, click Security > Certificates > Certificates. Expand Vault Trust Certificates and verify that there is a Vault Trust Certificate issued by the parent certifier to the ID vault.

Note: The Vault Trust Certificate is created on the administration server for the directory. If you issued the certificate on a server that is not the administration server, the certificate will be visible on that server after it replicates from the administration server. Results

The Vault Trust Certificate replicates to the service during directory synchronization. Related information:

Domino documentation

102 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 5. Customizing service settings

After you configure the service to integrate with your on-premises environment, optionally customize service settings to suit your needs. About this task

You can customize settings before or after you onboard users.

Enabling the accessible experience for the web client You can submit a request to enable the accessible experience for the web client for everyone in your organization. Mail, Calendar, Contacts, and Preferences features provided with this experience are all accessible. About this task

Accessibility features help users who have a disability, such as restricted mobility or limited vision, to use information technology products successfully.

Another accessible experience for the web client is the desktop ultra-light mode. For more information on this mode, see the topic about web client accessibility features in the user documentation.

Both accessible experiences are supported on a computer using Mozilla Firefox 24+ ESR or higher.

See the IBM Human Ability and Accessibility Center for more information about the commitment that IBM has to accessibility. Procedure

To enable the accessible experience for the web client for all users in your organization, contact Support. Related information:

Web client accessibility features

Support

Setting up administration notifications Set up the service to send email notifications that report when specific types of errors occur in the service. About this task

Directory synchronization errors are the types of errors that are reported, currently. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization.

© Copyright IBM Corp. 2011 103 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings. 5. Click Email Notifications. 6. In the Send administrator notifications to these addresses box, type each address to send notifications to. Specify any Internet-formatted address, either internal or external to the service. For example, type [email protected]. 7. Optional: To send a test notification to each new or changed address, select Send test notification to newly added addresses. 8. Select the language to use in the notifications. 9. In the Reminder interval field, specify how frequently to resend notifications that are related to the same error. Acceptable values are1-7days. 10. Click Save. Results

If a directory synchronization error occurs in the service, an email that is formatted as follows is sent:

Sender: SmartCloud

Subject: message summary[SCN-dirsyncNotify]

Body: message details

The body of the email provides a link to a page in SmartCloud Notes Administration Account Settings that provides more information about the error.

Note: If you select the Send test notification to newly added addresses, a test email with the subject New administration email address added [SCN-admintest] is sent to each new or changed address. If an expected test notification is not received, verify that the address is specified correctly. No error message is shown if the email cannot be delivered.

Restricting access to groups Add a Readers list to a group to restrict access to it. For example, a Readers list comes in handy if you have a large mailing group that you want to allow only a few users to send mail to. About this task 1. Right-click the group in the directory and then click Document Properties. 2. Click the Security tab (fourth tab). 3. In the Who can read this document field, clear the All readers and above box. 4. Add the names that you want to allow access to the group. 5. Add the following groups to the access list: v (Required) SaaSLocalDomainServers. Granting access to this group allows the group to replicate to replicas of the directory in the service. v (Recommended) LocalDomainServers v (Recommended) LocalDomainAdmins

104 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 6. Make a minor edit to the group. This step ensures that the change to the group replicates to the service.

Using administrative policies If you use administrative policies on premises, you can apply many of those same policy settings to service users as well. Administrative policies enable all users to have the same working experience.

There are two types of policies, organizational and explicit. An organizational policy automatically assigns settings to all people within an organization or organizational unit. You cannot use this type of policy for service users because an organizational policy with a few pre-defined settings is already used within the service.

To assign policies to service users, use an explicit policy. In this type of policy, you use the Policy Assignment field to assign users to the policy.

If you use an organizational policy on premises and want to apply the settings to users in the service, create an explicit policy that mirrors the on-premises organizational policy. For example, the fictitious Renovations Corporation has an organizational policy on-premises that applies to anyone in the Renovations organization. Because it is an organizational policy, anyone whose hierarchical name includes */Renovation, such as Samantha Daryn/Renovations, is assigned this policy. The Renovations organizational policy cannot be used for users in the service. Therefore, the administrator creates an explicit policy, named Renov-Explicit, that includes policy settings identical to the settings that are in the on-premises Renovations organizational policy. Next, the administrator adds the name */Renovations as a name in the Policy Assignment field. This way, users who have /Renovations in their name are automatically assigned this policy.

Note: The service does not support assigning policies by specifying the policy name in a user's Person record in the Domino directory. If you are using this kind of policy model, you must switch to a direct assignment in the Policy document itself.

Although most settings in policies are supported in the service, there are a few restrictions. If you plan to use explicit policies for your service users, read about policy settings restrictions before you do.

If you are unfamiliar with administrative policies, see the topics on policies in the Configuring users and servers section of the IBM Domino documentation. Related information:

IBM Domino documentation Creating policies for service users To ensure that users in the service have the same experience as on-premises users, you can create explicit policies. Any organizational policies that you might be using on premises are not supported. Before you begin

Read the following topics: v “Using administrative policies”

Chapter 5. Customizing service settings 105 v “Policy settings restrictions” on page 114 About this task

Use these general steps to create explicit policies that mirror your on-premises policies. If you include policy settings that are pre-defined for all users in the service, or that are not supported, the service ignores the settings.

Important: If you plan to support multiple domains in your organization, use a naming convention that includes the domain name when you create any of your policy documents. Supporting multiple domains essentially means that multiple names.nsf files from different company domains are synced to the service. Therefore, it is critical that all Policy Settings documents and all master Policy documents have unique names.

For more information about creating policies, see the IBM Domino 9 documentation. Refer to the topics on policies in the section on configuring users and servers.

For information about IBM Notes Traveler policy settings, see the topic on creating a Notes Traveler policy settings document in the Notes Traveler documentation. Procedure 1. Identify the policies that you are currently using in your on-premises policies. 2. Note any settings in the current policy that have restrictions when used in the service. 3. Use the information that you identified in the previous steps to create an explicit policy. 4. To assign the policy, add the names of users or groups from the directory to the Policy Assignment field of the Policy document. Or, type a wildcard entry to represent all names in an organization, for example, */Renovations.

Note: The service does not support assigning policies by specifying the policy name in a user's Person record in the Domino directory. If you are using this kind of policy model, you must switch to a direct assignment in the Policy document itself. What to do next

You cannot open a service policy to view the settings. However, to view a detailed summary of the effective policy settings, use the Policy Viewer in the Domino Administrator client. You can view a policy synopsis for a selected user or group. Related information:

IBM Domino documentation

Creating an IBM Notes Traveler policy settings document Creating an archiving policy settings document To use policies to set up mail file archiving for IBM Notes clients, you use both Archiving Policy Settings documents and Archive Criteria Settings documents.

106 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Before you begin v Create an explicit policy to use with the service. For more information, see the topics “Using administrative policies” on page 105 and “Creating policies for service users” on page 105. v Make sure that you have at least Editor access to the Domino Directory and one of these roles: PolicyCreator role to create a settings document; PolicyModifier role to modify a settings document.

About this task

In the cloud, mail archiving is always run on the Notes client. The source mail file to archive must be a local mail replica or managed mail replica on the client. The destination archive database can be created on the client or on an on-premises server. Users cannot create archives on the cloud servers.

When Archive Settings are configured, Notes users can select File > Application > Archive to archive local replicas of their mail files. If you do not configure Archive Settings, users can still click Archive Settings in the application properties box to archive a mail file.

The information provided here applies only to Notes clients. Archive Settings do not apply to web client users.

Note the following additional information: v This procedure applies to archiving mail that is in the cloud. To preserve an archive of an on-premises mail file, you must archive the contents before the user moves to cloud mail. v Users in the cloud cannot create local archives of on-premises mail files. As a best practice, remove on-premises mail files after users move to the cloud. v Archiving policy settings do not apply to non-mail databases.

Procedure 1. Open the explicit policy that you created in the Domino Directory. 2. In the Setting Type section, next to Archiving, click New. 3. On the Basics tab, complete these fields: v Name. Enter a name that identifies the users or the settings themselves. v Description. Enter a description of the settings. 4. Optional: Under Archiving Options, choose one of the following options if you want to prohibit archiving. The default is to allow both. v Prohibit archiving. Use this option to prohibit all archiving. The Allow Calendar Cleanup check box displays. It is selected by default but you can deselect if you choose to prevent users from performing calendar cleanup functions. Save the document. v Prohibit private archiving criteria. Use this option to prohibit users from creating private archive settings or modifying the archive settings that are defined in this settings document. 5. Under Archiving will be performed on, choose User's local workstation. Archiving cannot be performed on a server. 6. Under Archiving source database is on, choose Local. The mail file to be archived must be a local replica or managed mail replica on the client. 7. Under Destination database is on, choose one of the following options:

Chapter 5. Customizing service settings 107 v Local. Use this option to create the mail archive database on the user's local client. v Specific server Use this option to create the mail archive database on an on-premises server. Specify the name of the on-premises server. You must give users Create access to this server. Do not select Mail server. The destination database cannot be on the cloud mail server. 8. On the Selection Criteria tab, do one or more of the following steps: v Click New Criteria to create a new Archive Criteria Settings document. Then, click Add Criteria and select your newly-defined criteria document. See the topic “Creating an archive criteria settings document” on page 110 for instructions on specifying details of the criteria in the new document. v Click Add Criteria, and then choose one or more Archive Criteria Settings documents to add to your archiving settings. These settings must comply with the information in the topic Creating an archive criteria settings document. v Click Remove Criteria, and then choose one or more Archive Criteria Settings document to remove from your archiving settings. 9. Click the Logging tab. Under Archive Logging, enable the field Log all archiving activity into a log database to log archiving activity to a log database (the default). 10. Optional: Change any of the following fields if you want to change the location of the log directory and log file name. Table 26. Fields used to specify the log directory and file name Field Action Log Directory The default is archive. Enter a new name if you want to change it. Log Prefix The default is the letter l, followed by an underscore (_). Enter a new prefix if you want to change it. Log Suffix The default is .NSF. Enter any other suffix that you would like to use. Number of characters from The default is 50. To change the default, enter the original file name number of characters you want to use from the user's mail file name to create the archive log name.

11. In the field Include document links to archived documents, choose one of the following options: v Enable this field to include links to archived documents in the log (default). If you include links, users can open archived documents from within the log database. v Disable the field to exclude links to archived documents in the log. If you exclude links, users must open the archive database to view archived documents. 12. On the Schedule tab, for the field Specify a client-based scheduled archive, choose one of the following options: v Enable this field to set up a schedule for client-based archiving, and then specify the schedule by completing Step 13. v Disable this field and continue to Step 14. No archiving schedule is set for the users; however, users can still set their own archiving schedule.

108 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 13. Optional: If you enabled Specify a client-based scheduled archive, complete one or more of these fields. Table 27. Fields used to define an archive schedule for an end user Field Action Allow users to modify schedule Users modify the default schedule to set their own schedule. Frequency Choose one: v Daily – and then select the days of the week on which to archive. v Weekly – (default) and then choose the day of the week on which to archive. Run at Specify the time. The default is 12:00 PM. Note: The Notes client must be running for scheduled archiving to occur. Every week on When Weekly is set, specify the day. The default is Tuesday.

14. Also on the Schedule tab, under Location, specify the Locations from which to archive. v Any Location -- to archive from any Location. v Specific Location -- and then specify one or more Locations. 15. On the Advanced tab, complete these fields: Table 28. Advanced tab fields Field Action Delete a document only when the criteria Do one of these: can delete all responses as well v Enable (default) to ensure that a document is deleted only when the document's response documents meet archiving criteria and can also be deleted. Use this option to prevent orphaned documents in hierarchical views. v Disable the field to delete documents without prior checking of response documents. Note: This setting does not apply to Calendaring and Scheduling documents which are always enabled to prevent accidental "orphaning."

Chapter 5. Customizing service settings 109 Table 28. Advanced tab fields (continued) Field Action Maximum document retention selection is: Specify for all users to whom the policy applies, the number of days, months, or years that comprise the maximum retention period for deleting and archiving documents. If private archiving is enabled, and a maximum retention setting is in effect, users cannot define criteria with a scope that is larger than the maximum retention setting.

For example, assume the maximum retention is set to two years. Users can define criteria that selects documents created, modified, accessed, or expired up to 24 months. An error is generated if users try to save criteria whose scope is greater than 24 months (two years). Use customer-generated expiration field: Click to enable administrators to define their own field name for an archive document expiration date. Customer generated expiration field name: Specify a field name for the expiration date of archived documents. Any archive criteria that selects documents based on expiration date now uses the field name specified here.

16. Save the document.

Creating an archive criteria settings document:

Use an archive criteria settings document to define a set of criteria to be used by an archiving policy settings document when you archive an IBM Notes user's mail documents.

Before you begin v See the task “Creating an archiving policy settings document” on page 106. This procedure is part of that task. v Make sure that you have at least Editor access to the Domino directory and one of these roles: PolicyCreator role to create a settings document; PolicyModifier role to modify a settings document.

Procedure 1. Open the Settings view in the Domino Directory. 2. Select the Archive policy settings document for which you want to create archive criteria settings, and then click Edit Settings. 3. Click the Selection Criteria tab, and then click New Criteria. 4. Provide the following information on the Basics tab.

110 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 29. Basics tab fields

Field Action

Name Enter a name that identifies the archive criteria. When you add criteria to an archive policy settings document, this name appears in the selection box. This name also appears in the user's mail folder outline under Actions > Archive.

Description Enter a description of the criteria.

Enable archive criteria Choose one of the following options: v Enable the check box to use this archive criteria. v Disable the check box if you are creating archive criteria to use later.

5. For How should documents be archived? choose one: v Copy old documents into archive database; then clean up database. Use this option to archive (copy) documents to the archive database and then clean up (delete or reduce those documents) from the user's mail database. v Clean up database without archiving. Use this option to delete documents from the user's mail database without copying them into an archive database. Use this setting to enforce document-retention policies that delete all documents after a specified time. 6. If you chose to copy old documents for How should documents be cleaned up? choose one: v Delete older documents from the database. Use this option to delete copies of archived documents that remain in the user's mail database. v Reduce the size of the documents in the database. Use this option to truncate copies of the archived documents that remain in the user's mail database. 7. For Which documents should be cleaned up? specify the criteria that determines which documents are candidates for archiving. Choose one of the following options: v Older than. Use this option to specify the date the archive criteria settings document was created as the start date for the document retention period. Documents that are created before this date are eligible for archiving. v Not accessed in more than. Use this option to specify documents not opened in the specified time frame. Do not use this option unless the database property Maintain Last Accessed is set. If this property is not set, the criteria does not find any documents to archive. Specify a time period. v Not modified in more than. Use this option to specify documents that have not been modified in the specified time frame (default). Then specify a time period. This setting is recommended. v With expiration date older than. Use to specify documents that are marked as expired. A document is eligible for archiving if it has an expiration date earlier than the specified date. 8. Do not complete the fields in the Archive By View/Folder section of the document. 9. Optional: Click the Destination tab and change any of these fields.

Chapter 5. Customizing service settings 111 Table 30. Destination tab fields Field Action Archive Directory The default is archive. Enter a new name if you want to change it. Archive Prefix The default is the letter a, followed by an underscore (_). Enter a new prefix if you want to change it. Archive suffix The default is .NSF. Enter a different suffix for the archive database name if you want to use a suffix other than NSF. Number of Characters from The default is 50. To change the default, enter the original file name number of characters to use from the user's mail file name to create the archive database name.

Note: Click the link Preview an example to see the result of your choices before you save the archive criteria settings. 10. Save the document. Policy precedence When multiple policies apply to a user and there is a setting conflict, precedence rules determine which setting value is applied.

Note: There are some policy settings that are enforced in the cloud that you cannot override with on-premises policy settings. For more information, see the topics on policy settings restrictions.

You can create multiple policies that are assigned to different groups of users. For example, you could have a separate policy for each of the following users: v All users in an organization, for example, /Renovations. v All users in an organizational unit, for example, /Boston/Renovations v All users in a group in the directory, for example, Admin Group Renovations v Individual users

Note: Use the fewest number of policies and settings documents as possible to avoid complexity. In addition, avoid assigning individual users to policies, whenever possible.

When a user is assigned to more than one policy for which a setting conflicts, often you want the setting for the policy with the narrowest assignment scope to take precedence. For example, you might create one policy for your entire organization, /Renovations, that sets the Warning Period for password expiration to 10 days. Then, you might create another policy assigned to /Boston/Renovations that sets a Warning Period of 20 days. You want /Boston/Renovations policy to take precedence so that a user under /Boston/Renovations has the 20 day warning period.

In traditional on-premises Domino environments, you use the Organizational type policy to assign settings based on organization name hierarchy. In that case, the policy with the most specific scope in the hierarchy takes precedence automatically. For example, /Boston/Renovations automatically takes precedence over /Renovations.

112 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 In the cloud, only Explicit policies (sometimes referred to as dynamic policies) are supported. You can use them to create the equivalent of Organizational policies, however. To do so, create an Explicit policy and give it a hierarchical name, for example, /Renovations or /Boston/Renovations. Assign users to it by specifying a wildcard hierarchical name in the Policy Assignment field, for example, */Renovations or */Boston/Renovations.

In the cloud, the hierarchically named policy with the narrowest scope does not automatically have precedence. Instead, it is important to use the Policy Precedence value to specify that order of precedence. To specify precedence, use the Policies > Dynamic Policies view in the directory . The lower the precedence value, the higher the precedence.

For example, assume the policies in the following table, each with a different Warning Period for password expiration specified in Security Settings. Table 31. Policies with a different password expiration warning period Policy name Policy assignment Policy precedence Warning period /Renovations Renovations Admin 1 5 days Admins Group Group /Boston/Renovations */Boston/ 2 20 days Renovations /Renovations */Renovations 3 10 days

Someone who is assigned to all three policies has a warning period of 5 days because the /Renovations Admins Group policy has the lowest Policy Precedence value, 1. Someone who is under /Renovations and /Boston/Renovations but is not a member of the Renovations Admins Group, has a warning period of 20 days, because the Policy Precedence value 2 is lower than 3.

Inherit and Enforce settings. Each field in a policy settings document has Inherit and Enforce fields that are not selected, by default. These two settings can be used with hierarchically named policies to override policy precedence for specific settings. For example, assume the following policy configuration: Table 32. Policies with Inherit and Enforce settings Required Policy Policy Password Policy name assignment precedence Warning period quality /Renovations Renovations 1 5 days 7 Admins Group Admin Group /Boston/ */Boston/ 2 20 days 7 (Inherit) Renovations Renovations /Renovations */Renovations 3 10 days 8 (Enforce)

A user who is assigned to the /Boston/Renovations and /Renovations policies but not the /Renovations Admins Group policy, gets a Required Password Quality of 8. The Inherit value (from the Security Settings document for /Boston/ Renovations) and the Enforce value from the (Security Settings document for /Renovations) cause the password quality to be derived from the /Renovations policy, even though /Boston/Renovations is listed with precedence. The Warning Period is still determined by the precedence of the /Boston/Renovations policy and so is 20 days.

Chapter 5. Customizing service settings 113 The Inherit and Enforce values are evaluated only for multiple, hierarchically-named policies within one hierarchy. So, a user who belongs to all three policies, gets the Required Password Quality 7 because the /Renovations Admins Group policy has precedence and the Enforce value on the /Renovations policy does not apply.

Don't set value field. Select Don't set value next to a setting to cause it to be ignored during precedence evaluation. This field is used to prevent an unintended default setting from taking precedence over a customized setting in a policy with less precedence. For example, in a Security Settings document, the default Required Password Quality is 8. Assume you want to enforce a higher value for your entire organization. You would set the higher value in the Security Settings document that is associated with a policy assigned to the organization. Then, for Security Settings documents that are associated with all other policies that have higher precedence, select Don't set value for Required Password Quality. Then, the default value, 8, is ignored in those documents.

Use Don't set value as a general rule for all settings that you want to derive from a policy with lower precedence. Related concepts: “Policy settings restrictions” Most policy settings are supported for service users. However, there are a few restrictions to be aware of before you assign service users to an explicit policy. Policy settings restrictions Most policy settings are supported for service users. However, there are a few restrictions to be aware of before you assign service users to an explicit policy. Archiving Settings restrictions Archive Settings policies are used to set standard archiving behavior for IBM Notes client users.

In the cloud, mail archiving is always run on the Notes client. The source mail file to archive must be a local mail replica or managed mail replica on the client. The destination archive database can be created on the client or on an on-premises server. Users cannot create archives on the cloud servers. Related tasks: “Creating an archiving policy settings document” on page 106 To use policies to set up mail file archiving for IBM Notes clients, you use both Archiving Policy Settings documents and Archive Criteria Settings documents. Desktop Settings restrictions Desktop Settings are supported in on-premises policies for service users, but with a few restrictions.

The service enforces the following settings, found on the Mail tab, for all users in the service. The service ignores these settings in an on-premises policy.

Note: For information on using Desktop Settings to enable managed mail replicas, see “Using Desktop Settings to configure managed mail replicas” on page 120.

114 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 33. Desktop Settings that apply to all users in the service Settings in the Mail tab Value Description Use local mail.box to send 1 The client uses a local outgoing mail messages (faster) box for sending mail from the user interface. The client replicator transfers the sent messages from the local mail box to the mail box on the server. The value indicates how many messages need to be queued in the local mail box before triggering the replicator to transfer them to the server. Enable upgrade of all local NSFs Disable Local replicas are not updated to latest ODS version (default) automatically Enable server to poll for new Enable Provides the fastest performance. mail and trigger replication on notification of new mail

Registration Settings restrictions You can use Registration Settings in a policy for registering users on-premises. These settings are not used in the service, however. Mail Settings restrictions Mail Settings are supported in on-premises policies for service users, but with a few restrictions.

Chapter 5. Customizing service settings 115 Table 34. Mail Settings restrictions Settings Restriction Delete documents in the user's Trash folder The policy setting controls automatic after how many hours setting on the Mail > deletion in local mail file replicas on IBM Basics tab Notes clients.

To control when documents are automatically deleted from the Trash in mail files on cloud servers, do not use a policy. Instead, use the following service setting: SmartCloud Notes Administration > Account Settings > Email Management > Configure Mail Retention in the Trash Folder > Retain deleted messages for how many days? The value must be 14 - 90 days. If you do not specify a value, documents are automatically deleted from the Trash folder on mail files on cloud servers after 14 days. For more information, see the topic "Configuring how long mail remains in the Trash folder."

In the Delete documents in the user's Trash folder after how many hours policy field, specify a value that is equivalent to the service setting. For example, if you specify 21 days as the service deletion interval, specify 504 hours in the policy. When you keep the policy setting and service setting the same, documents in Trash are automatically deleted from local mail file replicas and mail file replicas on cloud servers at the same interval. If you do not specify a service setting explicitly and accept the default service deletion interval of 14 days, set the policy setting value to the equivalent value, 336 hours. List of trusted websites for images in This setting is not supported in the cloud. MIME messages setting on the Mail > The service ignores any values specified in Basics tab this field. IBM iNotes Some of these settings, which apply to web client users, relate to features that are not supported in the service.

Related tasks: “Configuring how long mail remains in the Trash folder” on page 156 When a user deletes a message from a mail file on a cloud server or the service automatically deletes an older message, the message is moved to the Trash folder where it remains for 14 days, by default. After 14 days, the message is permanently deleted. You can change how long deleted mail remains in the Trash folder. You can also prevent users from emptying the Trash folder themselves. Related information:

Comparison tables of features between IBM Notes, IBM iNotes and IBM SmartCloud Notes web

116 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Security Settings restrictions Security Settings are supported in on-premises policies for service users, but with the restrictions described in the following table. Table 35. Security Settings restrictions Settings Restrictions ID Vault tab The ID vault settings are enforced by the service and ignored in on-premises policies.

The services enforces the following settings for the ID vault in the service: v Assigned Vault: A name derived from customerID v Forgotten password help text: Contact your administrator for help (default) v Enforce password change after password has been reset: Yes v Allow automatic ID downloads: No v Allow ID downloads for: 5 days Password Management > Password If you want to enable Notes ID password Management Basics tab, Password expiration, you must do so through Expiration Settings SmartCloud Notes Administration. An on-premises Security Settings policy can be used only to enable password expiration warnings that notify users when password expiration approaches. For important details on how to use Security Settings to enable password expiration warnings, see the topic Setting password expiration for Notes IDs. Password Management > Custom Password You can use SmartCloud Notes Policy tab Administration to enable password synchronization. When service login passwords change, this feature allows Notes ID passwords to change to match. If you enable this feature, do not make custom password requirements in a policy more restrictive than the service login password requirements. For more information, see the topic Enabling password synchronization. Keys and Certificates tab The service does not support key rollover for Notes IDs. The service therefore ignores the values of fields in the Default Public Key Requirements and User Public Key Requirements sections of Security Settings.

Related tasks: “Setting password expiration for Notes IDs” on page 126 For users who access the service with the IBM Notes client, you can specify when Notes ID passwords expire. This password expiration does not apply to web users because they log in using their web login password rather than a Notes ID password. “Enabling password synchronization” on page 128 When users change their service login passwords, password synchronization enables the users to use the new passwords when they log in to the IBM Notes client.

Chapter 5. Customizing service settings 117 Roaming Settings restrictions Roaming Settings in a policy are not supported. The service does not support roaming. Notes Traveler Settings restrictions IBM Notes Traveler Settings are supported in on-premises policies for service users. Be aware of the default settings and policy restrictions within the service.

For detailed information about Notes Traveler Settings in policies, see the topic on creating a Notes Traveler policy settings document in the Notes Traveler 9 documentation.

Note: Security Settings can determine which devices and device versions can connect to the service. For information on supported devices and operating systems, see the IBM SmartCloud Notes client requirements.

The following table describes the Notes Traveler policy settings that the service enforces. You cannot use an on-premises policy to change the setting values. Table 36. Notes Traveler Settings that the service enforces Setting Enforced value Require device password Enabled

Although passwords are required, you can customize some password settings. For more information, see the table that follows this one. Note: Apple 5S and higher device users choose whether to enable the fingerprint identity sensor. If they enable the sensor, they are not required to enter the device password when they unlock the device. They are still prompted for the device password when they power on the device and at least once every 48 hours. Apple does not yet provide an API function that enables administrative control over the use of the fingerprint identity sensor. Note: Windows Tablet requires a device password of at least eight characters. The password must include at least three of the following types of characters: upper case, lower case, number, special character. Require device password > Prohibit Enabled ascending, descending and repeating sequences (Apple devices only) This setting is always enabled in the service. Therefore, ascending, descending and repeating sequences are not allowed. A sequence is three or more consecutive numbers or characters. Prohibit devices incapable of security Enabled enablement In general, this setting applies only to older mobile devices that do not support security enablement. For supported devices, see the IBM SmartCloud Notes client requirements.

118 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 36. Notes Traveler Settings that the service enforces (continued) Setting Enforced value

Device Access v Require approval for device access (disabled) v Number of devices to allow per user before approval is required (1) v Optional: Addresses to notify when approval action is pending (none)

Maximum Email Attachment Size Allowed v Android: no limit* - Administrator v Windows Mobile and Nokia Symbian^3: 4 MB limit. When the combined attachment size exceeds the limit, attachments are removed from emails that are synced to the device. v Apple: no limit* v BlackBerry® 10: no limit* v Windows Phone, Windows Tablet: no limit*

*The service always syncs attachments to the devices

The following password Security Settings are used by default in the service. Passwords are required but you can use an on-premises policy to customize these settings.

Note: Apple 5S and higher device users choose whether to enable the fingerprint identity sensor. If they enable the sensor, they are not required to enter the device password when they unlock the device. They are still prompted for the device password when they power on the device and at least once every 48 hours. Apple does not yet provide API function that enables administrative control over the use of the fingerprint identity sensor. Table 37. Security Settings used by default in the service Setting Default value in the service Require device password > Minimum 4 password length Require device password > Require Disabled alphanumeric value Require device password > Auto lock 30 minutes period (maximum) Require device password > Wrong Disabled passwords before wiping device

There is no Security Settings tab for Android devices in Domino directory templates version 8.5.2 or earlier. For these template versions, the service applies Apple device security settings to Android devices. Android devices do not support all of the Apple device security policy settings, just the following ones: v Require device password v Require alphanumeric value v Minimum password length

Chapter 5. Customizing service settings 119 v Auto lock period (maximum) v Wrong passwords before wiping device v Prohibit devices incapable of security enablement * * Compliance requires Android OS 2.2 or later with the Notes Traveler Device Administrator feature enabled by the user. The Device Administrator feature was added in Android 2.2.

There is no Security Settings tab for BlackBerry®, Windows Phone, and Windows Tablet devices in Domino directory templates version 9.0 or earlier. For these template versions, the service applies the following Apple device security settings to BlackBerry®, Windows Phone, and Windows Tablet devices: v Require device password v Require alphanumeric value v Minimum password length v Auto lock period (maximum) v Wrong passwords before wiping device Related tasks: “Managing IBM Notes Traveler devices” on page 272 For each user with an IBM Notes Traveler subscription, you can view information about the user's mobile device. You can also wipe the device to remove sensitive data from it, for example, if the device is lost or stolen. Related information:

Creating an IBM Notes Traveler policy settings document

Client requirements Using Desktop Settings to configure managed mail replicas In a hybrid environment, use Desktop Policy settings to enable managed mail replicas. Managed mail replicas helps ensure that IBM Notes users in the service have quick, local access to their mail when connected or disconnected from the network. Before you begin

Enable managed mail replicas through a Desktop Settings document that is assigned to a policy. Read about using administrative policies to understand the requirements for assigning policies to users in the service.

Note: Best practice is to configure managed mail replicas before you provision users. If you use this approach, you can resolve any managed mail replica issues ahead of user provisioning. About this task

Managed mail replicas are available beginning with Notes 8.5.2. They provide the following advantages to Notes users in the service and are recommended: v They are created automatically on the clients. v They are used automatically when the client Location is configured to connect to the mail server. v Replication between managed mail replicas and server-based mail replicas occurs automatically and in the background.

120 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v When clients are connected to the server, user mail actions are done on the local managed mail replicas. Users are not interrupted by network I/O or replication operations between the client and server. v They provide users with local access to previously synchronized mail when the client is disconnected from the network.

The following tables describe the most important settings in a Desktop Settings document to consider when you configure managed mail replicas. For settings not shown, the default settings are generally good to use. Table 38. Managed mail replicas: Desktop Settings > Mail > Mail Settings How to apply Setting Value to set this setting Applicability Comments Local mail file Created Set value At managed Converting a managed replica whenever mail replica local replica to a or Convert local modified creation or managed replica replica to conversion. allows your managed replica company to standardize on (Required) managed replicas. Mail file On server Set value When the mail The Notes client location whenever application is automatically (Required) modified opened. uses the local copy after it is created. At other times, the client uses the server. Use local 1 When mail is The service mail.box to send sent. enforces this messages (Required) setting, (faster) regardless of the value that is specified here.

A sent mail message is placed in the local mail.box and sent in the background.

Chapter 5. Customizing service settings 121 Table 39. Managed mail replicas: Desktop Settings > Mail > Managed Replica Settings How to apply Setting Value to set this setting Applicability Comments Amount of free value Mb Set value When the Type a value space required whenever managed mail that you choose. before cache is modified replica is Setting field to a created created. value such as 1,000 (1 Gb) ensures that a managed replica does not use the remaining free space on initial creation.

If you do not specify a value, no free space check is done.

Table 40. Managed mail replicas: Desktop Settings > Mail > Client Settings How to apply Setting Value to set this setting Applicability Comments Auto-retrieve Enable document When a If setting is not document without truncated enabled, users setting attachment (partial) are prompted to document is retrieve opened. truncated documents. Enable server to Enable When the client poll for new is notified that mail and trigger (Required) new mail is replication on received on the notification of server. new mail

Table 41. Managed mail replicas: Desktop Settings > Preferences > Replication > Default settings for a local replica How to apply Setting Value to set this setting Applicability Comments Create a Enable Set value When the The setting is full-text index whenever managed mail optional. for faster modified replica is searching created. Encrypt replicas Locally encrypt Set value When the The setting is whenever managed mail optional. modified replica is created.

122 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 42. Managed mail replicas: Desktop Settings > Preferences > Replication > Default replication schedule How to apply Setting Value to set this setting Applicability Comments All settings Schedule as you When the Notes normally do. Client is open

Table 43. Managed mail replicas: Desktop Settings > Preferences > Mail How to apply Setting Value to set this setting Applicability Comments Check for new Not necessary The Enable mail server to poll for new mail and trigger replication on notification of new mail setting enables this behavior. Mail checking Any value Specify any internal value. The Enable server to poll for new mail and trigger replication on notification of new mail controls this behavior.

Results

It is possible for users to see the following message after they are provisioned when managed mail replicas are enabled: Access to this server has been restricted due to excessive load.

Creating many managed mail replicas simultaneously can degrade server performance. For this reason, the service controls the number of managed mail replicas that can be created simultaneously on a mail server in the cloud. If a mail server in the cloud reaches the limit, a user can see this error on the Replication and Sync page during initial replication of the managed mail replica.

This error reflects a temporary condition. If the mail server cannot create the initial managed mail replica, it tries to create it again automatically at the next replication schedule interval or when the client is restarted.

A user who sees this error can open and use the server-based mail file in the meantime. One way to open the mail file is to click File > Open > IBM Notes Application and browse to the server and mail file replica. Related concepts: “Using administrative policies” on page 105 If you use administrative policies on premises, you can apply many of those same policy settings to service users as well. Administrative policies enable all users to have the same working experience.

Chapter 5. Customizing service settings 123 Related information:

Managed mail replicas explained

Configuring logins Reset passwords, manage password expiration periods, set up federated identity management, restrict logins to an IP range, and enable application passwords. Resetting service login passwords Users can reset their own service login passwords once within a 24 hour period by clicking Forgot password?. An administrator or administrator assistant can reset service login passwords for any user at any time. About this task

Reset passwords when userd forget their passwords, or when the password might be compromised. Users that log in by clicking Use My Organization's Login are using a federated identity and can reset their passwords only by following their company's process.

If administrators enable password synchronization, when users change their service login passwords, they can also use the new passwords to log in to the IBM Notes client.

Follow these steps to reset any user's password: Procedure 1. Click Administration > Manage Organization. 2. Click User Accounts. 3. Select the arrow next to the user that needs the password changed. 4. Select Reset password and enter the new password. This password is a temporary password that the user enters the next time that they log in. At that time, the user is asked to create a password. You can also reset the password by editing the user account. Click the appropriate user name in User Accounts and enter a new password in the Account Login tab. 5. Notify the user of the password change. The user is not automatically notified that the password was reset. Make sure to communicate this change to the user, along with the new password if needed. What to do next

Administrators can enable security settings to enforce password expiration through System Settings > Security. When s user logs in with an expired password, the user is prompted to reset that password. Setting service login password expiration By default, service login passwords do not expire. Enforcing a password expiration period helps ensure that passwords are changed frequently. Administrators can set a password expiration interval for all users.

124 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Procedure 1. Click Administration > Manage Organization 2. Click Security. 3. Click Edit Settings in the Password Settings section. Select the number of days before a password expires, how the password can be reset, and add password reset support for your users. Managing Notes IDs You can reset Notes ID passwords, set Notes ID password expiration, and synchronize Notes ID passwords with service login passwords. Resetting passwords for Notes IDs Reset the password on an IBM Notes ID file to change the current password. Typically you do this because a user has forgotten the current password.

About this task

This procedure applies only to passwords associated with Notes ID files used with Notes clients, and not to service login passwords.

Procedure 1. Log on to http://www.ibmcloud.com/social using the e-mail address and password of a SmartCloud Notes user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Under Available actions for this user, click Reset IBM Notes Password. 8. Enter a new password, and then click Save Changes. The password must be at least eight characters in length.

Chapter 5. Customizing service settings 125 9. Provide the new password to the user in a way that complies with your company security policies.

Results

After you complete this procedure, the user can log on to a SmartCloud Notes server from an IBM Notes client using the new password. After logging on with the new password, the user is prompted to change the password.

Note: If the Wrong Password prompt is displayed, tell the user to re-enter the new password that you provided. If that step does not solve the problem, tell the user to delete the local ID file and then re-enter the password.

The user has five days from the time you reset a password to use the password to log on to a SmartCloud Notes mail server and download the new password to the Notes client. If the 5-day limit is exceeded, the user sees the following message and you must reset the password again:

Contact your company administrator to have your Notes ID password reset. Related concepts: “Notes IDs and passwords” on page 130 When users connect to their mail servers in the cloud with IBM Notes clients and Notes IDs, they are authenticated using Notes Remote Procedure Call (NRPC) authentication. Related tasks: “Resetting service login passwords” on page 124 Users can reset their own service login passwords once within a 24 hour period by clicking Forgot password?. An administrator or administrator assistant can reset service login passwords for any user at any time. “Setting password expiration for Notes IDs” For users who access the service with the IBM Notes client, you can specify when Notes ID passwords expire. This password expiration does not apply to web users because they log in using their web login password rather than a Notes ID password. “Enabling password synchronization” on page 128 When users change their service login passwords, password synchronization enables the users to use the new passwords when they log in to the IBM Notes client. Setting password expiration for Notes IDs For users who access the service with the IBM Notes client, you can specify when Notes ID passwords expire. This password expiration does not apply to web users because they log in using their web login password rather than a Notes ID password.

Before you begin

For information on how this feature interacts with the password synchronization feature, see “Enabling password synchronization” on page 128.

About this task

You must enable password expiration through SmartCloud Notes Administration. An on-premises Security Settings policy can be used only to enable password expiration warnings that notify users when password expiration approaches.

126 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 If users click File > Security > User Security, the Password must be changed by field does not show the password expiration date.

Perform the following procedure to set password expiration for Notes IDs.

Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. Click Password Management 5. Click Enable password expiration for IBM Notes clients. 6. Enter the number of days a password can be used before it expires. The minimum value for this setting is 30 days; the maximum is 3650 days. 7. Optional: To warn users when password expiration approaches in a hybrid environment:

Note: Perform these steps only if you complete the previous steps to enable password expiration in the service. Enabling a warning period for service users without enabling password expiration in the service produces unexpected results and is not supported. a. Create an explicit group policy for service users. For more information, see “Creating policies for service users” on page 105. Note that if the policy is also assigned to any on-premises users who are not in the cloud, password expiration will be enabled for those users as well, with the specified change interval and warning period. b. In a Security Settings document that is assigned to the group policy, specify the following settings in the Password Management > Password Management Basics tab. Table 44. Security settings required for password expiration warnings Setting Value Enforce Password Expiration Notes Only Required Change Interval The expiration period that you specified in Step 6. Warning Period The number of days before password expiration at which the user receives an expiration warning message.

Results v When password expiration is first enabled, the passwords of all current users expire on a random basis after the expiration period, regardless of when the passwords were last changed. For example, if the expiration period is 90 days, all current users are prompted to change their passwords on a random basis when first authenticating after the 90-day expiration period. v The passwords of new users also expire on a random basis after the expiration period. v If you configured a warning period through policy settings, users receive password expiration warnings. v Users who are logged in when this setting becomes effective are not prompted to change the password during the current login session.

Chapter 5. Customizing service settings 127 v Users might experience a lag time of a few seconds between the time they change their password and authentication. This lag occurs while the updated ID is synchronizing with the vault. If the synchronization does not complete, authentication can fail. In that case, users can wait a few minutes, and then try again. If the synchronization continues to fail and the user cannot access the client, reset the Notes ID using SmartCloud Notes Administration.

What to do next

You might want to communicate the following information to your users: v How often they will be prompted to reset their passwords. v What to do if authentication fails after they change their passwords. Related concepts: “Using administrative policies” on page 105 If you use administrative policies on premises, you can apply many of those same policy settings to service users as well. Administrative policies enable all users to have the same working experience. Related tasks: “Resetting passwords for Notes IDs” on page 125 Reset the password on an IBM Notes ID file to change the current password. Typically you do this because a user has forgotten the current password. Enabling password synchronization When users change their service login passwords, password synchronization enables the users to use the new passwords when they log in to the IBM Notes client.

About this task

Password synchronization benefits users who are active users of both the web and Notes clients by allowing them to use one password for both clients.

After you enable password synchronization, when users change their service login passwords, the new passwords are added to the Notes ID files in the ID vault. Users can then use the new passwords the next time they log in to the service from the Notes client.

Password synchronization occurs whenever users change their service login passwords. Users can change the service login passwords at any time through Connections Cloud My Account Settings. They also change the passwords: v After they log in to the service for the first time with temporary passwords; v After they log in to the service after an administrator resets their service login passwords; v After they log in to the service when service login password expiration is enabled and their passwords expire.

Before you enable password synchronization, be aware of the following information: v The feature does not apply to users who log in to the service with a federated identity that your organization defines. v Synchronization occurs in one direction: from the service login password to the Notes ID password. Changing the Notes ID password does not change the service login password.

128 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v When service login passwords change, Notes client users are not required to use the new passwords. Their old passwords remain valid until they use the new passwords to log in to the service from the Notes client. Because the continued use of the old password prevents ID synchronization with the ID vault, as a best practice, recommend to users that they use the new passwords on the Notes client. v Synchronization occurs after Notes clients are connected to the service. v Notes client users can change their Notes ID passwords, either by choice or because you enable the Password Expiration setting in SmartCloud Notes Administration and their passwords expire. When Notes users change the Notes ID passwords, the service login passwords do not change automatically. However, users can use Connections Cloud My Account Settings to change the service login passwords to match the new Notes ID passwords. v If you enable password expiration for Notes IDs, a Notes ID password might expire before a user logs in to Notes with a new service login password. In this case, the user can log in to the Notes client with the old Notes ID password but the user is prompted to change the password when opening mail or another application. At this point the user can provide the new service login password. v If you use an on-premises policy to specify Notes ID password requirements for service users, as a best practice, do not make the requirements more restrictive than the service login password requirements. If the Notes ID password requirements are more restrictive, a password that is acceptable for the service password can be unacceptable for Notes. For example, if the policy requires that passwords be 10 characters and a user's service login password is only 8 characters, the service login password cannot be used for Notes. Service login passwords must: – Include at least eight characters – Include at least one non-alphabetic character and four alphabetic characters – Include no more than two repeated characters – Be different from the previous eight passwords – Not include the user's given name, surname, or email address – Not include the space character

Note: Although service login passwords can be any length, Notes ID passwords must be 63 or fewer characters. If you use password synchronization, tell users to use service login passwords that are within the 63 character limit so they can be used for the Notes ID, too.

To enable password synchronization, complete the following procedure.

Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes and then click Account Settings. 4. Click Password Management. 5. In the Password Synchronization section of the page, select Enable password synchronization. 6. Click Save.

Chapter 5. Customizing service settings 129 Results

When users change their service login passwords, they can use the new passwords to log in to the Notes client.

If users change the Notes ID password, the service login password does not change automatically.

What to do next

Notify users that the feature is enabled. Recommend that when they change the service login passwords that they use the new passwords to log in to the Notes client. Related tasks: “Resetting service login passwords” on page 124 Users can reset their own service login passwords once within a 24 hour period by clicking Forgot password?. An administrator or administrator assistant can reset service login passwords for any user at any time. “Setting service login password expiration” on page 124 By default, service login passwords do not expire. Enforcing a password expiration period helps ensure that passwords are changed frequently. Administrators can set a password expiration interval for all users. Related information:

Federated identity management Notes IDs and passwords When users connect to their mail servers in the cloud with IBM Notes clients and Notes IDs, they are authenticated using Notes Remote Procedure Call (NRPC) authentication.

In service-only environments, and in hybrid environments that do not use on-premises security policy settings to configure password requirements, Notes ID passwords must be at least eight characters. Passwords must also have a password quality of 8, on a quality scale of 0 (weakest) to 16 (strongest). Password quality refers to the required character complexity of passwords. In hybrid environments, you can use on-premises security policy settings to control password requirements.

By default, Notes ID passwords do not expire and keeping this default behavior is recommended. Nevertheless, you can configure a password expiration interval of from 30 to 3650 days through the SmartCloud Notes Administration interface. In hybrid environments, you do not control password expiration through an on-premises policy, but you can use a policy to enable a warning to be displayed to users when their passwords are due to expire.

If users forget their Notes ID passwords, company administrators can use the SmartCloud Notes Administration interface to reset the passwords to temporary values. The users use the temporary passwords to log in to the service from a Notes client and then are prompted to change the passwords.

The Notes shared login feature is supported in hybrid environments. This feature allows users to log in to Microsoft Windows and then use the Notes client without providing a Notes ID password. A benefit of this feature is there are no Notes ID passwords to use or remember.

130 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 The Notes client can connect automatically to the cloud service instant messaging community and to cloud service Activities through the client sidebar. (Access to service Activities requires a collaboration subscription). After users log on to the service mail server from the Notes client, a single-sign on capability enables them to access these cloud services during the session without providing their cloud service account login credentials. A Notes client can be configured to connect to both on-premises and cloud instant messaging servers or Activities servers through the sidebar. In this case, users must provide their cloud service login credentials to access the cloud servers. Related tasks: “Resetting passwords for Notes IDs” on page 125 Reset the password on an IBM Notes ID file to change the current password. Typically you do this because a user has forgotten the current password. “Setting password expiration for Notes IDs” on page 126 For users who access the service with the IBM Notes client, you can specify when Notes ID passwords expire. This password expiration does not apply to web users because they log in using their web login password rather than a Notes ID password. Limitations when Notes IDs are not in the vault There are advantages to using and storing IBM Notes ID files in a vault in the service. All Notes client users have a Notes ID, which is automatically uploaded to the vault at some point after the client connects to the service. Users who will not use a Notes client to access the service are not a required to have a Notes ID. However, these users are limited if they do not have a Notes ID in the service vault.

Service users who will use only the web client, and who do not have a Notes ID stored in the vault, cannot perform secure mail operations (signing mail, and reading or sending encrypted mail). These limitations also apply to IBM Notes Traveler and BlackBerry® smartphone users. If your users do not now and never have had a Notes ID, and they do not need to perform secure operations, then they do not require Notes IDs.

If, however, they previously had a Notes ID, but it will not be stored in the service vault, then these additional limitations apply: v If the mail file is transferred to the service without an imported Notes ID, then users cannot read old encrypted messages if there are any. v Administrators cannot reset the Notes password v Notes ID password resets and ID recovery are not available. v If the user's name changes, the user's Notes name cannot be changed.

If you are transferring mail files of users who currently have a Notes ID, users can import their Notes ID into the mail file before you transfer mail files. The Notes ID is uploaded to the vault the first time a user performs a secure mail operation, such as sending signed mail or reading encrypted mail. Alternatively, users can use the web client to upload the ID file to the service after they have been provisioned, or administrators can upload ID files.

If a user has a Notes ID, but the Notes ID is not stored in the vault in the service, you cannot rename the user. If however, you want to be able to rename a user, but do not want to store the user's Notes ID in the vault, you can modify the user's Person document to reflect that the user will not use a Notes ID file again. Then, you can rename the user on premises using the Rename feature in the Domino

Chapter 5. Customizing service settings 131 Administrator client. To allow renames to succeed, remove the following items from the user's Person document in the Domino Directory on a server that you synchronize with the service: v Certificate v CertificateExpiration v CertificateIssuer Related tasks: “Uploading a Notes ID to the vault” on page 269 In a hybrid environment, if a service user has an IBM Notes ID file, the ID must be stored in the ID vault in the service. In some cases, for users who have a Notes ID, but who will not use the Notes client, you might need to upload the Notes ID to the vault manually. If it is not stored in the vault, web client, Notes Traveler, and BlackBerry® smartphone users cannot perform secure mail operations. Other limitations also apply, as outlined in this topic. Setting up federated identity management When you set up federated identity management, users log on to the service using your on-premises authentication mechanism. About this task

Federated identity management provides the following benefits: v It allows your company to control the type of authentication and authentication options. For example, you might restrict access to specific networks, use VPN connections, define custom password strength or password expiration periods, use smartcards, or require two-factor authentication. v Users can use their familiar, on-premises credentials to access the cloud service. v While users are logged on to the on-premises identity provider, they can access a cloud service without being re-prompted for credentials.

After you implement federated identity management, you must accommodate users of mobile apps. If all of your mobile users have one or more IBM mobile apps such as Connections, Chat, Meetings, or most versions of IBM Notes Traveler, you have the following options: v Set up an additional, separate federated identity management endpoint for the IBM mobile apps. For more information about this, see the Flow models section of “SAML federated identity concepts” on page 133. v Use the partial authentication type when setting up federated identity management, which allows you to specify a group of users to whom federated identity management does not apply. In this case, you would specify your mobile device users. For more information about the partial authentication type, see the Authentication types section of “SAML federated identity concepts” on page 133. v Use application passwords. For information about application passwords, see “Enabling application passwords” on page 139.

All other mobile apps must use application passwords when federated identity management is implemented.

Notes Traveler version 9.0.1.3 or greater for Android is an exception to the rule. It can connect to the same federated identity management system that non-mobile apps use.

132 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Note: Users to whom federated identity management applies cannot connect to the service with IMAP clients or FTP clients. SAML federated identity concepts Learn about the federated identity process as implemented in the cloud service, the flow models that are supported, and the authentication types.

Overview of the process using SAML

Cloud services rely on SAML to provide the SSO services. In this implementation, your organization is the identity provider, and the cloud service is the service provider. You can use either SAML 1.1 or SAML 2.0.

As the identity provider, your organization authenticates users. The authentication can be by a login with a user name and password, or by some other method. For mobile apps, the authentication must be by a login with user name and password.

When a user gains access to your intranet and attempts to use a cloud service, a SAML assertion is sent from your organization to the SAML endpoint in the cloud service. The SAML assertion securely identifies the user. The cloud service uses the SAML assertion to decide whether the user can access it.

Flow models

Two flow models exist in federated identity management. One model is the identity provider initiated model (IdP-initiated), and the other is the service provider initiated model (SP-initiated). Mobile apps use the SP-initiated model.

Normally, the SP-initiated flow model is not available in SAML 1.1 because SAML 1.1 does not support Identity Provider Discovery Profile. However, the cloud services use a hybrid version of SP-initiated that allows both SAML 1.1 and SAML 2.0. As a result, Identity Provider Discovery Profile is not required by cloud services, and is not implemented.

The cloud services implement the Browser/POST profile that is used in SAML 1.1 and is compatible with the Web Browser SSO profile in SAML 2.0. Other profiles are not supported at this time.

The following outlines describe the two flows: IdP-initiated 1. The user gains access to your intranet via your organization's authentication mechanism. 2. The user navigates to a web page on your intranet that contains a link to a cloud product such as Connections Cloud or SmartCloud Notes web. 3. The user clicks the link. 4. The SSO process is initiated. A SAML assertion is sent to the cloud endpoint via HTTP POST. If the user has a valid account, access is granted. 5. The user interacts with the cloud product. SP-initiated hybrid 1. The user navigates to the cloud service login page. 2. The user clicks Use My Organization's Login.

Chapter 5. Customizing service settings 133 3. The user enters the email address that is associated with the user’s account. 4. The cloud service looks up the email address and then redirects the user to your organization’s authentication mechanism. 5. The flow continues from Step 4 of the IdP-initiated model.

The SP-initiated hybrid flow model also applies to mobile apps. Before using a mobile app, the user must do a one-time setup of the mobile app to use a cloud server. The setup process is different for each mobile app; instructions are included in the documentation of each app.

The following outline describes the flow for mobile apps: SP-initiated hybrid for mobile apps 1. A mobile app initiates a connection to a cloud service. 2. The cloud server looks up the email address and then responds with the mobile login URL of your organization’s mobile authentication mechanism. 3. The mobile client issues a basic authentication request to the mobile login URL with the user's email address and password. 4. If the basic authentication is successful, a SAML assertion is returned to the mobile app. 5. The mobile app sends the SAML assertion to the cloud endpoint via HTTP POST. If the user has a valid account, access is granted. 6. The mobile user interacts with the cloud product.

Authentication types

Four types of federated identity management are available: Federated, Modified, Partial, and Non-federated. By default, all users in your organization are assigned the Non-federated type unless you enable one of the other types. Federated Users must authenticate with your organization before they can access cloud services. Users do not have a user name or password in the cloud user account. If they go to the service login page, they must click Use My Organization's Login. The Federated type applies to all users in your organization. The Federated type is convenient for your users who normally work from the office. They can log on to your system and use cloud services without needing a separate user name and password combination. However, if any of your users work from home or work while traveling, your directory servers must be accessible from the Internet. Also, because your users cannot log in with a name and password that is defined in the service, services such as chat and IMAP are not available. If you choose the Federated type, you must implement the SP-initiated flow model. Modified Users have the option of authenticating with your organization before accessing the cloud-based services, or using a name and password defined in the service to log on. The Modified type applies to all users in your organization.

134 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 The Modified type allows your users to access cloud services from the Internet, but you do not need to make your directory servers accessible from the Internet. Your users can use the single sign-on services when they are in the office, and the cloud service login when they are outside the office. Partial Each user in your organization is assigned one of the previously listed types: Non-federated, Federated, or Modified. If you do not specify a type for a particular user, the user is assigned the Non-federated type. Use the Partial type if you have one group of users who normally work in the office, and another group of users who normally work from home or who travel frequently. For example, the office workers can be assigned the Federated type, and the traveling sales team can be assigned the Modified type. You can also use the Partial type to group users by the services that are available to them. Users with the Federated type do not have access to chat or POP/IMAP, but users of the Modified type do have access to chat and POP/IMAP. If you choose the Partial type, you must implement the SP-initiated flow model to support users with the Federated type. Non-federated The login for the cloud service is independent of, and separate from, your organization's login procedure. Users must log on using the name and password defined in the service to use the cloud-based services. The Non-federated type is the default type, and is the simplest and easiest type to set up because it requires no action on your part.

After one of the federation types is implemented, you can change to one of the other types by contacting your customer services representative. The customer services representative will advise you on the process. If you are using the Partial type, you can change individual users from one type to another without the need to contact your customer services representative. Preparing for federated identity management The difficulty of getting your system ready for federated identity management depends on both the state of your system, and on your knowledge and experience with SAML, SSO, LDAP, and related technologies.

Before contacting your IBM customer service representative to enable federated identity management, review the following checklist: v Choose the version of SAML that you want to use. You can use either SAML 1.1 or SAML 2.0. v Choose the type of federation that you want to employ: Federated, Modified, or Partial. See the topic SAML federated identity concepts for more information. v Review the IdP-initiated flow model and the SP-initiated hybrid flow model. See the topic SAML federated identity concepts for more information. v Implement SAML on your web server. You can use Tivoli® Federated Identity Manger, OpenSAML, Active Directory Federation, or some other federated identity manager.

Chapter 5. Customizing service settings 135 v If you are setting up federated identity for users of mobile apps, create a second endpoint that accepts basic authorization. The mobile apps work with the SP-initiated flow model only. v Retrieve or create the private/public key pair that will be used in digital signatures. v Integrate your directory server with your SAML service. Administration is easier if all of your users are on the same directory server. v Implement and test the SAML Browser/POST profile in either SAML 1.1 or SAML 2.0. v Create a dummy service provider and conduct an IdP-initiated single sign-on test to make sure that everything is working correctly. v Create a SAML metadata file to transmit your identity provider metadata to the IBM customer service representative. If you are using SAML 1.1, you have the option of transmitting most of the information in an email or by some other means that you negotiate with the IBM customer service representative. However, in this case you must transmit the public key inside a Java™ keystore. Enabling federated identity management When your system is ready for testing with the cloud system, contact an IBM customer services representative.

Before you begin

Before you start the enablement process, review the following list: 1. Implement and test a federated identity management system that uses SAML. Make sure that your system is configured to send the user’s email address as the subject in a SAML assertion. 2. Test your system to make sure that it is configured for the type and flow model that you have chosen. See the topic SAML federated identity concepts for more information. 3. Complete the checklist in the topic Preparing for federated identity management

Procedure

To enable federated identity management:

Send an email to cloudcsg@us.ibm.com. In the email, request to have federated identity management enabled for your organization. An IBM customer services representative will contact you with instructions and provide details of the process.

What to do next

After federated identity management is enabled, notify users of IBM mobile apps such as Traveler, Chat, or Meetings that they must generate application passwords. Users enter the application password instead of their regular login passwords when logging in with a mobile app. In the notification, include the following link, which has instructions for generating application passwords: https:// apps.na.collabserv.com/help/topic/com.ibm.cloud.welcome.doc/ logins_application_passwords.html Configuring the Sametime rich client for SAML and downloading Your users can chat using the IBM Sametime Connect rich client.

136 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

If your organization uses a standard login, your users can use any standalone Sametime Connect client at version 8.5.1 or later. They can also use the embedded version in Notes 9.0 or later.

If your users log in with your organization's authentication credentials and use SAML token authentication for federated identity management, you can create a pre-configured installation package for Sametime Connect or for Notes. SAML support in Sametime and in Notes uses the Form based user/password login type.

Alternatively, Users can download the SAML-enabled Sametime client that is available in SmartCloud and configure it themselves. Instructions to do this are in the user help https://apps.na.collabserv.com/help/topic/com.ibm.cloud.chat.doc/ imb_download_saml.html. However, users will need SAML IDP information from you to complete the configuration.

Procedure

To create a pre-configured installation package: 1. Locate the plugin_customization.ini file. The file is in one of the following locations, depending on the operating system: Windows Inside the deploy folder of the package root. RedHat Linux Inside the RedHat .rpm package at one of the following locations:

For Sametime Connect: \opt\ibm\Sametime\framework\rcp\deploy For Notes: \opt\ibm\notes\framework\rcp\deploy MacOS Inside sametime-*.pkg\Contents\deploy. 2. Add the following configuration lines in the plugin_customization.ini file, based on your company's Sametime community and SAML IDP information.

Note: To fit the width of this page, some records are shown on more than one line. In the plugin_customization.ini file, each record is a single line. # ";" is used to separate multiple communities com.ibm.collaboration.realtime.community/saml_communities= # IDP server url com.ibm.collaboration.realtime.community/.idp= # login type of IDP server com.ibm.collaboration.realtime.community/.idp.type=form # html tag id or tag name of the user name field in IDP web page. com.ibm.collaboration.realtime.community/.idp.form.username.tag= | # html tag id or tag name of the user password field in IDP web page. com.ibm.collaboration.realtime.community/.idp.form.password.tag= | # html tag id or tag name of the submit field in IDP web page. com.ibm.collaboration.realtime.community/.idp.form.submit.tag= | # Optional. The default value is "false". If "true", all on-premises communities are deleted com.ibm.collaboration.realtime.community/.primary=false

Chapter 5. Customizing service settings 137 # Optional. The default value is "false". if "true", the SmartCloud community can be # removed from the communities preference page com.ibm.collaboration.realtime.community/.editable=false Sample:

Note: To fit the width of this page, some records are shown on more than one line. In the plugin_customization.ini file, each record is a single line. com.ibm.collaboration.realtime.community/saml_communities=im.na.collabserv.com com.ibm.collaboration.realtime.community/ im.na.collabserv.com.idp=https://www.example.com/FIM/sps/SAML20/logininitial? PartnerId=https://apps.na.collabserv.com/sps/sp/saml/v2_0& TARGET=https://apps.na.collabserv.com&PROTOCOL=POST com.ibm.collaboration.realtime.community/im.na.collabserv.com.idp.type=form com.ibm.collaboration.realtime.community/im.na.collabserv.com.idp.form.username.tag=Intranet_ID com.ibm.collaboration.realtime.community/im.na.collabserv.com.idp.form.password.tag=password com.ibm.collaboration.realtime.community/im.na.collabserv.com.idp.form.submit.tag=ibm-submit 3. Replace the existing plugin_customization.ini file in the Sametime installation package or in the Notes installation package with the file that you updated. 4. Distribute the updated Sametime installation package or Notes installation package to your users. The SAML configuration information is automatically populated when your users install the client.

Note: The installation package that you distribute to Mac users must be digitally signed by IBM. Before distributing the installation package to Mac users, email your modified plugin_customization.ini file to [email protected]. A signed installation package will be created and returned to you. Restricting the IP address range To ensure that users log in from an approved network connection, administrators can define an approved range of IP addresses. About this task

By restricting the IP addresses that have access to your organization, you provide a level of protection against user's credentials being stolen or phished. If IP ranges are restricted to your network, an attacker would need to authenticate to the server from within your network to access any stolen credentials.

If your company uses SMTP, POP or iMAP protocols, restrictions are not applied. Also, restrictions are not applied to SmartCloud Notes Notes Remote Procedure Calls (NRPC). Procedure 1. Click Administration > Manage Organization 2. Click Security. 3. Click Add Range in the IP Address Ranges section to enter the beginning and ending IP addresses. You must specify the IP address at which you are currently logged in. Results

Enabling IP address restrictions might block mobile user access to your organization. For example, Blackberry users must authenticate through a Blackberry Enterprise Server (BES) which authenticates both the mobile device and the user. Because the IP address for the authenticated user is that of the BES server,

138 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 IP address restrictions can block access, depending on the range specified. Use VPN tools on the mobile device to route traffic to your organization using your network What to do next

You can use IP address restrictions as a secondary authentication mechanism in combination with SAML single sign-on authentication. Enabling application passwords Application passwords can be used to provide a secure login for applications that do not support forms-based authentication. For example, they can be used to access applications that require passwords on a mobile device or for organizations that use federated identity and service login passwords are not used. When you enable application passwords, you also have the option of requiring the use of application passwords, and of allowing mobile users to bypass IP restrictions. About this task

If you require an application password, then the service login password is disabled for the application, and users must log in using the application password. For example, users would be required to use the application password to log in to the service on a mobile device or in a browser. However, they could still use the service login password to log in to the service web site and for other applications. If you do not require an application password, then users can continue to log in from a browser, for example, using their service login password.

If you allow mobile users to bypass IP restrictions, application passwords provide an additional layer of password strength. This is due in part to their length (16 characters) and because they are generated using a strong random number generator. If a mobile device is lost or stolen, you can then disable the IP restriction bypass which prevents access to the application outside your organization's designated IP range.

Note: If you enable application passwords and select the Ignore IP range restrictions for applications setting to allow users to bypass IP restrictions, the setting does not apply to Windows Phone or Windows Tablet users. If you restrict login to a specific IP range, Windows Phone and Windows Tablet users must log in from network locations within the range.

You can also disable the use of application passwords at any time. Then, if users have created an application password, the application cannot be accessed because the password is no longer effective.

Tip: Users can also prevent access to the application by revoking their application password, which they can do at any time.

Organizations that do not use federated identity can disable the use of the standard service password for mobile applications. Procedure 1. Select Administration > Manage Organization. 2. In the navigation pane, under System Settings, click Security. 3. Under Password Settings, click Edit Settings.

Chapter 5. Customizing service settings 139 4. Select Allow users to generate application passwords. 5. Select any of the following options that apply, and then click Save Changes. Table 45. Application Password Options Option Result Expiration Select a password expiration interval or select No expiration if you do not want application passwords to expire. Ignore IP range restrictions for applications Users will be able to access applications from outside the organization's designated IP range. However, they cannot access it using the service login, they must use an application password instead. For more information about specifying IP address ranges, refer to “Restricting the IP address range” on page 138 Require applications to use application This option restricts the supported passwords to access this site authentication flow to application passwords. It prevents users from logging to this site using their service login password.

This option does not display for organizations that use federated identity.

Results

After you enable this feature, users can create and manage application passwords in My Account Settings in the service. General information about how users manage their application passwords is listed here. v If enabled, users can generate an application password for the IBM Notes Traveler. v Application passwords can be shared across mobile products, including IBM Traveler, IBM Sametime, and Connections Cloud. v If you did not select the option Require applications to use application passwords to access this site, then using an application password is optional for users. However, if you have IP range restrictions enabled, they will not be able to log in using their service password unless they are within the IP range. v Application passwords are generated by the service when requested by users. The generated passwords displays to the user only once, and cannot be recovered. v Users can revoke and generate a new application password at any time. There is no limit to the number that can be generated. v Passwords are generated using cryptographically strong random number generator. They are 16 characters long, and not case sensitive. Users should enter the password once into their device and allow the device to save the password. v If there are ten failed login attempts, the account is locked for three minutes. What to do next

If you selected Applications must use the generated password to access this site, or if you allowed users to bypass the specified IP range, instruct them to generate application passwords. For information on how users generate application passwords see Application passwords for mobile access.

140 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Authentication methods by client The following table lists the authentication methods supported for each type of IBM SmartCloud Notesclient. Table 46. Authentication methods by SmartCloud Notes client Authentication method Supported clients

Cloud service account identity and v SmartCloud Notes web password v IMAP clients v IBM Notes Traveler devices v FTP client that is used to connect to the integration server to download journal files or to upload change files to manage user accounts

SAML Federated Identity v SmartCloud Notes web v Notes Traveler Android 9.0.1.3 and higher client Cloud service account identity with Notes Traveler devices application password NRPC IBM Notes Research in Motion data center BlackBerry® devices that access the service authentication through Hosted BlackBerry subscriptions

Password rules by authentication method The following table summarizes the password rules and settings for each supported IBM SmartCloud Notes client. Table 47. Password rules and settings by authentication method Authentication method Password rules Password expiration1 Password changes

Cloud service v At least eight v Disabled by v By administrator account identity and characters default v By user password v At least four v Administrators can alphabetic enable a password characters expiration interval v At least one of 30, 60, 90, 180, non-alphabetic or 365 days. character v No spaces v No more than two consecutive characters v No match of any of the eight previous passwords v Cannot contain user name or email address SAML Federated Controlled by Controlled by Controlled by Identity company company company

Chapter 5. Customizing service settings 141 Table 47. Password rules and settings by authentication method (continued) Authentication method Password rules Password expiration1 Password changes

Cloud service 16 characters v Disabled by v Password changes account identity and (non-case sensitive) default not allowed application password v Administrators can v Administrators or enable users can revoke passwords and users then generate new ones

NRPC In service-only v Disabled by v By administrator environments, and in default v By user hybrid environments v Administrators can that do not use enable through policy security SmartCloud settings to configure NotesAdministration password requirements, IBM Notes ID passwords must be at least eight characters and have a password quality of 8, on a password quality scale of 0 (weakest) to 16 (strongest).

1 While it may seem that requiring passwords to expire provides more security, most security experts believe the opposite is true. Password expiration often leads to the use of simpler, more easily-guessed passwords, and to users writing down passwords to remember them. A better policy is to use more complex password phrases that do not expire, whenever possible. In addition to providing better security, this policy also reduces the number of help desk calls generated from users who forget their ever-changing passwords.

Configuring the name finder Complete this procedure to configure how users find names in a directory. Before you begin

Read the topic “Standard and Advanced Name Finder options” on page 145for details about and a comparison of the Standard and Advanced name finder options.

If you plan to use the Show user photos option to show photos that are stored in an on-premises Domino directory, complete the procedure “Adding photos to Person documents” on page 147.

If you plan to use the Browse corporate hierarchy feature without the Use ranked sort order option, assign corporate hierarchy categories to Person documents in the on-premises directory. For more information, see the topic about categorizing users by corporate hierarchy in the IBM Domino documentation.

142 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 If you plan to use the Use ranked sort order option, use the Domino Japanese Extension (DJX) tool to customize the on-premises directory to support it. About this task

The name finder settings control how users find names in a directory. For example, the settings are used when users find names by clicking the To link in a new mail message or the Required link in a new meeting invitation.

Name Finder settings are not related to type ahead addressing, the feature that automatically finds matches to names that users type in address fields. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings. 5. Click Name Finder. 6. Select options, as described in the following table:

Option Description Basic The name finder lists all names in a directory, in alphabetical order by surname. Users type the first few characters of the surname they are looking for, and the cursor moves to the first matching name. From there, users can use the scroll bar to find the name.

This setting is the default and it applies to Notes users and web client users. Basic Quick Search Only The name finder shows no names in a directory, initially. Users type the first few characters of a given name or surname and click Search. The name finder then shows directory entries whose surnames or given names begin with the characters searched for.

For example, a search for Jack can return the names Jackie Roberts or Tony Jackson but not Tony Blackjack.

This setting provides more flexibility for finding names in large directories.

This setting applies to Notes users and web client users.

Chapter 5. Customizing service settings 143 Option Description Standard Users search for names and search results show directory entries that match. Unlike the Basic and Basic Quick Search Only options, users can sort the search results and see details about the user entries that are returned in search results.

This search capability applies to web client users only. Advanced Users get the name finder capabilities of the Standard option. In addition, they are able to narrow search results by manager, department, job title, location.

This option is available for hybrid environments only.

This search capability applies to web client users only. Show user photos Search results show user photos.

In service-only environments, the photos come from IBM Connections Cloud user profiles.

In hybrid environments, the photos can come from IBM Connections Cloud user profiles or from Person documents in an on-premises directory. To use an on-premises directory, clear the Use SmartCloud Engage photos field.

This option is available when you select the Standard or Advanced options.

The feature applies to web client users only. Browse corporate hierarchy Users can browse a directory by hierarchy categories that you assign to Person documents in an on-premises Domino directory.

This option is available for hybrid environments when you select the Standard or Advanced options.

The feature applies to Notes users and to web client users. Browse corporate hierarchy > Used ranked Users can browse a directory by ranked sort order categories that you define in an on-premises Domino directory by using the Domino Japanese Extension (DJX) tool.

This option is available for hybrid environments when you select the Standard or Advanced options.

The feature applies to Notes users and to web client users.

144 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Results

The change usually takes effect within 15 minutes or less. Related information:

Domino documentation Standard and Advanced Name Finder options The Standard and Advanced Name Finder configuration options provide several features to help users to find names in directories.

The Standard option is available for service-only environments and hybrid environments. The Advanced option is available for hybrid environments only.

The following table compares the features that are provided by each option. All of these features are available for the web client. The features currently available for the IBM Notes client are the browse features only. When you enable the Standard or Advanced option, the Basic Quick Search Only search option is put in effect for Notes client users. Table 48. Comparison of the Standard and Advanced Name Finder configuration options Feature Standard Name Finder Advanced Name Finder Name search Users can search by: Users can search by: v First name v First name v Last name v Last name v Notes full name v Notes full name v Internet address v Internet address v Short name v Short name v Alternate name v Alternate name (if value v Phonetic name populated in directory) v Phonetic name (if value populated in directory) Search conditions to narrow Not available Users can narrow name the results of name searches searches by: v Manager v Department v Job Title v Location

Each condition added narrows results further.

These fields must be populated in Person documents in the on-premises directory. Maximum search results 200 200 returned

Chapter 5. Customizing service settings 145 Table 48. Comparison of the Standard and Advanced Name Finder configuration options (continued) Feature Standard Name Finder Advanced Name Finder Sort entries in search results All users can sort results by: All users can sort results by: v Last name, first name v Last name, first name v First name, last name v First name, last name v Directory v Directory

Users in hybrid Users can sort results by the environments can sort results following information, if the by the following information, corresponding fields are if the corresponding fields populated in Person are populated in Person documents: documents: v Manager v Manager v Job Title v Job Title v Department v Department v Location v Location Show details about names in All users can see the All users can see the search results following details: following details: v User name v User name v Internet address v Internet address v Domain v Domain v Directory v Directory Users in hybrid Users can see several environments can see several additional details, if the additional details, if the fields are populated in fields are populated in Person documents. Person documents. Show user photos from IBM This feature requires users to Connections Cloud user have a collaboration This feature requires users to profiles in search results subscription in addition to a have a collaboration SmartCloud Notes subscription in addition to a subscription. SmartCloud Notes subscription. Shows user photos from Available in hybrid Requires a change to the on-premises Person environments only and Domino directory design to documents requires a change to the support photos in Person Domino directory design to documents. support photos in Person documents. Browse entries in a directory Available in hybrid Available for directories with by categories that are defined environments for directories Person documents that are by use of the Domino with Person documents that assigned corporate hierarchy Corporate Hierarchy feature are assigned corporate categories. For more hierarchy categories. For information, see the topic more information, see the about categorizing a user by topic about categorizing a corporate hierarchy in the user by corporate hierarchy Domino documentation. in the Domino documentation.

146 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 48. Comparison of the Standard and Advanced Name Finder configuration options (continued) Feature Standard Name Finder Advanced Name Finder Browse entries in a directory Available in hybrid You use the Domino by ranking environments. You use the Japanese Extension tool Domino Japanese Extension (DJX) to configure the tool (DJX) to configure the directory to support this directory to support this option. option.

Related information:

Domino documentation Adding photos to Person documents In a hybrid environment, you can enable the Name Finder Show user photo option to use photos in the IBM Domino directory. Before you do, add photo fields to the directory design and then add photo image files to the directory. About this task

Make the changes described in this procedure to a synchronized directory that replicates to the service. Procedure 1. Make a backup copy of your pubnames.ntf file. 2. From IBM Domino Designer, open pubnames.ntf. 3. Click Shared Elements > Subforms. 4. Double-click the $PersonInheritableSchema subform. 5. Create a field called Photo: a. In the Basics tab, click Create > Field. b. In the Name field of the properties box, type Photo.IntheType field, select RichTextLite. c. Click the second tab of the properties box and complete the following fields: v In the Only allow field, select Thumbnail. v Select Resize Thumbnail Image, in pixels. v In the Width field, select 85. v In the Height field, select 74. v In the Image attachment name field, type ContactPhoto. d. Click the sixth tab of the properties box. Clear the following Hide paragraph from fields to ensure they are not selected so that the field is visible: v Notes R4.6 or later v Web browsers v Mobile e. Select the new Photo field. In the Objects panel, click the onChange event and add the following code to it: Sub Onchange(Source As Field) Dim ws As New NotesUIWorkspace Dim uidoc As NotesUIDocument Dim doc As NotesDocument

Chapter 5. Customizing service settings 147 Set uidoc = ws.CurrentDocument Set doc = uidoc.Document Call doc.ReplaceItemValue("PhotoModified", Now()) End Sub 6. At the bottom of the $PersonInheritableSchema subform, create a hidden field called PhotoModified: a. In the Basics tab, click Create > Field. b. In the Name field of the properties box, type PhotoModified.IntheType field, select Date/Time. c. Click the second tab of the properties box and complete the following fields: v Select DisplayTime. v In the Show field, select Hours and minutes. v In the Time zone field, select Adjust time to local zone. 7. Save and close the subform. 8. Replace the design of your directory database with the new version of the pubnames.ntf template. 9. To add a photo to a Person document, open the Person document in the directory, click the photo field that you created, select the image file, and save the document. What to do next

Enable the Name Finder option Show user photos and do not select Use SmartCloud Engage photos. Related tasks: “Configuring the name finder” on page 142 Complete this procedure to configure how users find names in a directory. Basic name finder illustration The following pictures illustrate finding names in a directory when the Basic name finder option is enabled.

148 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Basic Quick Search Only name finder illustration The following pictures illustrate finding names in a directory when the Basic Quick Search Only name finder option is enabled.

Chapter 5. Customizing service settings 149 150 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Standard name finder illustration The following pictures illustrate finding names in a directory when the Standard name finder option is enabled.

Chapter 5. Customizing service settings 151 Advanced name finder illustration The following pictures illustrate finding names in a directory by narrowing search results when the Advanced name finder option is enabled.

152 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Browse corporate hierarchy name finder illustration The following pictures illustrate browsing a directory to find names when the Browse corporate hierarchy option is used with the Standard or Advanced name finder.

Chapter 5. Customizing service settings 153 Configuring mail settings There are several settings related to mail that you configure from SmartCloud Notes Administration. Changing the size limit for incoming messages The service does not deliver inbound messages that are larger than 100MB, by default. You can specify a different inbound message size limit. The limit applies to all mail that is sent to users in the service. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click Email Management. 5. Under Limit Message Size, specify the size limit for incoming messages. Prevent automatic forwarding of messages You can prevent users from using mail rules to automatically forwarding email to external addresses. About this task

Users can create mail rules that include the action send copy to, which automatically forwards a copy of the email to other users. Select this option so that mail addressed to users in domains that are not owned by your company are ignored when the message is forwarded. Users can still forward email to any address manually. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization.

154 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click Email Management. 5. Under External Forwarding, select Do not allow automatic forwarding to external addresses. Specifying how Notes links display in the web client You can specify how IBM Notes links, such as doc links, application links, and view links, display in web client email. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click Email Management. 5. Under Link Style, select how Notes document, view, and application links display when users read mail in a browser: Table 49. Link Style Options and Icons Style Description Web links only The default. Uses web addresses (https://...). In email, the address displays as an Internet icon:

Document link

View link

Application link Notes links only Uses Notes URLs (notes://...). In email, the address displays as a Notes icon:

Document link

View link

Application links Note: A web client user can open this style of link only if the target is located in the service. For example, a web client user cannot open a link to an application on an on-premises server. Notes and web links Uses both web and Notes addresses, and includes both icons to represent each link. Example of a link to a document:

Chapter 5. Customizing service settings 155 Configuring how long mail remains in the Trash folder When a user deletes a message from a mail file on a cloud server or the service automatically deletes an older message, the message is moved to the Trash folder where it remains for 14 days, by default. After 14 days, the message is permanently deleted. You can change how long deleted mail remains in the Trash folder. You can also prevent users from emptying the Trash folder themselves. Before you begin

In a hybrid environment that includes IBM Notes clients, you can use an on-premises Mail Settings policy to specify automatic deletion from the Trash folder on local mail file replicas. For more information, see the topic “Mail Settings restrictions” on page 115. About this task

Documents that are deleted from the Trash folder cannot be recovered. While deleted mail is in the Trash folder, users can restore it to its original folder.

The Trash folder can contain a maximum of 32,768 messages. If this limit is reached, each message added to the Trash folder causes a message that has been in the Trash folder the longest to be permanently deleted. This deletion occurs even if a message has been in the Trash folder less time than the specified deletion interval. Premature deletion from Trash stops when either manual or automatic deletion of messages causes the number of messages in the Trash folder to fall below the limit. This behavior is not common but can occur in mail files where many messages are frequently received and deleted. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click Email Management. 5. Under Configure Mail Retention in the Trash Folder, complete these fields to manage mail in the Trash folder. Table 50. Trash Folder Mail Retention Settings Option Description Retain deleted messages for how many Enter a number from 14 - 90. The default days? value is 14.

If you decrease an interval that was previously set, then all messages that meet the new criteria are deleted. For example, if you decrease the interval from 20 days to 16 days, then mail in the Trash folder older than 16 days is deleted.

156 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 50. Trash Folder Mail Retention Settings (continued) Option Description Allow users to empty the Trash folder When this option is selected, users can permanently delete messages from the Trash folder by clicking Empty Trash or by selecting a message and deleting it.

This option is enabled by default. To prevent users from deleting mail from the Trash folder, deselect the option. Then, mail remains in the Trash folder for the duration specified in Retain deleted messages for how many days? before being permanently deleted. Note: If you prevent users from deleting mail in the Trash, IBM Notes client users can still delete mail from the Trash on local mail replicas. However, the deletion does not carry over to the server mail file replicas.

Deleting older email and meetings You can reduce the size of mail files and improve email usability by automatically deleting older email messages and meetings. By default, email messages and meetings remain indefinitely unless users delete them. About this task

When you enable email deletion, you can: v Control how many days messages and meetings remain before they are processed for deletion. v Exclude messages in user-created folders from automatic message deletion. v Send reports of automatically deleted messages and meetings to specific user addresses. v Exclude the mail files of specific users from the automatic deletion.

Non-mail documents added by web client users, such as Person documents, are not deleted.

Messages that are flagged for follow-up are not deleted, except for messages that are flagged by the sender before being sent, which are deleted.

When email deletion is enabled, the service takes the following steps to delete older messages and meetings: 1. Messages that are older than the Delete email after how many days? value are moved temporarily to a folder created by the service. Meetings are moved to the temporary folder when it is longer than the specified number of days since the meetings occurred. Repeat meetings are processed based on the date of the last meeting. 2. The default name of the folder to which deleted messages and meetings are moved temporarily is *To Be Deleted*. You can specify a different name. Users can prevent messages in this folder from being deleted by moving them to a folder that is exempted from automatic deletion. 3. Messages and meetings are moved weekly from the temporary folder location to the Trash folder. The service staggers this processing so that not all mail files

Chapter 5. Customizing service settings 157 are processed at the same time. Users can prevent messages and meetings in the Trash folder from being deleted by moving them to a folder that is exempted from automatic deletion. 4. Messages and meetings are deleted from the Trash folder after 14 days, by default. You can use the Retain deleted messages for how many days? setting in the Configure Mail Retention in the Trash Folder section of the Email Management window to change the number of days messages remain in the Trash folder. After messages are deleted from the Trash folder, they cannot be recovered.

The value of Delete email after how many days? plus the value of Retain deleted messages for how many days? determine when messages are deleted from mail files. For example, if the value of Delete email after how many days? is 365 and the value of Retain deleted messages for how many days? is 90, messages are permanently deleted from mail files after one year and three months (455 days).

Perform the following steps to enable and configure automatic deletion of older email. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click Email Management. 5. Under Delete Older Email, select Enable email deletion. 6. Use the following settings to specify how to manage older email deletion: Table 51. Mail Deletion Settings Option Description Delete email after how many days? Specify the number of days email messages remain before being processed for deletion. If no value is specified, 14 days is the default value. Keep email that is filed in folders. Select this option to prevent mail that is stored in all user-created folders from being deleted. Keep email only if it is in one of these Select this option to keep mail only folders or their subfolders messages in specific folders or subfolders from being deleted. In the Exempt Folders box, specify the folder names, one name per line.

To specify a single subfolder, enter parentfolder\subfolder. For example, enter Suppliers\Tools to prevent messages in the \Tools subfolder from being automatically deleted, but to allow messages in the Suppliers parent folder and any other of its subfolders to be deleted.

158 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 51. Mail Deletion Settings (continued) Option Description Folder name Specify the name of a folder to temporarily store messages that are targeted for deletion. If the folder does not exist, the service creates it. Messages remain in this folder for a week and then are moved to the Trash folder.

If you do not specify a folder name, the name *To Be Deleted* is used. Send email report of the number of emails List the addresses of users you want to deleted to the following addresses receive email deletion reports. Do not delete the email of the following List the names of users you want to exempt users from mail deletion.

Enabling the ActiveX control for Internet Explorer users The Internet Explorer ActiveX control provides mail enhancements to IBM SmartCloud Notes web users who use Internet Explorer. About this task

You enable use of the ActiveX control through SmartCloud Notes Administration Account Settings. ActiveX is disabled by default to allow and encourage more secure web browser configurations. If you enable ActiveX to provide additional mail features to Internet Explorer users, be aware that doing so might result in less secure browser configurations.

If you enable ActiveX, when users who use Internet Explorer log in to the SmartCloud Notes service, they see prompts that allow them to install the ActiveX control. The prompts refer to the ActiveX control as the IBM iNotes control.

After users install the control, they can do the following tasks: v Make SmartCloud Notes web the default email client through Preferences. v Send email from Windows Explorer, the desktop, or the Start menu. v Create new email messages by clicking a Mailto:// link from external web pages. v Select multiple files to attach to an email, detach and save multiple attachments, open attachments by double-clicking without having to save them first, and drag multiple attachments to Windows Explorer or the desktop. v Copy an image to the clipboard and then press Ctrl+V or click the image icon in the message toolbar to paste the image into an email.

Note: Running Internet Explorer in Protected Mode can prevent users from being able to save attachments, drag attachments from mail to the desktop, or set the default mail client. For information about options to resolve this issue and about Protected Mode, see IBM Technote 1655831. One option is to resolve the issue by adding the mail server or domain as a trusted site. If you use this option, as the trusted site, specify notes..collabserv.com (where dc is your data center) or *.collabserv.com.

Users might occasionally be prompted to install updates to the ActiveX control when enhancements to the control are deployed in the service. If users do not

Chapter 5. Customizing service settings 159 install an update, features that require the control are no longer available during the current session. Users are prompted again to install the update when they next log in to the service.

Complete the following steps to enable all web users who use Internet Explorer to download and use the ActiveX control. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings. 5. Click Email & Calendar Options. 6. Select Enable ActiveX attachment control. Related information:

IBM Technote 1655831 Specifying an SMTP server to route mail to the Internet By default, the service routes mail that service users send to external users over the Internet. You have the option to route this mail through a company-controlled SMTP host server instead. Before you begin

Prepare your on-premises environment. For more information, see “Preparing to use a company SMTP server to route outbound Internet mail” on page 54. About this task

Skip this procedure if you want the service to handle routing the mail that is sent to external users. In this case (default behavior), the service filters the messages for virus and spam before routing them to the Internet.

By using a company SMTP host server for external routing, you can act on messages before routing them, for example, filter or audit messages. When you use this feature, the service filters messages for viruses and spam and then routes them directly to your designated SMTP host server. Messages addressed to any domain that is not an internal, service-verified domain are routed to the SMTP host server.

The service uses Transport Layer Security (TLS) to route mail to the SMTP host server if the host server uses TLS. The connection is made using STARTTLS over SSL TCP/IP port 25.

Perform the following steps to specify the name of your SMTP host server in Account Settings. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes.

160 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 4. Click Account Settings > Email Management. 5. In the SMTP server field under Manage Routing to External Internet Domains, enter an SMTP host name to use for routing. 6. Click Save.

Preparing to use custom mail file templates You can apply a custom mail file template to mail files of service users. The template must meet design requirements that minimize the risk and impact to your users and to the service. You submit the template for approval to an IBM Software Services for Collaboration representative. About this task

The template design development can be done in-house or through a contract with a third-party developer or an IBM representative. A short professional services engagement with IBM Software Services for Collaboration is required to approve a custom template.

A custom mail file template allows you to customize the design of user mail files. It is also used to customize the mail file access of new mail files to enable administrators or server-based agents to access them. Customized mail file access is strongly recommended; without it only mail file owners and mail file delegates can access mail files.

The following steps outline the high-level tasks and identify who is responsible for developing and applying a custom template. Procedure 1. Customer Contacts an IBM Software Services for Collaboration representative to procure a statement of work. This step should be done as soon as it is determined that the business requires a custom mail template. This prior notice ensures that they are prepared to validate the template soon after receiving it 2. Developer Reviews the design requirements for custom mail templates. To be approved for use with the service, a custom mail template must meet specific design requirements. For example, a custom template must contain specific design elements from the standard mail template of a IBM Notes version supported by the service. For information about template design requirements, see the wiki article SmartCloud Notes Template Validation Requirements. 3. Developer Designs and implements the template changes in the on-premises environment. When preparing a custom template that is already in use, the developer should: v Assess and document the current customizations. v Compare each customization to the standard mail template. Determine whether each is still needed or if it can be deleted. If a customization is still needed, determine whether it requires modification. v Document the requirements for the new version of the custom template. 4. Customer Tests the template in the on-premises environment. You are responsible for testing the template in your company environment to ensure that it functions as intended.

Chapter 5. Customizing service settings 161 5. Customer Emails a request to [email protected] to be set up for the Mail Analyzer application. The email should include the Customer ID and also be sent to the IBM Software Services for Collaboration representative. The customer receives a confirmation email when setup is complete. The Mail Analyzer application is used to do preliminary checks of the custom template. 6. Customer After receiving notification that the Mail Analyzer application setup is complete, the customer emails the custom template to [email protected] to perform an automated analysis. The customer receives an email summary of the results. This step can be repeated as often as needed during the development and testing cycle. 7. Customer Submits the template to an IBM representative for a final manual validation. Template validation requires a short professional services engagement with IBM Software Services for Collaboration. 8. IBM representative Validates the template and report results to the customer. This step ensures that the template meets the template validation requirements. The IBM representative sends the customer a short, written report summarizing the assessment, and indicating approval or rejection. 9. IBM representative Loads the template to the service, after approval of the template. 10. Company administrator Applies the template to user accounts. When the template is approved, a company administrator for the service uses SmartCloud Notes Administration to apply the template to the accounts of new or existing users. Alternatively, the template can be applied through the integration server and a user provisioning change file. For more information, see the topic on creating user provisioning change files in the integration server documentation. Related tasks: “Preparing customized mail file ACLs” on page 168 An important reason to customize mail file access is to allow administrators or server-based agents to access mail files. Without customized mail file access, only mail file owners and mail file delegates can access mail files. “Configuring mail file templates” on page 164 Configure which mail file templates can be applied to user mail files and configure a mail file template to use by default. “Changing user mail file templates” on page 246 You can change the mail file template assigned to a user. For example, change the mail template if the IBM Notes client of a user is upgraded to a new version. Related information:

Integration server documentation Handling execution security alerts caused by custom templates The service signs a custom mail file template with a unique customer signature. IBM Notes users that use a custom mail file template see an execution security alert if the Execution Control List (ECL) on the client does not allow access to the signature.

162 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

The first time Notes users authenticate with the service after the application of a custom template, they see an execution security alert. The alert states that the template signer, customerID LotusLive Template Signer/customercertifier,is attempting to perform an ECL update action. Selecting Start trusting the signer prevents all future alerts for the template signature.

For more information about execution security alerts, see the topic about the execution control list in the Domino documentation.

In a hybrid environment, you can prevent the security alerts by using a Security Settings document that is assigned to an explicit policy. To do so, perform the following steps before you deploy the custom template: Procedure 1. Read the topic on using administrative policies to understand the requirements for using policies with the service. 2. From the Domino Administrator, open a server with the directory in which you want to configure the policy. 3. Select the People & Groups tab, and then open the Settings view. 4. Choose one of the following options: v To add a Security Settings document, click Add Settings > Security, and type a name for the new document. v To edit an existing Security Settings document, click Edit Settings. 5. Click the Execution Control List tab. 6. In the Admin ECL field, click Edit. 7. Click Add. 8. Type */customercertifier, where customercertifier is the name of the certifier that you uploaded to the service and that is used to name your mail servers in the service. For example, type */SCN/Renovations. 9. Select the certifier name that you added, select the allowed access levels, and click OK. You must select Workstation security and then select Access to Workstation Security ECL. If you are unsure which other access levels to allow, select the same access levels that are specified for Notes Template Development. 10. In the Update Mode field, select Refresh. 11. In the Update Frequency field, select When Admin ECL Changes. 12. Click Save & Close. 13. Make sure that the Security Settings document is assigned to an explicit policy that is used for users in the service. 14. Before you deploy the custom template, allow time for the policy change to replicate to the service. Related concepts: “Using administrative policies” on page 105 If you use administrative policies on premises, you can apply many of those same policy settings to service users as well. Administrative policies enable all users to have the same working experience. Related information:

Chapter 5. Customizing service settings 163 Domino documentation

Configuring mail file templates Configure which mail file templates can be applied to user mail files and configure a mail file template to use by default. About this task

The service provides standard mail file templates to apply to user mail files. Custom mail file templates that are designed for your company and approved by an IBM Software Services for Collaboration representative might also be available for use. Apply the mail file template after user provisioning. Procedure 1. Log on to http://www.ibmcloud.com/social as a user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. From SmartCloud Notes Administration, click Mail Templates. 5. Perform any of the following template management tasks. Table 52. Mail template management tasks Task Steps Additional information

Select a mail template 1. Click Custom Mail Templates If you do not select a to apply to new user or Standard Mail Templates. default template, the most accounts by default. recent English version of the 2. Select a template. standard template is used as 3. Click Set as default the default.

You can change the mail template after you add a new user, as necessary.

Download a template to 1. Click Custom Mail Templates When the design changes make design changes to or Standard Mail Templates. are complete, you must it. submit the template to an 2. Select a template. IBM Software Services for 3. Click Download. Collaboration representative for approval before it can be applied to user mail files.

Remove a custom 1. Click Custom Mail Templates. Remove a template if it is template from the list of no longer used. If you 2. Select a template. available templates. remove a template that is 3. Click Delete Selected. currently assigned to a user, you should assign a new one.

Be careful when removing a template. If you change your mind, you must contract the services of IBM Software Services for Collaboration to add it back.

164 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Related tasks: “Changing user mail file templates” on page 246 You can change the mail file template assigned to a user. For example, change the mail template if the IBM Notes client of a user is upgraded to a new version. “Preparing to use custom mail file templates” on page 161 You can apply a custom mail file template to mail files of service users. The template must meet design requirements that minimize the risk and impact to your users and to the service. You submit the template for approval to an IBM Software Services for Collaboration representative. “Viewing assigned mail file templates” on page 247 You can view the mail file template that is assigned to a service user.

Using extension forms files to customize the look of the web client You can use an extension forms file to customize the visual theme, fonts, the action bar, and other aspects of the web client. For example, you can add graphics, change colors, and add new menu items. Before you begin

Read the topic “Extension forms file requirements” on page 167.

Note: IBM reserves the right to disable any extension forms file that causes a degradation in the service. About this task

Deploying an extension forms file in the service requires a brief service contract with an IBM Software Services for Collaboration representative. The representative validates extension forms files to ensure that they comply with requirements that reduce risk to your users and to the service. Once approved, the IBM representative uploads the extension forms file to the service for your use. You can deploy more than one extension forms file and apply each to different users.

Extension forms files must be based on the IBM iNotes 9.0 Social Edition forms9_x.ntf template that is downloaded from the service.

To deploy an extension forms file in the service, perform the following steps. Procedure 1. Download the extension forms template or a currently deployed extension forms file from the service: a. Log in to the service as an administrator. b. If your account has the user role, click Admin > Manage Organization. c. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. d. Click Extension Forms Files. e. Perform one of the following steps: v To use the default design as a starting point, click Extension Forms Templates and download the template file. v To download an extensions forms file that is already deployed, select the file in the Extension Forms File page and click Download.

Chapter 5. Customizing service settings 165 2. If you download the extension forms template in the previous step, use the template to create the extension forms file. 3. To transfer changes in an extension forms file currently used at your company to the extension forms file used in the service: v Assess and document the design changes in the on-premises extension forms file. v Note any design changes that are no longer needed and can be deleted. v Determine whether the remaining design changes in the on-premises extension forms file are supported in the service or need modification. v Document the changes to the new extension forms file that are required. 4. Make the design changes to the extension forms file to be used in the service. 5. Test the design changes on an IBM Domino iNotes server in the on-premises environment:

Note: You might want to install and set up a test server for this purpose. a. In a Mail Settings document applied to a policy, click IBM iNotes and in the Basics tab, add the name of the extension forms file to the Extension Forms File Name field. This step is needed only if the extension forms file name is not Forms9_x.nsf, or if you want to use a policy to enable the forms file for specific users. b. Use the following server command to flush the server database cache: dbcache flush c. Copy the extension forms file to the iNotes directory under the server data directory. d. Use the following server command to stop and restart the HTTP task: tell http restart e. Start a web browser and clear the browser cache. f. Test the changes from the browser. 6. Submit the extension forms file to an IBM Software Services for Collaboration representative for validation. The IBM representative validates the extension forms file and sends you a summary report that indicates whether the extension forms file is approved. After it is approved, the IBM representative uploads the extension forms file to the service. What to do next

Assign the extension forms file to users. Related tasks: “Assigning extension forms files to users” on page 248 After an IBM representative uploads an approved extension forms file to the service, you can assign the forms file to users. Extension forms file enable you to customize the visual theme, fonts, the action bar, and other aspects of the web client. “Preparing to use custom mail file templates” on page 161 You can apply a custom mail file template to mail files of service users. The template must meet design requirements that minimize the risk and impact to your users and to the service. You submit the template for approval to an IBM Software Services for Collaboration representative.

166 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Extension forms file requirements Before you develop an extension forms file to customize the web client, be aware of the requirements. You can use multiple extension forms files, each applied to different sets of users. v Extension forms files must be based on the IBM iNotes 9.0 Social Edition forms9_x.ntf template that you download from the service. v Extension forms files can reference only mail files within the IBM SmartCloud Notes service. In particular, they cannot reference IBM Notes databases on on-premises servers or images on web servers outside the service. v Customization must be self-contained. Any resources, such as images, style sheets and JavaScript, must be included in the Extension Forms File. References to external sources are not allowed. Customization such as ActiveX controls or Java classes where the source code cannot be inspected are also not allowed. v Local encryption must be disabled on extension forms file databases: 1. From Notes, open the extension forms file database. 2. Click File > Application > Properties. 3. Click Encryption Settings. If the text Current encryption strength : None is shown in the dialog box, the database is not encrypted. If the database is encrypted, complete the remaining steps. 4. Click Do not locally encrypt this database. 5. Close the extension forms file database. 6. Open the database. A progress bar is shown as the database is unencrypted. 7. Repeat steps 2 and 3 to verify that the database is unencrypted.

You can use an extension forms file to make the following types of changes to the web client: v Modify the visual theme in the following ways: – Override CSS styles. – Override gradient fill color specifications. – Replace images. New images must be in the extension forms file. v Add fonts to the rich text editor that is used when users create email messages, calendar entries, and so forth. v Add fields to documents such as mail messages and calendar entries. v Add, remove, or modify items in the action bar menu. v Use global settings to extend the session information, for example, override a preference setting or read a profile note field. v Add JavaScript code to the document save function to verify items when documents are saved or sent.

You can customize the following subforms in an extension forms file: Table 53. Subforms that can be customized Subform Purpose Custom_Common_Utils Adds functions that are called from Custom_JS. Custom_CSS Adds new CSS styles.

Chapter 5. Customizing service settings 167 Table 53. Subforms that can be customized (continued) Subform Purpose Custom_JS Contains callback functions to use to add or remove action bar items, add code when pages are displayed or submitted. This subform is used for forms that use an older architecture. Most of the code uses the newer forms, however a few older forms remain. Custom_JS_Edit Adds fonts to the rich text editor. Custom_Name_Lite The code to display names in Korean format. Custom_Page_Dictionary Adds new variable values for use with the Custom_CSS subform. Custom_WelcomePage Adds choices for the Welcome Page. Custom_Page_Dictionary Adds variable values that are available for use in the Custom_CSS subform. Custom_xxx_Dictionary These custom dictionary subforms are included with each main area form, Mail, Calendar, ToDo, and so forth, to allow easier inclusion of new NotesFields and NotesVars. Custom_LazyLoad_Subforms Adds custom code to the lazy load table. Custom_Logout Adds custom code that runs on logout. Custom_About Displays the forms file version and a user-specified file version number in the client console log when the client starts. Custom_SessionInfo Add items to the iNotes session info object.

Preparing customized mail file ACLs An important reason to customize mail file access is to allow administrators or server-based agents to access mail files. Without customized mail file access, only mail file owners and mail file delegates can access mail files. About this task

To customize mail file access, modify the access control list (ACL) in a custom IBM Notes mail file template. Then, apply the custom template to the new mail files when you provision users for the service. Using a custom mail file template requires a short service contract with IBM Software Services for Collaboration to approve and upload the template to the service.

Note: If you transfer mail files to the service, you must modify the ACLs on the individual mail files before you transfer the files. When you provision users whose mail files are transferred, the ACL in a custom mail file template is ignored. For additional ACL requirements specific to transferring mail files, see the topic about preparing mail file ACLs before mail file transfer.

Important: It is important to customize mail file ACLs before users are provisioned. After users are provisioned, you can no longer use the ACL to change access to their mail files. At that point, the mail file ACL is changed only indirectly in the following circumstances:

168 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v A user is given access to a mail file through mail file delegation. v A user's name changes, which causes the name to change in the mail file ACL. (Renaming a group does not update a group name in the ACL.)

Note the following additional restrictions to ACLs of mail files in the service: v You cannot use the following ACL group entries that are seen in traditional IBM Domino environments: LocalDomainAdmins, LocalDomainServers, and OtherDomainServers. If you add these entries, they are stripped from ACLs. v To allow administrators to access mail files, add a group to the directory that includes their names, and then add the group to mail file ACLs. v Editor access is the highest level of access that is allowed for any ACL entry. If you give a user or group Manager or Designer access, the access is lowered to Editor. The user or group does not become a mail file delegate. v The mail file owner always has Editor access and you cannot change this access. You can give another user or group Editor access. In this case, they become mail file delegates, by default. You can prevent people with Editor access from becoming delegates. To do so, assign them the [ExcludeDelegate] role in the ACL. v You can use the following types of ACL entries: Person, Person group, Server group, Mixed group,orUnspecified. v Server type entries are not allowed. If you add them, they are stripped from ACLs. v You can allow an on-premises server-based agent to run on mail files. Doing so requires that you add the server that runs the agent to a group in your directory, then add the group to mail file ACLs as type Server group or Mixed group. For additional requirements, see the wiki article on using server-based agents in a SmartCloud Notes hybrid environment. v You cannot customize the -Default- and Anonymous entries. These entries are always set to No Access.

To use a custom mail file template to modify mail file ACLs, add entries that are enclosed in brackets []to the ACL of the custom mail file template. The ACLs of the new mail files in the service inherit the entries in brackets. For example, to give Editor access to the group SCN Administrators, add [SCN Administrators] to the ACL, select Editor access and the type Person group or Mixed group .Ifyou apply the custom mail file template when you provision Samantha Daryn/Renovations with a brand new mail file in the service, her mail file ACL includes the following entries: -Default- (No Access) Anonymous (No Access) Samantha Daryn/Renovations (Editor) SCN Administrators (Editor) SaaSLocalDomainServers1 Mail1/SCN/Renovations2

1This group is reserved for use in the service. Do not create a group by this name on-premises, or a group that begins with the characters SaaS.

2 This entry is the name of a user's home mail server in the service. Related tasks: “Preparing mail file ACLs before mail file transfer” on page 212 Before mail files are replicated to the staging server, prepare the mail file ACLs to set mail file access.

Chapter 5. Customizing service settings 169 “Configuring mail file templates” on page 164 Configure which mail file templates can be applied to user mail files and configure a mail file template to use by default. “Preparing to use custom mail file templates” on page 161 You can apply a custom mail file template to mail files of service users. The template must meet design requirements that minimize the risk and impact to your users and to the service. You submit the template for approval to an IBM Software Services for Collaboration representative. Related information:

Using server-based agents in a SmartCloud Notes hybrid environment

SmartCloud Notes Template Validation Requirements

Enabling busytime details in calendars You can enable IBM Notes users and web client users to see busytime details in calendars. About this task

If you enable this feature, when users schedule a meeting or use a group calendar, they can click a block of busytime in someone's calendar to see details about the calendar entry. Users can see calendar details only if users grant them this access to their calendars. The following types of detailed information can be seen: v Type of calendar entry, for example, meeting or appointment v Optionally assigned calendar category v Meeting chair v Location v Room

This feature is disabled, by default. When it is disabled, users can still see the blocks of time when users are busy, they just cannot see details about those blocks of time.

Complete the following steps to enable busytime details. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings. 5. Click Email & Calendar Options. 6. In the Calendar Details section, select Enable calendar detail collection. Results

When Notes client users and web client users schedule a meeting or use a group calendar, they can click a block of busytime in a calendar to see details if they are given the access to do so. Users control who can see their calendar information and whether detailed calendar information is visible or only users' availability. To control access to their calendars, web client users click Preferences > Delegation >

170 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Schedule. Notes users click More > Preferences then Access and Delegation > Access to Your Schedule.

Configuring instant messaging Use the Instant Messaging settings in IBM SmartCloud Notes Administration to specify whether to enable an instant messaging community in clients automatically. Instant messaging enables users to chat with and see the availability of other users in the service. You can automatically enable use of the service instant messaging community. For web users, you can automatically enable an on-premises IBM Sametime community managed by your company. About this task

By default, web users automatically connect to the instant messaging community in the service if the Enable instant messaging preference is selected on the client. By default, IBM Notes 8.5.2 or later clients automatically connect to the instant messaging community in the service if the clients are installed with the Sametime (integrated) option. Users are also logged on to the community automatically.

You can change the default setting and allow web users to instead connect automatically to an on-premises Sametime community at your company site. You must use a Sametime Proxy Server 8.5.2 (IFR1 or later) and configure it to support this capability. Notes clients can also connect to an on-premises community if you configure the clients to connect to the community yourself. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings 5. Click Instant Messaging. 6. In the Instant Messaging Integration window, select an option described in the following table and then click Save. If you switch from one option to another, the service pushes the change to the clients immediately.

Chapter 5. Customizing service settings 171 Table 54. Instant messaging configuration options Option Result - web users Result - Notes Enable the service instant Web users are logged on to Notes users who use Notes messaging community for the service instant messaging 8.5.2 or later installed with IBM Notes and SmartCloud community if they perform the Sametime (integrated) Notes web users the following steps from the option are logged on to the Inbox: service instant messaging 1. Click More > Preferences community. 2. Under Instant The connection to the service messaging, select Enable community overwrites any instant messaging. pre-existing embedded connection to an on-premises Multiple communities are Sametime community. not supported. Notes 8.5.1 clients are not affected by this option. To enable them to access the service instant messaging community, manually configure the clients to connect to the community. Enable an on-premises IBM Web users can connect to an Notes users can use instant Sametime community for on-premises Sametime messaging, but you must SmartCloud Notes web users community managed by configure the clients your company after you manually to connect to configure the on-premises communities. environment. Disable instant messaging Web users cannot use instant Notes users can use instant integration messaging. messaging, but you must configure the clients manually to connect to communities.

Configuring the web client to connect to an on-premises Sametime community Complete this procedure to configure IBM SmartCloud Notes web clients to connect to an IBM Sametime community at your company site. Before you begin

The following Sametime server components must be installed on-premises. For instructions, see the Sametime documentation. v Sametime Server 8.0.2, or Sametime Community Server 8.5 or later. For installation instructions, see the Sametime documentation. v Sametime Proxy Server 8.5.2IFR1. For installation instructions, see the Sametime documentation. v The Sametime Proxy Server requires the latest hot fix, which is available on IBM Fix Central. The hot fix includes installation instructions. This link retrieves the list of fixes for Sametime 8.5.2 IFR1 for all operating systems; find the latest fix for the Sametime Proxy Server on the operating system you use.

Note: The Sametime System Console is not used in this deployment.

172 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

Allowing the web client to connect to the on-premises Sametime community requires that users be able to access the Sametime Proxy Server from the same location where they access SmartCloud Notes. If your organization chooses to restrict access to the Sametime Proxy Server to users inside the corporate network, then all users must connect to that corporate network in order to access Sametime functionality in SmartCloud Notes.

If your organization wants to allow users to access Sametime functionality in SmartCloud Notes from locations outside the corporate network, you must ensure that requests to https://Server_name:Port_number/ are correctly forwarded to the Sametime Proxy Server, regardless of where they originate. To support external connections, the following requirements must be satisfied: v Server_name must be listed in the public DNS (domain name server). v The firewall must allow connections to Server_name on Port_number. v You must create network routes that allow connections to reach the Sametime Proxy Server. Procedure 1. Configure the on-premises Sametime Proxy Server to allow connections from the SmartCloud Notes domain by completing the following steps: a. On the computer where the Sametime Proxy Server is installed, open the stproxyconfig.xml file that is stored in the deployment manager's profile: The deployment manager's stproxyconfig.xml file is typically located in the following directory: WebSphere_AppServer_install_root/profiles/Deployment_Manager_Profile_Name/ config/cells/Cell_Name/nodes/Node_Name/servers/STProxyServer/ For example, on IBM AIX® or Linux: /opt/IBM/WebSphere/AppServer/profiles/dmgr/config/cells/STProxyCell1/nodes/ STProxyNode1/servers/STProxyServer On Microsoft Windows: C:\Program Files\IBM\WebSphere\AppServer\profiles\dmgr\config\cells\ STProxyCell1\nodes\STProxyNode1\servers\STProxyServer b. In the stproxyconfig.xml file, look for the closing tag and add the following statement immediately after it: Your_organization_domain_name,SmartCloud_Notes_domain_name Specify your own organization's domain name for Your_organization_domain_name. To determine the SmartCloud Notes domain your company uses, open the Inbox and look at the domain name that is shown in the browser URL. For example, in the following browser URL, the SmartCloud Notes domain is notes.na.collabserv.com: https://mail.notes.na.collabserv.com/livemail/iNotes/Mail/?OpenDocument

Note: The server, mail, is not part of the domain name. Specify one of the following values for the SmartCloud_Notes_domain_name: v If you use the North America data center: notes.na.collabserv.com v If you use the Asia Pacific data center: notes.ap.collabserv.com For example, if the Renovations company uses the North America data center, the statement looks like the following line: renovations.com,notes.na.collabserv.com

Chapter 5. Customizing service settings 173 c. Copy the new statement so you can use it again, and then save and close the file. d. On the same computer, open the copy of the stproxyconfig.xml file that is stored in the Sametime Proxy Server's profile: The Sametime Proxy Server node's copy of stproxyconfig.xml file is typically located in the following directory: WebSphere_AppServer_install_root/profiles/Sametime_Proxy_Profile_Name/ config/cells/Cell_Name/nodes/Node_Name/servers/STProxyServer/ For example, on IBM AIX or Linux: /opt/IBM/WebSphere/AppServer/profiles/STPAppProfile/config/cells/ STProxyCell1/nodes/STProxyNode1/servers/STProxyServer On Microsoft Windows: C:\Program Files\IBM\WebSphere\AppServer\profiles\STPAppProfile\config\ cells\STProxyCell1\nodes\STProxyNode1\servers\STProxyServer The Sametime Proxy Server's path looks very similar to the deployment manager's path, but references the Sametime_Proxy_Profile_Name instead of the Deployment_Manager_Profile_Name. e. Add the same new statement to the Sametime Proxy Server's copy of the stproxyconfig.xml file (after the closing tag as before), and then save and close the file. f. Restart the Sametime Proxy Server. 2. If web clients do not have VPN access to the Sametime Proxy Server, provide external access to the server. 3. If your Sametime server restricts access to certain types of clients, allow access to web clients by adding the following value to the VPS_ALLOWED_LOGIN_TYPES setting in the [Config] section of the sametime.ini file: 14A4 For more information, see Technote 1114318. 4. Complete the following steps to enable the service to connect to the on-premises community: a. Log on to the service as an administrator. b. Click Administration > Manage Organization. c. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. d. Click Account Settings. e. Click Instant Messaging. f. Click Enable an on-premises IBM Sametime community for SmartCloud Notes web users. g. Provide the Sametime Proxy Server URL, for example, https:// stproxy01.renovations.com. 5. Instruct Internet Explorer users to modify the browser trusted sites list as follows: a. Click Tools > Internet Options b. Click Security. c. In the Select a Zone to view or change security settings section, click Trusted sites and then click Sites. d. Add the following sites to the Websites box: *.lotuslive.com *.collabserv.com

174 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 In addition, add the Sametime Proxy Server URL, for example: https://stproxy01.renovations.com. 6. Instruct users to complete the following steps from their SmartCloud Notes web Inbox: a. Click More > Preferences b. Click Instant messaging > Enable instant messaging. Related information:

Sametime documentation Manually configuring Notes clients to connect to the service instant messaging community If you performed the procedure “Configuring instant messaging” and selected the option Enable an on-premises IBM Sametime community for SmartCloud Notes web users or the option Disable instant messaging integration, IBM Notes clients are not configured automatically to connect to the instant messaging community in the service. This topic describes how to configure Notes clients to connect to the service instant messaging community yourself if you selected either of these options. Before you begin

Notes must be installed with the Sametime (integrated) option selected. About this task

Perform this procedure for any of the following reasons. v You want to allow Notes 8.5.1 clients to connect to the service instant messaging community. v You want to allow Notes clients to connect to an on-premises Sametime community and to the service instant messaging community. You will configure the service instant messaging community as a secondary community.

Note: To provide dual-community enablement, the on-premises IBM Sametime server must be configured to support IBM Sametime Standard clients. You must purchase the Sametime Standard license separately, as the SmartCloud Notes entitlement supports IBM Sametime Entry only. v You want to allow some, but not all, Notes 8.5.2 or later clients to connect to the service community as the primary community. If you want all Notes 8.5.2 or later clients to connect to the service instant messaging community as the primary community, instead perform the procedure “Configuring instant messaging” and select the option Enable the service instant messaging community for IBM Notes and SmartCloud Notes web users.

Perform the following steps to configure a Notes client to connect to the service instant messaging community. Procedure 1. Start Notes. 2. Click File > Preferences. 3. Click Sametime. 4. Click Server Communities.

Chapter 5. Customizing service settings 175 5. Perform the following steps to add the service instant messaging community to the sidebar: a. Click Add New Server Community. b. Complete the fields in the Add Sametime Server Community window as described in the following table, and then click OK.

Tab Field Field value Not applicable Server community type Sametime Not applicable Server community name Provide a name that identifies the new community. Log in User name Service login name, for example, [email protected] Log in Password SmartCloud Notes web logon password

Do not specify the Notes client login password. Log in Use token based single Do not select sign on Server Host server im.na.collabserv.com (if your company uses the North American data center)

im.ap.collabserv.com (if your company uses the Asia Pacific data center)

im.ce.collabserv.com (if your company uses the European data center) Server Server community port 1533 Server Send keep alive signal 60 (default) after the following number of seconds Connection Connection Direct connection (default) Options Use this server for Select (default) awareness status lookup Options Use canonical names for Do not select (default) status lookup

6. If the client also connects to an on-premises community, make sure the service community is not the default community. 7. Click OK to save your changes. Instant messaging features The table in this topic summarizes the instant messaging features that are available through the service instant messaging community.

Note: If IBM Notes clients connect to an on-premises IBM Sametime community and to the service community, the version of Sametime that is used on-premises determines the features that are available for both communities.

176 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 55. Features supported by the service instant messaging community Feature Available Not available Online presence status; X availability status icons; custom status message The web client shows online presence status for names in the sidebar but not for names in documents or views. This limitation does not apply if an on-premises Sametime community is used. Automated geographic X awareness Telephony status X Set alerts when users are X available; privacy lists, selective do not disturb Business card display X

The name and email address are displayed but not other information, such as title and telephone number.

In a hybrid environment, the name and email address are taken from the service user account rather than from the customer Domino directory. Primary, frequent, and recent X contact list views There is a 500-contact limit.

Public groups are not supported.

The web client supports only the primary contact list. Initiate chats with users not X in your contact list Security-rich one-on-one text X chat and multi-way text chat. Rich text formatting; spell X check; emoticons and emoticon palettes Time and date stamps; chat X history The web client does not support chat history. Log in to multiple X communities Supported by Notes clients only.

Chapter 5. Customizing service settings 177 Table 55. Features supported by the service instant messaging community (continued) Feature Available Not available Screen capture tool; file X transfers Supported by Notes clients only. Note: To provide dual-community enablement, the on-premises IBM Sametime server must be configured to support IBM Sametime Standard clients. You must purchase the Sametime Standard license separately, as the SmartCloud Notes entitlement supports IBM Sametime Entry only. Instant screen share X Zero-download browser chat X client Supported by web clients only. Online meetings X Voice and video X Community collaboration X features, such as instant polls, broadcast chats, and persistent group chat Mobile use X Telephony integration X

Configuring IMAP access You can allow users to access IBM SmartCloud Notes from third-party email clients using IMAP. IMAP access is disabled by default, but you can enable it for all users or only for specific users. Before you begin

To allow IMAP access on a per user basis, you add the text item SaaSAllowIMAP=value to the user's Person document in the Domino Directory on a server that you synchronize with the service. There are a number of ways you can do this. For example, you can add a field to the Person document, or you can add an item element to a note.

If you are unfamiliar with the methods used to add a text item to a form in the Domino Directory, see the information about customizing the Domino Directory template in the Reference section of the Domino 8.5.3 documentation.

Note: Users who have Author rights to their Person document can enable IMAP for themselves by setting the field SaaSAllowIMAP to 2. To prevent this, on the Advanced tab of the Field Properties dialog for the SaaSAllowIMAP field, set the Security Options to Must have at least Editor access to use.

178 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

After you enable IMAP access, service users can configure their mail clients for IMAP access using information provided by the service. The following IMAP clients are supported: v Apple email v Microsoft Outlook 2003, 2007 v Thunderbird Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Account Settings and then click IMAP Email Access. 5. Select one of the following, and then click Save: v Enable IMAP for all users. If you select this option, you do not need to complete any further steps. v Enable IMAP for specific users only. If you select this option, you have enabled IMAP access for your organization. Continue to the next step to customize your on-premises Domino Directory so that you can specify IMAP access for individual users. v Disable IMAP for all users. If you select this option, no users have IMAP access and you do not need to complete any further steps. 6. From the Domino Administrator client, open the Domino Directory, on an on-premises Domino server whose directory you synchronize with the service. 7. For each user you want to specify IMAP access, add a TYPE_TEXT item named SaaSAllowIMAP to their Person document with either of the following values: v "2" -- to allow IMAP access. If you later change access from specific users to all users, no additional steps are needed to allow these users to continue to have access. v "3" -- to deny IMAP access. A user who is denied access using this value will be denied access under all circumstances. If you later change access from specific users to all users, this user will continue to have no access. An example of an agent that assigns the value "2" is FIELD SaaSAllowIMAP := "2"

Note: If you have enabled IMAP access for all users, any value other than "2" or "3" defaults to allowing access. Results

If you enabled IMAP for all users, then service users can set up their IMAP clients for IMAP access to SmartCloud Notes mail.

If you added the text item to the Domino Directory, during directory synchronization, the servers in the service are updated with the new information. Users cannot enable IMAP access and set up their IMAP mail clients until the synchronization is complete. Related reference:

Chapter 5. Customizing service settings 179 “IMAP client limitations” There are a few limitations when using an IMAP client to access IBM SmartCloud Notes. Related information:

Domino documentation

Setting up IMAP clients IMAP client limitations There are a few limitations when using an IMAP client to access IBM SmartCloud Notes. Folder limitations

The following restrictions apply to folders used with IMAP: v A single folder name cannot exceed 64 bytes. v An unlimited number of nested folders is allowed, but the combined length of all nested folder names (including delimiters) cannot exceed 129 bytes. View limitations

The service provides IMAP clients access to folders in user mail files but not to views. The Drafts, Sent, and Trash views in mail files therefore are not available through IMAP clients. To work around this limitation, IMAP client users can create folders that correspond to these views and put messages in the folders instead. IBM Notes or web client users must open these folders to see the messages in them. Return receipt

The service does not support the use of return receipts with IMAP clients. If you request a return receipt and the recipient opens the message using the IBM Notes or web client, no return receipt is generated.

Logging activity in journal files You can log different types of activity in journal files that you then download from the service. Before you begin

Before you complete this procedure, you must request integration server enablement from an IBM Connections Cloud customer services representative (CSR). When you do so, you provide an account identity to use to connect to the FTP site to download the journal files. You are notified when your enablement request is complete. For more information, see Requesting integration server enablement in the Connections Cloud integration server documentation. About this task

The following types of journal files are available for Notes: v Notes mail delivery, which records each email message that service users send.

180 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v Notes client session, which records each attempt to log in to the service from a Notes client to access an application such as mail or the company directory.

The journal service produces gzip-compressed journal files about every 24 hours. You use an FTP client to download the journal files from the IBM Connections Cloud integration site. Files are removed from the integration site after seven days.

Journal files are available for other Connections Cloud services, as well. For more information, see the Connections Cloud journaling documentation.

After you are notified that your request for integration server enablement is complete, complete the following steps to enable journaling through SmartCloud Notes Administration. Procedure 1. Log on to the service as an administrator. 2. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 3. Click Account Settings. 4. Click Journaling Options. 5. Select any of the following options to specify the type of journal files to generate: v Notes mail delivery v Notes client sessions 6. Click Save. What to do next

You can begin downloading journal files in about 24 hours. Related information:

Connections Cloud journaling documentation Downloading journal files You can begin to download journal files about 24 hours after you enable journaling. Before you begin

Request integration server enablement, then enable journaling options in SmartCloud Notes administration. For more information, see “Logging activity in journal files” on page 180.

Make sure that your corporate firewall allows outbound connections to the following hosts over FTP port 990 and FTP PASV port range 60000 - 61000: v North America data center: ftp.na.collabserv.com v Asia Pacific data center: ftp.ap.collabserv.com v European data center: ftp.ce.collabserv.com

Chapter 5. Customizing service settings 181 Procedure 1. From an FTP client, specify the following connections settings:

Setting Value Host If you use the United States data center: ftp.na.collabserv.com If you use the Asia Pacific data center: ftp.ap.collabserv.com If you use the European data center: ftp.ce.collabserv.com Protocol FTP Port 990 Encryption Implicit FTP over TLS User and password Account name and password that is used to connect to the FTP site.

2. Connect to the FTP host. 3. Change to the journal directory. 4. Select and download the following files: v If you enabled Notes mail journaling, download files named .NOTESMAIL.txt.gz v If you enabled Notes client session journaling, download files named.NOTES_NRPC_SESSION.txt.gz. is the file creation date. Related tasks: “Configuring the firewall for outbound connections” on page 42 Configure the firewall to allow outbound connections to the service. Related information:

Integration server documentation Format of the Notes mail journal file A Notes mail journal file records each message that users send. File name

The name of the compressed file that you download is .NOTESMAIL.txt.gz, where is the file creation date , in YYYY-MM-DD format. For example: 2012-12-23.NOTESMAIL.txt.gz. Syntax

Each record in a Notes mail journal file conforms to the following syntax: date user name (id=customerId, customerId=customerId) performed ACTION [on object (type=TYPE, id=OBJECTID, name=name, customerId=customerId)] [targeted at (type=TYPE, id=TARGETID, name=name, customerId=customerId)] with outcome OUTCOME [REASON][(EXTRA)]

Each record in a journal file is contained in a single line. Parameters date

182 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 A date and time, for example, 2012-12-18T13:23:47+0000. One of the following values is logged: v The date and time that a user sends a message to another user at the company v The date and time that a message failed to be delivered to a user at the company v The date and time that a user sends a message to an external user at another company name The user’s Notes name, if an internal user sends the message, for example, CN=Samantha Daryn/O=Renovations. An Internet email address, if an external user sends the message. customerId The unique number that identifies the company subscription in the service. ACTION SENT_MAIL TYPE The type of object or target. The object type is always MAIL_MESSAGE. The target type is always RECIPIENT. OBJECTID The unique identifier of the mail message that is sent. name The name of the OBJECTID or the TARGETID. The name for the OBJECTID is always MAIL. The name for the TARGETID is the email address of the recipient. TARGETID The unique identifier for the recipient. This value is always null because the email address specified in the name parameter uniquely identifies the recipient. OUTCOME The result of the action, either SUCCESS or FAILURE. If the outcome of an event is FAILURE, the reason is given. The reason is in uppercase and can be multiple words separated by underscores. For example: FAILURE “USER_NOT_FOUND”. EXTRA Contains the size of the message in kilobytes. Examples

Note: The following example records are shown on multiple lines. In the journal file, each record is a single line. 1. Samantha Daryn sends a message to another internal user at the company, Allie Singh. Allie receives the message. 2012-12-30T19:03:01+0000 user CN=Samantha Daryn/O=Renovations (id=20076547, customerId=20076547) performed SENT_MAIL on object (type=MAIL_MESSAGE, id=

Chapter 5. Customizing service settings 183 78.005C2BF7-85257A78.005C3063@LocalDomain>, name=“MAIL”, customerId=20076547) targeted at (type=RECIPIENT, id=, name=“CN=allie singh/[email protected]”, customerId=20076547) with outcome SUCCESS (size=“1”) 2. Samantha Daryn sends a message to another internal user at the company, Allie Singh. Allie’s name is not found in the directory and the message is not delivered. 2012-12-28T15:02:01+0000 user CN=Samantha Daryn/O=Renovations (id=20076547, customerId=20076547) performed SENT_MAIL on object (type=MAIL_MESSAGE, id=, name=“MAIL”, customerId=20076547) targeted at (type=RECIPIENT, id=, name=“CN=allie singh/[email protected]”, customerId=20076547) with outcome “FAILURE RECIPIENT NOT FOUND IN COMPANY DIRECTORY” (size=“2”) 3. Samantha Daryn sends a message over the Internet to an external user, [email protected]. 2012-12-28T15:02:01+0000 user CN=Samantha Daryn/O=Renovations (id=20076547, customerId=20076547) performed SENT_MAIL on object (type=MAIL_MESSAGE, id=, name=“MAIL”, customerId=20076547) targeted at (type=RECIPIENT, id=, name=“[email protected]”, customerId=20076547) with outcome SUCCESS (size=“1”) Format of the Notes client session journal file A Notes client session journal file records information about each IBM Notes client login session within the service. File name

The name of the compressed file that you download is .NOTES_NRPC_SESSION.txt.gz, where is the file creation date, in YYYY-MM-DD format. For example: 2012-12-23.NOTES_NRPC_SESSION.txt.gz. Syntax

Each record in a Notes client session journal file conforms to the following syntax: date user name (id=customerId, customerId=customerId) performed ACTION [on object (type=TYPE, id=OBJECTID, name=name, customerId=customerId)] [targeted at (type=TYPE, id=TARGETID, name=name, customerId=customerId)] with outcome OUTCOME [REASON][(EXTRA)]

Each record in a journal file is contained in a single line. Parameters date The date and time a Notes client user logs in to the service or attempts to log in, for example, 2012-12-18T13:23:47+0000. name The user’s Notes name, for example, CN=Samantha Daryn/O=Renovations customerId The unique number that identifies the company subscription in the service. ACTION NRPC_SESSION

184 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 TYPE The type of object or target. The object type is always NRPC_SESSION. The target type is always USER. OBJECTID A unique session ID name The name of the OBJECTID or the TARGETID. The name for the OBJECTID is always NRPC_SESSION. The name for the TARGETID is the user’s Notes name, for example, CN=Samantha Daryn/O=Renovations. TARGETID The unique identifier for the user. This value is always null because the name parameter uniquely identifies the user. OUTCOME The result of the action, which is always SUCCESS. EXTRA The following information is provided: v Number of databases accessed v Number of documents that are read and written v Time to connect to the service, in seconds v The client versions being used Examples

Note: The following example records are shown on multiple lines. In the journal file, each record is a single line. 1. Samantha Daryn logs in to the mail server in the service successfully from Notes. 2013-04-09T14:35:12+0000 user CN=Samantha Daryn/O=Renovations(id=20076547, customerId=20076547) performed NRPC_SESSION on object (type=NRPC_SESSION, id=02E31600, name=“NRPC_SESSION”, customerId=20076547) targeted at (type=USER, id=, name=“CN=Samantha Daryn/O=Renovations”, customerId=20076547) with outcome SUCCESS (DBs accessed=“1”, docs read=“0”, docs written=“0”, connect time=“302”, client version=“90010”,)

Chapter 5. Customizing service settings 185 186 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 6. Onboarding users

Onboarding refers to all the steps that are done to get users up and running with mail files and mail servers in the cloud. Before you begin

Before you onboard users, configure the service and, optionally, customize service settings.

Choosing a client deployment strategy Choose a strategy for deploying clients in the service. Before you begin

Complete the following tasks: “Deciding whether to use the Notes client” on page 188 and “Deciding whether to transfer mail files” on page 189. About this task

The following table describes common client deployment strategies. Table 56. Common strategies for deploying clients Strategy Additional information

New mail files v This option is the quickest and least expensive. SmartCloud Notes web and mobile clients v only All users can quickly use the web client and mobile clients to access their mail. v Users who decide that they want to use the IBM Notes client can do so when it is convenient, and can continue to use cloud mail in the meantime.

New mail files v This option causes the least disruption for users and is typically less time consuming Notes, SmartCloud Notes web, and mobile than transferring mail files. clients v This option might be a good one to choose if current Notes clients meet the service requirements and do not need to be upgraded. v Notes client users can export contacts from current mail files and import them into new mail files. v Notes client users can access on-premises archives of their original mail files. v The use of managed mail replicas can boost performance for Notes client users.

© Copyright IBM Corp. 2011 187 Table 56. Common strategies for deploying clients (continued) Strategy Additional information

Transferred mail files and Notes clients for v This option allows some critical users some users such as executives and managers to continue to use the Notes client and to New mail files and SmartCloud Notes web continue to work with current and past and mobile clients for other users mail file content. v This option can be more time consuming to deploy, depending on the quantity and size of the mail files that are transferred. v Your company sets up a IBM Domino staging server and uses IT resources to prepare mail files.

Transferred mail files for all users v This option is the most expensive and time consuming but can be the least A mixture of Notes, SmartCloud Notes web, disruptive for users, especially if Notes and mobile clients client upgrades are not required.

Deciding whether to use the Notes client IBM SmartCloud Notes web is the mail client that is available automatically to all IBM SmartCloud Notes users through a browser. Before you prepare to onboard users, decide whether you want them to use the optional IBM Notes client in addition to or instead of SmartCloud Notes web. About this task

For the following reasons, many companies decide to use SmartCloud Notes web and not the Notes client: v Users get access to new features automatically as they are available in the service. v IT departments save money by avoiding the need to upgrade and maintain Notes clients. v SmartCloud Notes web is easy to use and the interface is similar to that of recent versions of IBM iNotes and Notes. There might be little or no training needed. v Most Notes clients features are available in SmartCloud Notes web.

A recommended approach is to start all users in the service with SmartCloud Notes web. After users become familiar with it, you have a better sense of which users, if any, still need the Notes client. The following table describes some reasons to use the Notes client, as well as alternative options. Table 57. Reasons you might use the Notes client Reason Considerations and alternatives Users need access to IBM Domino The Notes Browser Plug-in is an alternative applications on-premises. option to the Notes client. This plug-in provides access to on-premises Notes applications through a browser.

188 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 57. Reasons you might use the Notes client (continued) Reason Considerations and alternatives Users need access to mail when Currently, only the Notes client supports disconnected from the network. local, disconnected access to mail. Local mail file access is provided through managed mail replicas (in hybrid environments) or standard local mail file replicas (in service-only environments).

Before you choose the Notes client for this reason, consider that with the increased use of mobile devices, some users might no longer require offline access through notebooks or desktops. Internet connections are slow. In hybrid environments, users with slow Internet connections, for example, users with limited bandwidth connections, see better performance if they use managed mail replicas on Notes clients. In service-only environments, these users benefit from using standard local mail file replicas on Notes clients. Users are starting with new mail files in the Currently, accessing mail that is archived service and want access to old mail archived on-premises requires a Notes client. on-premises. Users want features that are available only For a feature comparison, see the technote with the Notes client. “Comparison tables of features between IBM Notes, IBM iNotes, and IBM SmartCloud Notes web”. In hybrid environments, users want to Managing on-premises mail files of users manage (be delegates for) the mail files of who are not provisioned for the service on-premises users. requires the Notes client.

Related tasks: “Using Desktop Settings to configure managed mail replicas” on page 120 In a hybrid environment, use Desktop Policy settings to enable managed mail replicas. Managed mail replicas helps ensure that IBM Notes users in the service have quick, local access to their mail when connected or disconnected from the network. Related information:

Technote: Comparison tables of features between IBM Notes, IBM iNotes & IBM SmartCloud Notes web

Notes Browser Plug-in

IBM SmartCloud Notes client requirements Deciding whether to transfer mail files An important aspect of planning to move to the service is deciding whether to start with new IBM Notes mail files or to transfer current mail files.

Chapter 6. Onboarding users 189 About this task

You can combine approaches. For example, you might create new mail files for a majority of users and transfer the mail files of remaining users.

There are a several advantages to starting users with brand new mail files in the service: v Users can begin to use the service quickly because the steps to prepare and transfer mail files are unnecessary. v No company IT resources are required to prepare mail files for transfer. v If you have users who infrequently use past mail and calendar entries, or if your company mail retention policy is to retain mail for only a short period, a new mail file might not be an inconvenience. v Notes client users can export contacts and selected calendar entries from their original mail files to a Calendar (.ics) file, and then import the entries into their new mail files after they are provisioned.

In some cases, it might be important to transfer mail files. For example, you might want to transfer the mail files of users such as company executives or managers who work heavily with past and current mail messages and calendar events.

You can pay for the services of a professional transfer manager to work with your company to transfer mail files. The transfer manager can be an IBM Software Services for Collaboration representative or an IBM Certified Business Partner. The transfer manager performs tasks such as helping you to prepare mail files and to develop a transfer schedule. The transfer manager also sets up an on-premises IBM Domino server that is provided by your company to use as a staging server for the transfer.

When you transfer mail files, you can choose whether to transfer full mail files or to selectively transfer just some of the content. Selective transfer is helpful for expediting the transfer of large mail files and also for preventing large mail files from exceeding the mail file quota in the service.

When you use selective transfer, you specify which of the following types of content to transfer: v Contacts (Requires Preferences > Contacts > Enable Synchronize Contacts on the Replication and Sync tab to be selected in the mail file before the transfer.) v Mail rules v Group calendars v Draft documents v Calendar events, optionally including events up to 365 days in the past v Messages, optionally including messages sent and received up to 365 days in the past. v To Do's, optionally including To Do's with due dates up to 365 days in the past

The following content is always transferred: v Preferences settings v Embedded Notes IDs v Folders, which can be empty after the transfer if content is older than the transfer criteria

190 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 You decide whether and how to preserve data that is not transferred. For example, you might retain the original on-premises mail files. The original files and transferred files have different replica IDs and do not replicate. Related tasks: “Preparing for mail file transfer” on page 209 If you configure the service as a hybrid environment, as part of onboarding, you have the option to transfer users’ on-premises mail files to the service. Before you transfer mail files, complete the tasks to prepare.

Preparing for onboarding To prepare for onboarding, complete these tasks to prepare users, clients, and mail files. Before you begin

Before you prepare for onboarding, complete the following tasks: v Chapter 4, “Configuring the service,” on page 83 v “Choosing a client deployment strategy” on page 187 About this task Table 58. Tasks to prepare for onboarding Why the task is Additional Task important information Complete? Create a detailed This step ensures that Delegates of mail provisioning provisioning happens files must schedule and require in planned stages provisioned to your project team to that take into account manage mail files of sign off on it. factors such as pilot provisioned users. users, work For more information schedules, see “Mail file geographic locations, delegation” on page and clients used. 208. Prepare This step allows for a “Preparing communications and smooth transition to communications and training. the service and training” on page 206 reduces help desk calls. Develop a method to This step helps you track provisioning. understand at what stage users are at in the transition to the cloud and is also useful for providing status reports to executive management. Request removal of Provisioning can fail Contact Support to trial accounts. for users who have determine whether trial accounts. users at your company have trial accounts.

Chapter 6. Onboarding users 191 Table 58. Tasks to prepare for onboarding (continued) Why the task is Additional Task important information Complete?

In hybrid Though not v “Limitations when environments, if required,Notes ID Notes IDs are not users will not use the files enable users to in the vault” on IBM Notes client sign email, read page 131 with the service, encrypted email, and v Importing your verify that the users to recall mail Notes ID have Notes ID files to messages. ID files are which they or typically required to v “Uploading a administrators have enable administrators Notes ID to the local access. to change users' vault” on page 269 Notes names. Customize mail file This step is required “Preparing access. if you want to allow customized mail file people who are not ACLs” on page 168 the owners of mail files to access mail files without being delegates. Typically this access is provided by adding a customer-specific administrator group to mail file ACLs. Familiarize yourself The password “Password rules by with password requirements might authentication requirements for be different from method” on page 141 logging in to the ones that are service currently used in your on-premises environment. In hybrid This step helps to See the section about environments only, ensure a smooth Person documents in verify that users’ transition to the the topic Person documents service. “Requirements for comply with service synchronized requirements. directories” on page 22. (Optional) In hybrid This step applies “Adding multiple environments only, only if users have Internet email configure multiple more than one addresses to Person Internet addresses for Internet email documents” on page users address, for example, 207 if users have two email addresses as a result of a company merger. (Optional) Ensure You can apply the See “Preparing to use that a custom mail custom template custom mail file template is uploaded during user templates” on page to the service, if you provisioning so that 161. plan to use one. users see the custom design when they first use the service.

192 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 58. Tasks to prepare for onboarding (continued) Why the task is Additional Task important information Complete? (Optional) Set up This step allows you See the section on batch user to use user provisioning provisioning with the comma-separated- and identity integration server. value (CSV) files to management in the provision batches of Integration server users. documentation.

Prepare for specific There are special v “Preparing for the clients. considerations for web client” each type of client v “Preparing for that can be used with Notes Traveler the service. devices” on page 195 v “Preparing for Notes clients” on page 196 v “Preparing for IMAP clients” on page 202

Preparing for the web client Before you provision users who will access IBM SmartCloud Notes using the web client, prepare for the web client. Before you begin

Read about the web client. About this task Table 59. Tasks to prepare for the web client Why the task is Additional Task important information Complete? Prepare for There are tasks to “Preparing for onboarding. prepare that apply to onboarding” on page all or most clients. 191 Review the Using a supported SmartCloud Notes supported browsers browser version web requirements and browser ensures the best versions, decide experience for your which to use, and users. upgrade browsers if necessary.

Chapter 6. Onboarding users 193 Table 59. Tasks to prepare for the web client (continued) Why the task is Additional Task important information Complete? If users currently use Most IBM iNotes Technote: IBM iNotes, compare features are Comparison tables of the features that are supported in the features between supported for cloud. Making your IBM Notes, IBM SmartCloud Notes users aware of the iNotes & IBM web. few differences can SmartCloud Notes reduces help desk web calls and improve user satisfaction. Assess network This step ensures “Network capacity capacity. that your site has the for the web client” network capacity to on page 20 support the number of web client users you plan to have If the Notes client is This step enables An ID enabled for used with shared administrators or shared login cannot login enabled, but web client users to be uploaded to the the client won't be upload Notes ID files service ID vault used in the cloud, to the vault in the manually by a web disable the shared service manually client user or an login feature before after provisioning. administrator. It can you provision users. only be uploaded automatically through the use of a Notes client. For more information on shared login, see the Securing section of the Domino documentation. (Optional) Deploy an Use an extension “Using extension extension forms file forms file if you forms files to to customize the web want to customize customize the look of client the visual theme, the web client” on fonts, the action bar, page 165 and other aspects of the web client. Disable on-premises This step ensures For information on IBM iNotes login that users are not Using iNotes IBM redirection, if used. redirected to their iNotes redirect, see on-premises mail the Domino servers after the documentation. move to the cloud. An IBM Software Services for Collaboration representative can provide a custom redirector for cloud login.

194 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Preparing for Notes Traveler devices Before enabling users to use IBM Notes Traveler mobile devices with the service, prepare your environment and the devices. Before you begin

Read about Notes Traveler devices. About this task

Before you provision users with a Notes Traveler subscription, complete the tasks in the following table to prepare. Table 60. Tasks to prepare for Notes Traveler devices Why the task is Additional Task important information Complete? Prepare for There are tasks to “Preparing for onboarding. prepare that are not onboarding” on page client-specific. 191 Ensure that your Connections to hosts “Configuring the firewall configuration in the service over firewall for outbound allows devices to Port 443 are required connections” on page access the service for WiFi access. 42 over WiFi. Review the Notes Using a mobile Notes Traveler Traveler device device that complies requirements for the memory and with these cloud. operating system requirements ensures requirements. the best experience for your users. If you plan to use Some carriers might Notes Traveler BlackBerry 10 not support the requirements for the devices, first verify minimum required cloud. that your wireless Blackberry 10 carrier supports the operating system minimum operating level. system level that is required in the cloud. Enable cookies in Cookies must be device browsers. enabled to connect to the service and to sync mail on devices.

Review Notes Be aware of policy v “Notes Traveler Traveler device settings that the Settings policy settings. service enforces that restrictions” on might be different page 118 than your current v “Using settings. Also, administrative optionally customize policies” on page settings. 105

Chapter 6. Onboarding users 195 Table 60. Tasks to prepare for Notes Traveler devices (continued) Why the task is Additional Task important information Complete? Review device This step makes you Notes Traveler limitations in the aware of any Troubleshooting, cloud. changes that users known limitations, might see after the and restrictions. move to the cloud.

(Optional) Enable This step is required v “Enabling application only if your application passwords. company enables full passwords” on federated identity page 139 authentication and v “Setting up Android devices that federated identity run Notes Traveler management” on 9.0.1.3 or a higher page 132 are not used.

Preparing for Notes clients Use of the IBM Notes client to connect to the service is optional. If you want your users to use the Notes client, understand the steps to prepare. Before you begin

Read about the “Notes client” on page 11 and decide whether to use it. About this task

Skip this task is you do not plan to use the Notes client. Table 61. Tasks to prepare for the Notes client Why the task is Additional Task important information Complete? Prepare for There are tasks to “Preparing for onboarding. prepare that apply to onboarding” on page all or most clients. 191 Compare the features Most features are Technote: that are supported also supported in the Comparison tables of for the on-premises cloud, but there are features between client to the featured some differences to IBM Notes, IBM that are supported in be aware of. iNotes & IBM the cloud. SmartCloud Notes web

196 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 61. Tasks to prepare for the Notes client (continued) Why the task is Additional Task important information Complete? Evaluate your A version of Notes To ensure a smooth currently deployed (Standard transition, leave clients. If necessary, configuration) that is plenty of time to upgrade to newer supported in the complete client versions of the client. cloud is required. upgrades, and, if necessary, related hardware upgrades, before you provision users for the cloud.

There are various upgrade methods available, including desktop push technology, Notes Smart Upgrade, and end-user controlled upgrades. v Technote: SmartCloud Notes client requirements v Upgrade Central: Planning your upgrade to IBM Notes and Domino 9.0 Social Edition v Search for “Using Notes Smart Upgrade” in the IBM Domino documentation. .

Chapter 6. Onboarding users 197 Table 61. Tasks to prepare for the Notes client (continued) Why the task is Additional Task important information Complete? In hybrid Managed mail Use an on-premises environments, replicas are policy to configure configure managed recommended to managed mail mail replicas provide Notes users replicas. Complete quick, local access to this step before you their mail when provision users so connected or that you can resolve disconnected from any issues specific to the service. this feature ahead of time.

For more information, see “Using Desktop Settings to configure managed mail replicas” on page 120. Note: In service-only environments, users can get similar benefits by creating local replicas of their mail files after they are provisioned. Assess network This step ensures “Network capacity capacity that your site has the for the Notes client” network capacity to on page 20 support the number of Notes client users that will connect to the cloud. (Optional) Use a If you prepare a A short contract with custom mail file custom mail file IBM Software template to template in advance, Services for customize the mail you can apply the Collaboration is file design. custom template required to test and during user approve the template provisioning so that design. For more users' first experience information on with the cloud is requirements and with the custom steps, see “Preparing design. to use custom mail file templates” on page 161. In hybrid Be aware of policy “Using environments, review settings that the administrative policy settings service enforces that policies” on page 105 might be different than your current settings. Also, optionally customize settings.

198 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 61. Tasks to prepare for the Notes client (continued) Why the task is Additional Task important information Complete? (Optional) In hybrid After users move to Exporting calendar environments, if you the cloud, they can entries allows users are not transferring import the contacts to save calendar mail files, export and calendar entries entries in local .ics contacts, and into their new mail files. After users are calendar entries that files. provisioned, they can have future dates. import the files into their new mail files in the service. Contacts are imported along with the saved calendar entries. For more information, see the topic about exporting and importing calendars in the Notes client help. (Optional) In hybrid Mail archives You can use Domino environments, if you provide users with policies to archive are not transferring access to old mail mail. For mail files, create mail content after the information, see the archives on-premises move to the cloud. topic about before the move to Note: Users cannot understanding mail the cloud. create local archives archiving and of their on-premises policies in the IBM mail after the move Domino to the cloud. documentation. Alternatively, you can use a third-party archiving application. (Optional) Install the If your company “Connecting to cloud IBM Connections purchases a Activities through Activity Plug-in collaboration the Notes client subscription, this sidebar” on page 202 step provides access to cloud Activities from the Notes client sidebar.

How the Client Configuration tool configures the Notes client To set up the IBM Notes client for use with the service, users download and run the Client Configuration tool (config.nsf) from their workstations. The tool performs the following configuration checks and tasks on the client. v Checks for the following information: – The client is a version supported for IBM SmartCloud Notes access. – The config.nsf file contains information needed to perform the configuration. – The downloaded data is less than 24 hours old. If it is older than 24 hours, an message informs users. They can continue to use the tool if they choose. v Confirms that the user is logged in using the ID that they will use in the service.

Chapter 6. Onboarding users 199 v Performs other small consistency tests, such as checking that the current Location document can be located. v Creates a wildcard Connection document that the client will use to connect to a mail server in the service through the proxy server in the service. The server name in the Connection is */your_certifier, where your_certifier is the name of the OU certifier you provided for your mail servers during service configuration. v If the user is already using the Notes ID that they will use in the service, tests connectivity to their new mail server on port 1352. v If the user has a mail file that is being transferred, confirms that their old and new mail files can be located.

Note: If the tests confirm that the user's mail file has already been transferred successfully using replication, then the tool does not attempt to find the old mail file, which might have already been deleted. v If the tool needs to close the Notes client to force a download of the user ID file, it attempts to find an Offline location: – If an Offline location is found, the tool switches to it to prevent the client from doing a final replication when it closes. – If no Offline location is found, the tool creates an Offline location (named Offline) for this purpose. – If a location named Offline already exists, but is not suitable for configuration purposes, a the tool creates a location named “Temporary location for cloud mail setup - safe to delete”.

Note: If the tool closes the Notes client for reasons other than to download the Notes ID an Offline location is not needed. v Creates a Location document called SmartCloud for username, or updates it if it already exists and is incorrect. v If the user has an existing mail file that is being transferred, the tool locates existing bookmarks that point to the on-premises mail file and changes them to point to the replica of the mail file in the service. v If the user has Location documents that point to the on-premises mail file, the tool updates the location documents to point to the new SmartCloud Notes mail file. For example, if the user has a working Office Location document, it changes to a virtual duplicate of the cloud Location document. v If the user has Connection documents (Contacts > Advanced view) that restrict which locations can be used, and the list includes the current location, then the tool updates those connections to allow the cloud location document. This is necessary so that users can continue to access on-premises application servers using the new cloud location. v If the user has Account documents (Contacts > Advanced view) that restrict which locations can be used, and one of the locations is the current location, the tool updates the Account documents so that they can be used from the cloud location. v If the user has an existing mail file that will be transferred, but the transfer has not yet taken place, the tool replicates the existing on-premises mail file with service mail file. If this succeeds, the field LLNMigrated=1 is set in the Calendar Profile document, which signals that another replication is not needed. The tool then sends email to LLNStatusUpdates advising of the successful transfer. LLNStatusUpdates is a mail-in database that can be used by IBM support or the administrator who is managing the on-premises deployment.

200 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v If the user has an existing mail file that will be transferred, and there is a local mail file, the tool replicates the local mail file with the service mail file. v Depending on the configuration tasks that have been completed at this time, the tool might shut down the Notes client. If so, a message informs the user, and provides instruction for what to do next (for example, restart Notes and enter the password for your SmartCloud Notes ID, to download the ID file). Again note that sometimes the shutdown is done for purposes other than downloading an ID file. Downloading Notes client software and other entitled software You can easily access the IBM Software Download Center to download IBM Notes and other software to which your company is entitled. Software entitlement is governed by the service Terms of Use and applicable License documents.

About this task

You can access the site if you have the Administrator account role. You can use the site to download software before or after user subscriptions are activated.

To access the Download Center, complete the following steps: 1. Log in to the service as an administrator. 2. Click Apps > Downloads and Setup. 3. In the Software Entitlements section, click View available software to get to the Download Center.

4. In the Software Downloads page, type the partial or full name of the entitled software in the Find by search text box. Then, click the search icon.

Chapter 6. Onboarding users 201 Search filter options are available to narrow product results by language and operating system. For more information, see Technote 1674504. Related information:

Technote 1674504 Connecting to cloud Activities through the Notes client sidebar Users with collaboration subscriptions in addition to SmartCloud Notes subscriptions are automatically logged in to the cloud Activities server through the Activities sidebar.

About this task

The Activities sidebar must be installed on the client. To install the Activities sidebar in Notes 8.5.2 or later 8.5x versions, select the IBM Connections Notes installation option.

To install the sidebar in IBM Notes 9.0 Social Edition or later versions, install the IBM Connections Plug-ins. For more information, see the wiki article Where is the Activities Sidebar for Notes 9.0 Social Edition?

Activities integration is not supported for Notes 8.5.1. Preparing for IMAP clients If you plan to use IMAP clients, complete these tasks to prepare. Before you begin

Read about IMAP clients. About this task Table 62. Tasks to prepare for IMAP clients Why this task is Additional Task important information Complete? Prepare for There are tasks to “Preparing for onboarding. prepare that apply to onboarding” on page all or most clients. 191

202 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 62. Tasks to prepare for IMAP clients (continued) Why this task is Additional Task important information Complete? Verify that users have Using a supported IMAP client a supported IMAP client is required requirements client installed. because it provides the best experience for users. Be aware of the This information can IMAP client IMAP client help with limitations limitations. troubleshooting. Open the firewall Ports 993 and 465 “Configuring the ports that are must be open to firewall for outbound required for IMAP allow connections to connections” on page access. the service via IMAP. 42 Enable IMAP access IMAP access is not Decide whether to in IBM SmartCloud enabled by default. enable IMAP access NotesAdministration. for all users or for specific users. To enable IMAP access for specific users requires time to make necessary edits to the on-premises directory. For more information, see “Configuring IMAP access” on page 178.

Preparing to use BlackBerry devices If you plan to use BlackBerry devices that are supported by a Hosted BlackBerry Services subscription, complete these tasks to prepare. Before you begin

Read about “BlackBerry devices with a Hosted BlackBerry Services subscription” on page 12. About this task Table 63. Tasks to prepare for BlackBerry devices Why this task is Additional Task important information Complete? Prepare for There are tasks to “Preparing for onboarding. prepare that apply to onboarding” on page all or most clients. 191

Chapter 6. Onboarding users 203 Table 63. Tasks to prepare for BlackBerry devices (continued) Why this task is Additional Task important information Complete? Verify that this The Hosted An IBM SmartCloud subscription supports BlackBerry Services Notes for Hosted the BlackBerry subscription does not BlackBerry Services devices that you support BlackBerry subscription enables want to use. 10. users to access the service through BlackBerry devices that run operating system versions 4.0 through 7.x. Users who use BlackBerry 10 devices require SmartCloud Traveler for Notes subscriptions instead. For more information about device requirements for each of these subscriptions, see the client requirements. Plan for time that is This step must be After your company required to accept complete before you purchases a Hosted and process the can provision users BlackBerry Services Research in Motion and can take three to subscription, you terms of use four weeks. must accept the agreement. Research in Motion terms of use agreement. Then, wait for an IBM representative to indicate that your subscription setup is complete.

204 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 63. Tasks to prepare for BlackBerry devices (continued) Why this task is Additional Task important information Complete? Ensure that devices An enterprise data If users currently use are set up to use an plan is required to personal plans such Enterprise data plan. activate the as BlackBerry BlackBerry devices Internet Service, they for the service. must convert to enterprise data plans. Allow time for users to contact the phone company to make the change and to set up the new plans on their devices. Users should know that they can no longer use personal accounts in the cloud. When users switch from personal plans to enterprise plans, you are likely to see increased costs that are associated with purchasing the new plans and with data usage. Be aware of the These setting If your current BlackBerry device requirements might policies are different settings that are be different from from the cloud enforced in the ones that are policies, service, such as currently communicate this password implemented at your change to users. For requirements. company. more information, see “Settings enforced for BlackBerry smartphones.” BlackBerry browser is You can notify users Access to web not supported if this behavior is applications in your different from what corporate intranet or they are accustomed on the Internet to. through the device is not supported.

Settings enforced for BlackBerry smartphones This topic describes the settings that the service currently enforces for BlackBerry® smartphones. Table 64. Settings enforced for BlackBerry smartphones Policy Value Allow users to send outbound messages No through services other than IBM SmartCloud Notes

Chapter 6. Onboarding users 205 Table 64. Settings enforced for BlackBerry smartphones (continued) Policy Value The maximum size of a single native 10240 (KB) attachment that can be downloaded to a smartphone The total size of all native attachments that 5242880 (Bytes) can be uploaded from a smartphone The maximum size of a single native 3145728 (Bytes) attachment that can be uploaded from a smartphone Allow users to disable smartphone No passwords Password pattern checks At least 1 alphabetic character and 1 numeric character Number of days after which a smartphone 90 password expires and the smartphone prompts the user to set a new password The number of minutes of inactivity allowed 30 before the smartphone is locked and the user must provide a password to unlock it. Minimum smartphone password length 8 characters Smartphone password required Yes The number of previous passwords that are 8 prevented from being used as new passwords Reset smartphone to factory default settings Yes when smartphone is wiped Allow users to place calls while the Yes smartphone is locked

Preparing communications and training Prepare a communications and training plan to help your users, administrators, and help desk personnel make the transition to the service. About this task

Prepare to communicate to your users the benefits of the service, the changes to expect, and the steps to take to make the transition. Ensure that your help desk personnel are aware of the communications plan and are prepared to help users follow instructions that are provided in it. For several client-specific sample communications to use as a starting point, see the wiki article Preparing communications about the transition to SmartCloud Notes.

Consider use of the following training resources to help users, help desk personnel, and administrators become familiar with the clients and features available with the service: v Preparing training for IBM SmartCloud Notes wiki article v Technote 7040248: Comparison tables of features between IBM Notes, IBM iNotes & IBM SmartCloud Notes web v IBM Multimedia Library for IBM Notes, affordable and proven resource for Notes client training

206 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v Getting started with SmartCloud Notes clients, getting started resources that are provided through the wiki Adding multiple Internet email addresses to Person documents You can include multiple Internet email addresses in a Person document. About this task

Domains specified in the Global Domain document field Alternate Internet domain aliases are not handled as alias domains by the service. Instead, each domain in this field is listed and verified in the service as a separate domain, similar to the domain specified in the Local primary Internet domain field. To enable a user to receive mail addressed to a domain in the Alternate Internet domain aliases field, you must specify the user’s address for the domain in the Person document.

Specify one Internet email address when you register the user. This address is added to the Internet address field of the Person document in the directory. After registration, add any additional addresses as secondary values in the Short name/User ID field in the Person document.

You can use the Alternate Internet domain aliases field in a Global Domain document to define an Internet domain. If you do, a user can only receive email addressed to the domain if the domain address is added to the Person document, either during or after user registration. Related tasks: “Preparing Global Domain documents” on page 49 Prepare at least one Global Domain document to define the Internet domains that your company owns. Mail file quota Currently a size limit (quota) of 25 GB is enforced on the mail files of users who were provisioned before November 22, 2014; the mail file size limit of users who are provisioned after this date is 50 GB. An exception is the mail files of SmartCloud Notes Entry users, whose mail files havea1GBlimit.

The sizes of the following mail file elements are factored into the quota calculation: v design elements v documents v view index v Domino Attachment and Object Store (DAOS) element v white space v attachments Full-text index size is not a factor in the quota calculation.

Users do not receive warning notifications if they are approaching their mail quota. However, web client users and Notes client users can see how close they are to quota by clicking the quota status bar that is shown near their name in the mail file.

Chapter 6. Onboarding users 207 When a user’s mail file quota is reached, the user cannot receive mail and the sender of a message receives a delivery failure notification.

Some clients continue to allow mail to be sent when quota is reached, as described in the following table. When a user with an over-quota mail file sends a message that cannot be delivered, the user does not receive a delivery notification failure. The service retries sending the delivery failure notification for about a day, and if not successful, deletes the notification. Table 65. Send mail behavior when quota is reached Sending mail without Sending mail and saving a Client saving a copy copy Notes Mail is sent. Mail is sent but not saved. web client Mail is sent. Mail is not sent or saved. Notes Traveler Not supported. Mail is not sent. Mail stays in the Outbox and the client tries to resend. BlackBerry® smartphone Mail is sent. Mail is not sent. Mail stays in the Sent folder and can be resent later.

Mail file delegation Using delegation preferences, users can allow other users to manage their mail, calendar, contacts, and to do items. Depending on which client is used, there are some differences in how delegation works with IBM SmartCloud Notes. Notes client

Delegation works in the following way for users who access their mail using the IBM Notes client: v To set up delegation, users set a Mail > Access & Delegation preference. Once set, this preference applies to both the Notes client and the web client. v In the Notes client, users can also delegate management of their Calendar, Contacts, and To Do tasks. v A delegate cannot assign other delegates to a mail file. v In a hybrid environment, delegates must be provisioned for the service to manage a mail file in the service. After delegates are provisioned, they can manage mail for both provisioned users with mail files in the service and on-premises users who have mail files on company servers. Users whose mail files are on company servers cannot manage a mail file in the service.

If your on-premises environment includes delegates who manage mail for other users, consider provisioning the delegates first. After delegates are provisioned, they can manage mail for both provisioned users and for on-premises users who have mail files on company servers. Web client

Delegation works in the following way for users who access mail using the web client: v To set up delegation, users set a Delegation user preference. Once set, this preference applies to both the Notes client and the web client.

208 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v In the web client, users can also delegate management of their Calendar, Contacts, To Do tasks, and Notebook. v A delegate cannot assign other delegates to a mail file. v In a hybrid environment, delegates who are provisioned for the service can only manage the mail files of other provisioned users; once provisioned, they cannot manage an on-premises mail file. Conversely, a person whose mail file is on a company IBM Domino server cannot manage the mail file of a provisioned user. Reassigning delegation after a user name change

If a delegate’s Notes user name changes, then the owner of the mail file must reassign delegation to the new name. Doing so updates the mail file ACL (access control list) with the new name, which allows the user access to the database. Related tasks: “Changing a Notes user name” on page 255 In a hybrid environment, you use the Domino Administrator client on-premises to change a user's Notes name. The steps initiate a series of administration process requests.

Transferring mail files As a convenience to your users, their current mail files can be transferred to the service before they are provisioned. Transferring mail files is optional. Before you begin

Complete the tasks “Deciding whether to transfer mail files” on page 189 and “Choosing a client deployment strategy” on page 187 About this task

Transfer mail files before you provision users. Essentially, the transfer process moves the current on-premises mail files to new mail servers in the cloud. If you transfer mail files, users continue to have access to their original mail after they are provisioned for the service. Users continue to use their existing Notes IDs after switching to the service. As a result, they can continue to access private content such as encrypted mail data.

Note: Mail file folders with a type set to private rather than shared (the default type) are not transferred to the service. This limitation applies only to the private folders themselves. The messages within the folders are transferred, and they are visible in the All Documents view in the mail file. Preparing for mail file transfer If you configure the service as a hybrid environment, as part of onboarding, you have the option to transfer users’ on-premises mail files to the service. Before you transfer mail files, complete the tasks to prepare. Preparing the staging server To prepare for mail file transfer, mail files are replicated to an on-premises IBM Domino server, referred to as the staging server. You must perform steps to prepare and set up the staging server.

Chapter 6. Onboarding users 209 Setting up a Domino staging server:

You provide an IBM Domino server on-premises to use as a staging server for the mail file transfer.

About this task

To avoid the risk of impacting production systems during user provisioning, use a dedicated server that is not used in your production environment. If you choose to use a production server, the following requirements are in addition to any resources required by production workloads. If you do choose an existing server to use as the staging server, select one that does not have any mail file replicas.

The minimum requirements for the staging server are as follows: v A 32-bit Domino server version 8.5.3 or later on any supported version of Microsoft Windows. v Dual Core Intel / AMD CPU v 2GBRAM v Available local storage of up to double the data volume for users that are being processed at any one time. Space is required for the mail files as well as encrypted copies of the mail files.

For information about installing and setting up Domino servers, see the Domino documentation.

Mail files can be transferred via FTP or removable storage. Removable storage can be a Network Attached Storage (NAS) device or a USB device. Your transfer manager indicates which type is available to you.

Note the following requirements for removable storage: v For NAS transfers, the staging server requires an available Gigabit Ethernet network port, for optimum performance. v For USB device transfer, see the USB device hardware requirements that are described in the web page What is Media Data Transfer Service? Related information:

What is Media Data Transfer Service?

Domino documentation

Register a server ID for the staging server:

Register a server ID, and optionally an administrator ID, for the staging server. Give mail servers access to the staging server.

About this task

The staging server requires access to your mail servers. To avoid the need for cross-certification, register the server ID under a certifier that your mail servers trust.

If access to mail servers in your environment is granted through a server-specific organizational unit (OU) wildcard, register the staging server under that OU. Then, the staging server has access to the mail servers automatically. For example, if your

210 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 mail servers are registered under /SERVER/RENOVATIONS and access to them is controlled through the wildcard entry */SERVER/RENOVATIONS, you might register the staging server ID as SCNSTAGING1/SERVER/RENOVATIONS.

For more information, see the topic on registering a server in the Domino documentation.

Procedure 1. Register the server ID with a common name of your choice, for example, SCNSTAGING1. 2. Optional: To use a dedicated ID to administer the staging server rather than one used in your production environment, register a new ID file within the trust hierarchy of the staging server ID. 3. Open the Server document of each mail server in the Domino directory in which the mail server is registered. Click the Security tab. v Make sure that the Access server field allows the staging server at least Reader access. v Add the staging server to the Trusted servers field. This access allows the scheduled agents in the onboarding tools to access the mail servers. 4. Delete the Server document for the newly created staging server from the directory. The new server will be set up in its own domain. Related information:

Domino documentation

Enabling the staging server to receive client configuration status reports:

The transfer manager creates documents in the Domino directory that allow the Notes client configuration tool to mail status messages to the staging server.

About this task

Users run the Notes client configuration tool to configure a Notes client to connect to the service. The tool mails a status message to the staging server. To enable routing of these messages, the transfer manager completes the following steps.

Procedure 1. Open the Domino Directory of your on-premises mail hub domain. 2. Perform the following steps to create a Mail-In Database document: a. Click Configuration > Messaging > Mail-In Databases and Resources. b. Click Add Mail-In Database. c. In the Mail-in name field, type the required name, LLNStatusUpdates. d. In the Description field, type a description, for example, OTT. e. Leave the Internet Address field blank. f. In the Internet message storage field, select No Preference. g. In the Domain field, type the Domino domain of the staging server, for example, SCNStaging. h. In the Server field, type the name of the staging server, for example SCNSTAGING1/SERVER/RENOVATIONS. i. In the File name field, type the file name of your OTT database, for example ott.nsf.

Chapter 6. Onboarding users 211 j. In the Encrypt incoming mail field, select No. k. Click Save & Close. 3. Click Connections > Add Connection, and create a Connection document to route mail from this domain to the domain SCNStaging. Preparing mail file ACLs before mail file transfer Before mail files are replicated to the staging server, prepare the mail file ACLs to set mail file access.

Procedure 1. Make sure that the staging server has Author access to each mail file that will be transferred. Server access to mail files is often controlled through a wildcard ACL entry, for example, */SERVER/RENOVATIONS, or a group, for example, LocalDomainServers. 2. Make sure that the mail file access is set as you want it to be for use in the service. For important information about ACL requirements, see “Preparing customized mail file ACLs” on page 168. 3. Make sure that each mail file ACL has no more than 74 customer-defined roles. To see the roles in an ACL, click File > Application > Access Control > Roles. 4. Disable the Enforce a consistent ACL across all replicas of this database setting in the ACL of each mail file. To do so, you can use the Manage ACL tool available in the Domino Administrator, as described in the following steps. Or you can use a procedure that has been established in your environment. a. From the Domino Administrator, click the Files tab. b. Select multiple mail databases to be provisioned. c. Click Database > Manage ACL. d. In the Manage Multiple ACLs dialog box, click Advanced. e. Select Modify Consistent ACL setting > Do not enforce a consistent ACL. Preventing local database encryption in new mail file replicas Prevent sending the local database encryption setting to new replicas.

About this task

The transfer manager copies replicas of mail files to the import server in the service. Use of local database encryption on the staging server replicas prevents this step. Perform the following steps on each mail file to prevent propagation of local database encryption to the replicas on the staging server.

Procedure 1. From IBM Notes, click File > Replication > Options for this Application. 2. Click Send. 3. To disable propagation of database encryption to new replicas, clear the field Send changes in local security property to other replicas. Importing IDs into mail files If users will not use the IBM Notes client with the service and their Notes ID files are not embedded in their mail files, you might want to have them import the ID files into their mail files before the mail files are transferred to the service.

212 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

This step enables user ID files to be uploaded to the ID vault in the service easily after user provisioning. Users require an ID in the vault to perform such actions as reading encrypted mail and to enable administrators to change their Notes names. Users might already have ID files that are embedded in their mail files, in which case this procedure is not necessary.

Importing the ID file before you transfer mail files is not required. Alternatively, users can import their ID files themselves after they begin to usethe service. In addition, administrators can upload user ID files to the service vault after users are provisioned.

If you want to import ID files before you transfer mail files, tell users to complete the following steps.

Note: Users who use the Notes shared login feature cannot perform this procedure because they do not have the required passwords that are associated with their ID files.

Procedure 1. Log on to IBM iNotes 2. Make sure that your ID is not smart card enabled. 3. Click Preferences, and then click Security. 4. Click Import Notes ID. 5. Locate your ID file and type your password as prompted.

Results Related tasks: “Provisioning users and mail files” on page 224 If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes. “Uploading a Notes ID to the vault” on page 269 In a hybrid environment, if a service user has an IBM Notes ID file, the ID must be stored in the ID vault in the service. In some cases, for users who have a Notes ID, but who will not use the Notes client, you might need to upload the Notes ID to the vault manually. If it is not stored in the vault, web client, Notes Traveler, and BlackBerry® smartphone users cannot perform secure mail operations. Other limitations also apply, as outlined in this topic. Scanning mail files for viruses Before you replicate mail files to the staging server, scan them for viruses using a virus program that is compatible with the service. This step is optional but gives you control over how to handle and communicate any issues with viruses. The service also scans for viruses as part of preparing for mail file provisioning. Transferring mail files with help from an IBM partner You can hire a certified IBM partner or IBM Software Services for Collaboration to help you transfer IBM Notes mail files to the cloud. Before you begin

Complete the tasks in the section “Preparing for mail file transfer” on page 209.

Chapter 6. Onboarding users 213 About this task

The person who helps you is known as the transfer manager. A company administrator and the transfer manager work together to complete the following steps. Contact an IBM representative directly for in-depth information. 1. Establish a transfer schedule. 2. Prepare for mail file transfer. Preparing includes setting up a IBM Domino staging server, to which mail files are replicated prior to being transferred to the cloud. 3. Use the Onboarding Planning Tool (OPT) to do quality checks that validate that on-premises mail files and Person documents comply with cloud requirements. 4. Replicate mail files to the staging server. 5. Create a mail file transfer request. The transfer manager performs this step. The request specifies a transfer method (NAS/USB or FTP) and downloads an encryption key to the staging server that is used to encrypt the mail files before transfer. If FTP is the transfer method, the request also generates and FTP user account and password to be used to upload files to the IBM data center. 6. Transfer mail files to a data center. If NAS/USB is the transfer method, ship the files to the data center. Otherwise, use an FTP client to upload the files to the data center. 7. Import the mail files into the service so that they are ready for provisioning. The transfer manager performs the step. 8. Provision users. The company administrator performs this step. Related information:

IBM software services for collaboration How the transfer manager creates a mail file transfer request After the mail files are replicated to the staging server, the transfer manager creates a Control document to initiate a mail file transfer request.

Before you begin

A Customer Service Representative must create a user account for the transfer manager, and assign the account a role that is required specifically to perform this procedure.

About this task

The transfer manager performs the following steps to create a Control document.

Procedure 1. In SmartCloud Notes Administration, click User Provisioning with Mail File Transfer. 2. Click New Control Document. 3. Enter the required information, including Transfer Method, which is either NAS (Network Attached Storage) or FTP (File Transport Protocol). 4. If you select FTP as the transfer method: a. In the Transfer Size field, specify the total size of the files to be transferred in this batch. The size must be no greater than the size shown in the FTP Available field, which is the space available for new requests. Do not underestimate the

214 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 size. It is better to overestimate the size to ensure that there is enough space allocated on the server for this request. The FTP Reserved fields shows the space reserved for all active requests. b. Specify a password for the FTP account. 5. Click Submit. 6. Click Download Key.

Results

An encryption key is downloaded to the on-premises staging server. If FTP is the transfer method, an account name is displayed, for example, 20103212_0000409801002. An account is created on the FTP server in the service and assigned that account name and the specified password.

What to do next

The transfer manager uses the downloaded key to encrypt the mail files on the staging server. Transferring mail files to the service data center After the transfer manager creates the mail file transfer request and encrypts the mail files, the company administrator transfers the mail files to the service data center. The customer uses the transfer method that is specified in the transfer request.

Transferring mail files using a removable storage device:

If the transfer manager specifies NAS/USB as the transfer method in the transfer request, a removable storage device is used to transfer the batch of mail files. This transfer method is required if the total size of the files being transferred is greater than 250 GB. To transfer using this method, the transfer manager copies the mail files from the staging server to the removable storage device. The files are encrypted during the process. The company administrator is then responsible for securely shipping the device to the designated service data center.

What to do next

After the transfer manager imports the mail files into the service, provision the users. Related tasks: “Provisioning users and mail files” on page 224 If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes.

Uploading mail files to an FTP server:

The transfer manager can specify FTP as the transfer method in the transfer request. If so, you use an FTP client to upload the mail files to an FTP server in the service.

Before you begin

Uploading the mail files to the FTP server requires an FTP client. This procedure describes how to use FileZilla Client version 3 to upload the files. FileZilla is a free

Chapter 6. Onboarding users 215 FTP client that is subject to the terms and conditions of the GNU General Public License agreement. If you use a different FTP client, it must support implicit SSL/TLS over FTP, passive data transfer, and SSL session reuse.

Make sure that the firewall used by your FTP client computer allows outbound connections over port 990 and over the port range 60000 - 61000. You can restrict these firewall rules to the client computer and the FTP server.

The transfer manager must complete the following steps before you upload the mail files: v Use an encryption key downloaded from the service to encrypt the mail files. v Give you the host name of the FTP server in the service, and the account name and password to use to connect to the server.

Note: Your transfer manager might complete these steps for you.

About this task

The FTP server accepts only encrypted connections using implicit SSL/TLS over FTP and it supports only the passive transfer mode. Use of the passive transfer mode allows the FTP client to initiate both the control and data connections. The FTP server does not support active transfer.

Procedure 1. Perform the following steps to create a site entry for the FTP server on FileZilla Client: a. Start FileZilla. b. Click File > Site Manager. c. In the Site Manager window, click New Site and enter a name for the site, for example, Mail transfer. d. In the General tab of the Site Manager window, complete the fields as described in the following table.

Field Value Host Host name of the FTP server that the transfer manager gave you Port Blank Protocol FTP - File Transfer Protocol Encryption Require implicit FTP over TLS Login Type Normal User FTP server account name that your transfer manager gave you, for example, 20103212_00004098010002 Password Account password that your transfer manager gave you

e. In the Transfer Settings tab of the Site Manager window, select Passive as the Transfer mode. f. Click OK. 2. Performs the following steps to upload the encrypted batch of mail files to the FTP server: a. From FileZilla, click File > Site Manager.

216 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 b. Select the site you created. c. Click Connect. If you see errors indicating that the login is incorrect and that the client cannot connect to the server, ask your transfer manager to reset the FTP password for your account. After you receive the new password from the migration manager, in the site entry you created, replace the original password with the new password. Then try uploading the batch of mail files again. d. In the "Unknown certificate" window, examine the certificate that is shown. If you trust that the certificate is valid, select Always trust certificate in future sessions, and click OK. If you select this option, in the future you do not see the "Unknown certificate" window when connecting to the server. e. In the Local site panel, go to the folder on the staging server in which the encrypted mail files are stored. f. Select the files that you want to upload and then drag or copy them to the Remote site panel. The files can be placed only in the top-level directory. Space in this directory is allocated specifically for your company. g. In the bottom of the FileZilla window, click Successful Transfers and confirm that the transfer was successful. h. To disconnect from the FTP server, at the top of the FileZilla window, click Server > Disconnect.

Note: If there is a period of inactivity after connecting FileZilla to the FTP server, FileZilla is disconnected. In this case, you might see the error messages A record packet with illegal version was received and Disconnected from server: Connection aborted. These messages do not indicate a problem. Use the Site Manager menu option again to reconnect to the server.

Results

The following steps occur to establish the connection between FTP client and server: 1. The client initiates a connection to the FTP server over port 990. 2. The server validates the client credentials. 3. The client switches to passive mode (PASV). 4. The server selects a port in the 60000 - 61000 range and returns the port to the client to use for secure data transfer. 5. The client initiates a second secure connection to the port returned by the server.

The following sample output provides an example of messages seen on the FTP client when connecting to the FTP server. You might see different output depending on the FTP client you use. See the table that follows the sample output for an explanation of the more important messages. Status: Resolving address of ftp.notes.na.collabserv.com Status: Connecting to 74.220.123.77:990... (See table) Status: Connection established, initializing TLS... Status: Verifying certificate... Status: TLS/SSL connection established, waiting for welcome message... Response: 220 LotusLive FTP upload server Command: USER 20745886_0054824112001 Response: 331 Please specify the password. Command: PASS ******** Response: 230 Login successful.

Chapter 6. Onboarding users 217 Command: SYST Response: 215 UNIX Type: L8 Command: OPTS UTF8 ON Response: 200 Always in UTF8 mode. Command: PBSZ 0 Response: 200 PBSZ set to 0. Command: PROT P Response: 200 PROT now Private. Status: Connected Status: Retrieving directory listing... Command: PWD Response: 257 "/" Command: TYPE I Response: 200 Switching to Binary mode. Command: PASV (See table) Response: 227 Entering Passive Mode (74,220,123,77,235,42).(See table) Command: LIST (See table) Response: 150 Here comes the directory listing. Response: 226 Directory send OK. Status: Directory listing successful

Table 66. Explanation of important messages in the example FTP connection output Message Explanation Status: Connecting to The initial connection using port 990 is 74.220.123.77:990... established.

If you see an error here, verify that port 990 is open on the firewall for outbound connections. Command: PASV Client switches to passive mode to prepare the data channel. Response: 227 Entering Passive Mode Server returns the IP address for the FTP (74,220,123,77,235,42). server (74.220.123.77) and the port (235*256+42=60202) Command: LIST The directory listing is initiated.

If you see an error here, verify that port range 60000 - 61000 is open on the firewall for outbound connections.

What to do next

The transfer manager must click Upload Complete in the Control document associated with this transfer.

After the transfer manager imports the mail files into the service, provision the users. Related tasks: “Provisioning users and mail files” on page 224 If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes.

Provisioning users Provisioning users adds IBM SmartCloud Notes subscriptions to user accounts in the service. After users are provisioned, they can begin to access their mail in the cloud.

218 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Before you begin

Before you provision users, Prepare for onboarding. Optionally, transfer mail files. Provisioning users without transferring mail files This procedure adds an IBM SmartCloud Notes subscription to a user account and creates a new mail file for the user on a mail server in the cloud. You can also add optional subscriptions purchased by your company. Before you begin

Prepare for onboarding to ensure that all required preparation is complete. If you are provisioning a new user at your company, make sure that you first register the user on-premises.

Your company might purchase a bundled subscription that allows you to enable services independently. For example, you might be able to enable Connections and Meetings services for users before you enable the IBM SmartCloud Notes (Email) service. To enable other services separately, create the user accounts through the IBM Connections Cloud User Accounts page. When you complete the procedure in this topic, all bundled services are enabled. About this task

If your on-premises environment includes delegates who manage mail for other users, consider provisioning the delegates first. After delegates are provisioned, they can manage mail for both service users and on-premises users whose mail files are still on company servers. Users whose mail files are on company servers cannot manage the mail of a service user.

The first step in provisioning users is searching the service directory for the names of the users that you want to provision. To provision users, you select their names from the search results. If you are provisioning many users, it is likely that you will repeat this search-then-provision step.

As an alternative to this procedure, you can use the Connections Cloud integration server to provision many users at once.

Note: If you are transferring mail files to the service during user provisioning, do not perform this procedure. Instead, refer to the procedure “Provisioning users and mail files” on page 224. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. In the Provisioning section of the SmartCloud Notes Administration window, click User Provisioning.

Note: Do not click User Provisioning with Mail File Transfer. 5. Display the names of the users to provision. In the Search box, type the beginning characters of any of the following user values: v Distinguished name, for example, Samantha Daryn/Renovations.

Chapter 6. Onboarding users 219 v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Select one user or multiple users to whom you want to assign the same subscription settings. Optionally, search again and select additional names. The previously selected names remain selected. 7. Click Provision Selected. 8. In the Provisioning Options window, select subscriptions for the user. You must select a SmartCloud Notes subscription. Other optional subscriptions may be available. When you are done, click Next. Table 67. Subscription fields Subscription field Description Mail Select a SmartCloud Notes subscription. Alternatively, select a bundled subscription, if available. Collaboration If available, optionally select a collaboration subscription . Alternatively, select a bundled subscription, if available. Bundled If available, select a bundled subscription that includes both a SmartCloud Notes subscription and a collaboration subscription. Other If available, optionally select add-on subscriptions.

9. Select an optional extension forms file for the web client and a mail template for the IBM Notes client: a. Optional: If an extension forms file is available for your company, you see the Select Extension Forms File option. To apply an extension forms file to web clients, select a forms file. An extension forms files provides a customized experience for the web client. Extension form files are available only if your company implements them. b. In the Select Mail Template section, the default mail template is selected. If you want to apply a different template to the user mail files, click Select next to the template name.

220 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v If the Notes client is used, select a template version that is compatible with the Notes client version that is used. Click Next to scroll through the list of available templates until you find the correct one. v If the Notes client is not used, select the latest template version in the language that you want to use. v To see only custom mail templates developed for your company, click Hide Standard Mail Templates. If you select a custom mail file template, after provisioning is complete, the design of the Inbox folder is applied to any custom mail folders created by your company. c. Click Next. 10. In the Provide an initial password section, provide a temporary password that complies with the requirements that are shown. Users provide this password when they log in to the service for the first time with a web browser. After logging in, they are prompted to create new passwords. This password is a different password than the one associated with a Notes client ID file or any on-premises HTTP password. If users you are provisioning already use the service through another subscription, they continue to use their current passwords, and do not use this password. If your company uses federated identity management, users do not provide this password. Instead, they use the Use My Organization's Login page to provide a password that allows them to authenticate using a company security application. 11. Click Next and review your selections. Note the password that is shown in the Initial Password field because you must provide it to each user who is new to the service. 12. Click Confirm to open the User Provisioning Requests page. Review the list of users again, and when you are ready to provision them, click Request Provisioning. v As users are added to the provisioning queue, the User Provisioning Requests page removes their names from the list. v The page shows the percentage of requests that are complete because they are added to the provisioning queue and the number that remain to be processed. v The names of any users who cannot be added to the provisioning queue are listed with error messages. Resolve errors and repeat the steps to provision the users. Missing user Internet addresses and directory synchronization problems are examples of errors that can prevent a user from being added to the provisioning queue. To cancel provisioning of any users that are not yet processed, click Cancel. 13. When the provisioning request is complete, click Return to User Provisioning. What to do next

After users are successfully added to the provisioning queue, check user provisioning status to determine when provisioning is complete or if any provisioning errors occur.

When users are listed in the Provisioning Status page as Done and in the Pending state, help users get started with the service. Related tasks:

Chapter 6. Onboarding users 221 “Checking user provisioning status” on page 229 After you provision users, check the status of their IBM SmartCloud Notes subscriptions. “Helping users get started” on page 230 After user provisioning is complete, help users get started with their mail in the cloud. Related information:

Integration server and subscription provisioning for Smartcloud Notes hybrid users Registering a new user on-premises To provision a user in a hybrid environment, the user must be registered in an on-premises IBM Domino directory. If a user you are provisioning is new at your company, perform this procedure to register the user on-premises.

Before you begin

You can apply a policy to the user so that the policy is in effect when the user is provisioned for IBM SmartCloud Notes. To do so, create an explicit policy before you continue. Then, select the policy during this procedure. If you do not apply a policy during user registration, you can apply it later. For more information, see “Using administrative policies” on page 105.

The Domino directory in which you register the user must be configured as a synchronized directory that is used for user provisioning. For more information, see “Configuring directory synchronization” on page 89.

Procedure 1. From an on-premises Domino Administrator client, open a server that is in the Domino domain in which you want to register the user. 2. Click the tab People & Groups. 3. Click Tools and click People > Register. 4. Use any of the following methods to specify the certifier to use to certify the new user ID. v If you are prompted to provide a password for the certifier that you want to use, enter the password. Otherwise, click Cancel. v Click Certifier ID, select the certifier ID, and click OK. v Click Use the CA Process and select the certifier.

Note: There must be a trust relationship between this certifier and the OU certifier you uploaded to the service to certify your mail servers. For example, if your mail server OU certifier is /SCN/Renovations, there is an automatic trust relationship if the user ID certifier is /Renovations. However, if the user ID certifier is /Zetabank, you must create cross-certificates to establish trust. 5. Complete the following fields in the Basics tab of the Register Person window.

Field Value Registration Server The name of the server to use to register the user. The domain Domino directory for this server must be configured as a synchronized directory that is used for user provisioning.

222 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Field Value First name, Middle name, Last name The user's name.

If you plan to use the integration server to provision users, a first name and a last name are required. Otherwise, only a last name is required.

If you specify a last name only, after the user is provisioned, the one name is displayed in the SmartCloud Notes directory and in the mail file. However, in Connections Cloud account settings and user accounts, the name is also the first name. For example, if you register a user with the last name HelpDesk, when you log on to the service as an administrator and click User Accounts, the name is shown as HelpDesk HelpDesk. Short name A short version of the name that is generated automatically. You can change the default value.

You cannot enter an email address here. Password A password for the Notes ID.

Password Options v Password Quality Scale v Encryption Strength v Set internet password (optional). The service does not use the Internet password. However, it might be required for access to on-premises web applications. Mail system IBM Notes

Select this option regardless of the type of client you plan to use with the service. Explicit policy (Optional) Select an explicit policy to apply to the user. Organizational policies are not supported. Enable roaming for this person Do not select this option. Roaming is not supported. Create a Notes ID for this person Select.

6. Select the Advanced box in the Register Person window. 7. Click Mail and complete the fields that are displayed to create a required, temporary on-premises mail file. When the user is provisioned for the service, a new mail file is created in the service. Make a note of the location of the temporary mail file; after user provisioning is complete you can delete it. 8. Click Address and complete the fields that are described in the following table.

Field Value to specify Internet address The user's Internet mail address, for example, [email protected].

Chapter 6. Onboarding users 223 Field Value to specify Internet domain The domain portion of the user's Internet address, for example, renovations.com. The domain must be one that is verified by the service. Address name format; Separator Select options to determine the format of the Internet address.

9. Click ID info and complete the fields that are described in the following table.

Field Value to specify Create a Notes ID for this person Select this option. Certifier ID Confirm the certifier to use to create the ID. There must be a trust relationship between this certifier and the certifier you provided to certify your mail servers in the service. Public key specification Select one of the listed specifications. License type Select North American or International. The license type determines the type of ID file that is created. It affects encryption of sent and received mail and of data. North American is the stronger type. Location for storing user ID Select any of the following options: v In Domino directory to store the ID file as an attachment in the Person document. v In file to store the ID in a file that you provide to the user. v In Notes ID vault to store in an on-premises ID vault. This option is useful only to retrieve the ID during initial setup of a Notes client on-premises. After the client connects to the service, the ID is uploaded to the ID vault in the service. Then, the on-premises ID vault is no longer used.

10. Optional: Click Groups and assign the user to groups in the Domino directory. 11. Click the green check mark to add the user to the registration queue. 12. Select the Registration Queue and click Register.

Results

A Person document for the user is added to the Domino directory of the registration server. After the Person document replicates to the service during directory synchronization, a company administrator can provision the user from the User Provisioning window of SmartCloud Notes Administration. To provision the user, the administrator first searches for the user name. Provisioning users and mail files If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes.

224 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Before you begin

Prepare for onboarding and transfer mail files.

Your company might purchase a bundled subscription that allows you to enable services independently. For example, you might be able to enable Connections and Meetings services for users before you enable the IBM SmartCloud Notes (Email) service. To enable other services separately, create the user accounts through the IBM Connections Cloud User Accounts page. When you complete the procedure in this topic, all bundled services are enabled. About this task

As an alternative to this procedure, you can use the Connections Cloud integration server to provision many users at once.

You must provision users within 60 days from the time their status shows Ready to Provision. After 60 days the status changes to Cancelled and the users and their mail files must be transferred to the service again in a new batch.

If your on-premises environment includes delegates who manage mail for other users, consider provisioning the delegates first. After delegates are provisioned, they can manage mail for both service users and on-premises users whose mail files are still on company servers. Users whose mail files are on company servers cannot manage the mail of a service user.

After provisioning is complete, the design of the Inbox folder is applied to custom mail file folders. Custom folders are user-created folders or company-created folders from a custom template that is used in the service.

The mail template specified during user provisioning controls the design of the mail file in the service.

Tip: After you provision users who will use only the web client and whose IBM Notes ID files were attached to the transferred mail files, tell the users to sign or encrypt a mail message after logging on to the service for the first time. That step triggers the upload of their ID files to the ID vault in the service. When doing so, they may need to provide the Notes ID password. After the ID is uploaded to the ID vault, they are no longer prompted for that password when signing or encrypting mail.

Perform the following steps to provision users and mail files: Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click User Provisioning with Mail File Transfer. A Control Document created by the transfer manager, who has the Data Transfer Manager role, is shown for each batch of users. Each Control Document shows the status for that batch of users. When all provisioning of users in a batch is either completed or cancelled, the Control Document shows the status Complete.

Chapter 6. Onboarding users 225 5. When any Control document shows the status Ready, click the Users tab to see a list of user names that are ready to be provisioned.

Note: Each user's Internet mail address is shown. If a user is new to IBM Connections Cloud, the address is also the identity used to log in to the service from a browser at http://www.ibmcloud.com/social. If a user already has another Connections Cloud subscription, the log in identity is the current value of the Email field in the Account Login tab of the Connections Cloud user account. 6. Select one or more users whose status shows Ready to Provision

Note: If a user status shows Error, work with your transfer manager to resolve the problem, and then wait for the status to change to Ready to Provision. 7. Optional: Click Provisioning Estimate to see an estimate of the time it will take to provision the selected users. The estimate is based on the size of the mail files in this request and on the number of requests in the queue. 8. Click Provision Selected. 9. In the Provisioning Options window, select subscriptions for the user. You must select a SmartCloud Notes subscription. Other optional subscriptions may be available. When you are done, click Next. Table 68. Subscription fields Subscription field Description Mail Select a SmartCloud Notes subscription. Alternatively, select a bundled subscription, if available. Collaboration If available, optionally select a collaboration subscription . Alternatively, select a bundled subscription, if available. Bundled If available, select a bundled subscription that includes both a SmartCloud Notes subscription and a collaboration subscription. Other If available, optionally select add-on subscriptions.

10. Select an optional extension forms file for the web client and a mail template for the IBM Notes client: a. Optional: If an extension forms file is available for your company, you see the Select Extension Forms File option. To apply an extension forms file to web clients, select a forms file. An extension forms files provides a customized experience for the web client. Extension form files are available only if your company implements them. b. In the Select Mail Template section, the default mail template is selected. If you want to apply a different template to the user mail files, click Select next to the template name. v If the Notes client is used, select a template version that is compatible with the Notes client version that is used. Click Next to scroll through the list of available templates until you find the correct one. v If the Notes client is not used, select the latest template version in the language that you want to use.

226 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v To see only custom mail templates developed for your company, click Hide Standard Mail Templates. If you select a custom mail file template, after provisioning is complete, the design of the Inbox folder is applied to any custom mail folders created by your company. c. Click Next. 11. In the Provide an initial password section, provide a temporary password that complies with the requirements that are shown. Users provide this password when they log in to the service for the first time with a web browser. After logging in, they are prompted to create new passwords. This password is a different password than the one associated with a Notes client ID file or any on-premises HTTP password. If users you are provisioning already use the service through another subscription, they continue to use their current passwords, and do not use this password. If your company uses federated identity management, users do not provide this password. Instead, they use the Use My Organization's Login page to provide a password that allows them to authenticate using a company security application. 12. Click Next and review your selections. Note the password that is shown in the Initial Password field because you must provide it to each user who is new to the service. 13. Click Confirm to open the User Provisioning Requests page. Review the list of users again, and when you are ready to provision them, click Request Provisioning. v As users are added to the provisioning queue, the User Provisioning Requests page removes their names from the list. v The page shows the percentage of requests that are complete because they are added to the provisioning queue and the number that remain to be processed. v The names of any users who cannot be added to the provisioning queue are listed with error messages. Resolve errors and repeat the steps to provision the users. Missing user Internet addresses and directory synchronization problems are examples of errors that can prevent a user from being added to the provisioning queue. To cancel provisioning of any users that are not yet processed, click Cancel. Results

User provisioning with mail file transfer creates replicas of user mail files on the mail servers in the service. At the next directory synchronization with on-premises servers after user provisioning is complete, the Person documents in the on-premises Domino directory are updated to show the new mail server names and mail file path.

When the staging server application detects the name of the new SmartCloud Notes mail server in the Person document, it deposits a welcome email in a user's original, on-premises mail file. You can customize the content of this notification. The notification should include suitable links for your users to use to log on to the service for the first time. For example, you might include http:// www.ibmcloud.com/social or a link to a logon page used by your company.

Chapter 6. Onboarding users 227 A user can run the Notes client configuration tool to configure a Notes client to connect to the service. In this case, the tool initiates a final replication between the on-premises mail file replica and the replica in the service after client configuration is complete.

If a user does not use the Notes client, the staging server application initiates the final replication when it detects the name of the new SmartCloud Notes mail server in the Person document. What to do next

After users are successfully added to the provisioning queue: v Track the status of mail file provisioning by returning to the Users tab in the Control Document and refreshing the page or using the Status field filter. v Check user provisioning status to determine when provisioning is complete or if any provisioning errors occur. Related concepts: “Mail file delegation” on page 208 Using delegation preferences, users can allow other users to manage their mail, calendar, contacts, and to do items. Depending on which client is used, there are some differences in how delegation works with IBM SmartCloud Notes. Related tasks: “Managing IBM Notes Traveler devices” on page 272 For each user with an IBM Notes Traveler subscription, you can view information about the user's mobile device. You can also wipe the device to remove sensitive data from it, for example, if the device is lost or stolen. “Managing BlackBerry smartphones” on page 274 After activating a user’s BlackBerry® smartphone, perform any of the following tasks to manage it. “Checking user provisioning status” on page 229 After you provision users, check the status of their IBM SmartCloud Notes subscriptions. Related information:

Using Connections Archive Essentials

Integration server Deleting on-premises mail files After users have set up clients to complete the provisioning process, the staging server application creates Administration Process requests to delete on-premises mail files.

About this task

The requests, called "Approve File Deletion," are put in the Pending Administrator Approval view in your on-premises Administration Requests database where they await your approval. Do not approve a deletion request immediately. Instead, wait at least a few days to ensure that the user provisioning is complete before approving the deletion. Decommissioning on-premises mail servers Once an on-premises IBM Domino mail server is no longer providing mail service to users, you can decommission the server using your standard processes.

228 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Checking user provisioning status After you provision users, check the status of their IBM SmartCloud Notes subscriptions. Before you begin

Complete one of the following procedures: v “Provisioning users without transferring mail files” on page 219 v “Provisioning users and mail files” on page 224 Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. In the Provisioning section of the SmartCloud Notes Administration window, click Provisioning Status. 5. Display the names of the users whose status you want to check. In the Search box, type the beginning characters of any of the following user values: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. In the Status field, select one of the following options:

Chapter 6. Onboarding users 229 Option Description In Progress Show all users in the search results who are in the process of being provisioned. The service is setting up mail files and doing other steps to prepare user accounts. Users that are shown in this view cannot use the SmartCloud Notes service yet. Note: It is possible for user accounts to be in a Held state. This state can be seen only in IBM Connections Cloud user accounts by clicking Home and then User Accounts. The Held state indicates that service is performing routine checks. It does not indicate that there is a problem. Do not delete and then re-add the account. Resolution often takes a few hours or less; however, on some occasions it can take a few days. If you are concerned that the Held state is not changing, contact customer support. Done Show all users in the search results who are successfully provisioned. The service has finished preparing the mail files and accounts of these users, and the users can use the service.

One of the following states is shown for each user: v Pending: This state indicates that a user has not yet logged in to the SmartCloud Notes service and accepted the terms of use. v Active: this state indicates that a user has logged in to the service and accepted the terms of use. Error Show all users in the search results who cannot be provisioned because of an error. If you see a user in this state, contact support to help you resolve the error.

What to do next

When users are listed in the Provisioning Status page as Done and in the Pending state, help users get started with the service. Related tasks: “Helping users get started” After user provisioning is complete, help users get started with their mail in the cloud.

Helping users get started After user provisioning is complete, help users get started with their mail in the cloud.

230 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Before you begin

Check user provisioning status; users in the Pending state are ready to begin to use the service. Providing account information to users After you add a IBM SmartCloud Notes subscription to user account, provide the user with the information that is required to log in to the service. Before you begin

Complete the procedure “Checking user provisioning status” on page 229 and verify that users are listed in the provisioning status page as Done and in the Pending state. About this task

Users must log in to the service from a browser within 30 days after being assigned a SmartCloud Notes subscription. After logging in, users can begin to use the web client immediately.

Users who want to use the IBM Notes client must download and run the SmartCloud Notes client configuration tool to connect the client to the mail server in the service. This tool is available within the service after logging in from a browser. A version of the Notes client that is supported by the service must be installed and set up. The Notes client is available for download from the IBM Notes product page. A SmartCloud Notes subscription includes a license for the client.

Note: If a user sees the error ID in vault has expired download time when attempting to connect to the service for the first time from a Notes client, reset the Notes ID password and instruct users to log in again with the new password.

Users whose on-premises mail files are transferred to the service receive a welcome email in their original, on-premises mail file. The welcome email contains content that is customized for your company. Procedure 1. Provide the following information to each user: v The login URL – http://www.ibmcloud.com/social. v The web login name – The value of the Email field in the Account Login tab of the user's Connections Cloud user account. To see user accounts, log in to the service as an administrator, click Administration > Manage Organization, and click User Accounts. v The temporary password -- The first time users log on, they use a temporary password that is created for them at the time their account is created. They are asked to change this password the first time they log on. 2. If you use a hybrid environment, you may also need to provide the Notes ID file to a user who is using the Notes client for the first time.

Chapter 6. Onboarding users 231 Results

When users log in from the browser, they are presented with the Account Updates form. They must click Submit to complete the user registration and activate their account. What to do next

Help users get started with the clients they will use in the cloud. Related tasks: “Getting started with the web client” Complete the following tasks to help users get started with the web client. “Getting started with the Notes Traveler devices” on page 233 Complete the following tasks to help users get started in the cloud with IBM Notes Traveler devices. “Getting started with the Notes client” on page 237 If the IBM Notes client is used with the service, complete the following tasks to help users get started. “Getting started with IMAP clients” on page 237 If IMAP clients are used, complete the following tasks to help users get started with them. Getting started with the web client Complete the following tasks to help users get started with the web client. Before you begin

Complete the procedures “Providing account information to users” on page 231 and “Preparing for the web client” on page 193. About this task Table 69. Getting started with the web client Why this task is Additional Task important information Complete? Point users to the Users can refer to the SmartCloud Notes web client documentation as web documentation documentation. they begin using the client. Prepare to If any user has See Technote 1496881: troubleshoot any trouble logging in to SmartCloud Notes login problems. the service, you can user cannot log on quickly resolve the problem.

232 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 69. Getting started with the web client (continued) Why this task is Additional Task important information Complete? (Optional) If instant Instant messaging To enable instant messaging is enabled must be enabled in messaging in the web for your company, client preferences and client, users click make sure that users in SmartCloud Notes More > Preferences also enable it in Administration. > Instant Messaging client preferences. and select Enable instant messaging.

For information on configuring instant messaging in SmartCloud Notes Administration, see “Configuring instant messaging” on page 171.

(Optional) In hybrid The plug-in allows v Notes Browser environments, install web client users to Plug-in and configure the access Notes requirements IBM Notes Browser applications on v Notes Browser Plug-in on-premises Domino Plug-in servers. documentation for the service

Getting started with the Notes Traveler devices Complete the following tasks to help users get started in the cloud with IBM Notes Traveler devices. Before you begin

Complete the procedures “Providing account information to users” on page 231 and “Preparing for Notes Traveler devices” on page 195. About this task Table 70. Getting started with Notes Traveler devices Why this task is Additional Task important information Complete? If you did not add This subscription “Adding a Notes the Notes Traveler must be added for Traveler subscription add-on subscription users to access their to a user account” on during user mail in the cloud page 234 provisioning, add it through mobile now. devices that are supported by the Notes Traveler service.

Chapter 6. Onboarding users 233 Table 70. Getting started with Notes Traveler devices (continued) Why this task is Additional Task important information Complete? Uninstall any This step prevents previous Notes devices from Traveler accounts attempting to from devices. continue to get mail from an on-premises server. Remove user This step prevents “Removing user accounts from any the on-premises accounts from on-premises Notes servers from on-premises Notes Traveler servers. attempting to connect Traveler servers” on to mail files in the page 235 service to which they no longer have access. Point users to the The documentation Notes Traveler Notes Traveler describes how to get documentation documentation. started with each of the supported devices. (Optional) On the This setting helps On the phone, select Apple iPhone, prevent users from Settings > Mail, recommend that deleting messages by Contacts, Calendars users enable the Ask mistake. > Ask Before Before Deleting Deleting setting. Prepare to You can quickly Refer to the troubleshoot. resolve any following section of problems. the Notes Traveler documentation: Troubleshooting, known limitations, and restrictions

Related tasks: “Managing IBM Notes Traveler devices” on page 272 For each user with an IBM Notes Traveler subscription, you can view information about the user's mobile device. You can also wipe the device to remove sensitive data from it, for example, if the device is lost or stolen. Adding a Notes Traveler subscription to a user account To enable a user to connect to the service through a mobile device supported by IBM Notes Traveler, add the subscription to the user’s account.

About this task

The following steps describe how to add a subscription to the account of a user who already has a Notes Traveler subscription. You can also add the subscription when you first add the user account. For information about adding user accounts, see the topic Administering user accounts.

234 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the arrow next to a user's name and select Edit User Account. 5. Click Next. 6. In the Subscription Add-ons section, select the Notes Traveler subscription. 7. Click Save.

What to do next

The user can now set up the mobile device to connect to the service. For information, see theNotes Traveler documentation.

After the user sets up the device to connect to the service, if you use a hybrid environment, remove the user’s account from any on-premises Notes Traveler servers. Related tasks: Chapter 7, “Administering user accounts,” on page 243 Though IBM is responsible for the administration and maintenance of the mail servers, there are tasks that you perform through an administration interface at http://www.ibmcloud.com/social. Related information:

Notes Traveler Removing user accounts from on-premises Notes Traveler servers After a user sets up a device to connect to the service, if you use a hybrid environment, remove all accounts the user has on on-premises IBM Notes Traveler servers.

About this task

To remove users’ on-premises Notes Traveler accounts, deny users access to the on-premises Notes Traveler server as described in the topic "“Restricting access using server document access fields”." Then delete the users from the Notes Traveler server.

In addition, remove any previous on-premises Notes Traveler client software or account from mobile devices.

Restricting access using server document access fields:

Deny service users access to on-premises IBM Notes Traveler servers.

Procedure 1. From the Domino Administrator client, select the IBM Notes Traveler Server document. 2. Click Edit Server. 3. Click the IBM Notes Traveler tab. 4. Populate either the Access Server or Not Access Server field with the names of users and groups.

Chapter 6. Onboarding users 235 Users defined as Domino 'Full Access Administrators' have access regardless of how the Not Access Server or Access Server fields are configured. Users denied access to Domino through the Domino Not Access Server or Access Server fields under the Security tab of the server document cannot access Notes Traveler. Table 71. Server access fields Field Description Access Server Select the option users listed in all trusted directories to allow access to Notes Traveler only to people that have person documents in either the primary directory of this server or any secondary directories that trusted credentials using Domino directory assistance.

You can also select individual names of users and groups to allow access to this Notes Traveler server. A blank entry means that all users can access Notes Traveler except any who are listed in the Not Access Server field. Not Access Server Select the names of users and groups that should be denied access to this Notes Traveler server. A blank entry means that no users are denied access. Note: Entering names in the Access Server field automatically denies access to those names not listed.

5. Click Save & Close.

What to do next

Delete users from on-premises Notes Traveler servers.

Deleting a user from Notes Traveler servers:

Remove service users from all on-premises IBM Notes Traveler servers.

Procedure 1. Run the following command: tell traveler delete * 2. Run the following command: tell traveler security delete *

Note: If the user has already been deleted from the Domino directory, then the full user name must be specified. For example: tell traveler delete * "CN=John Doe/OU=Raleigh/O=IBM" The previous two steps should completely remove the user, but you can verify with these additional steps: 3. Open the Notes Traveler administration application and verify that there are no entries for the user. 4. Open ntsclcache.nsf and verify that there are no entries for the user.

236 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Getting started with the Notes client If the IBM Notes client is used with the service, complete the following tasks to help users get started. Before you begin

Complete the procedures “Providing account information to users” on page 231 and “Preparing for Notes clients” on page 196. About this task Table 72. Getting started with the Notes client Why this task is Additional Task important information Complete? Point users to the Users require For more documentation. instructions to information, see the download and run Notes section of the the client IBM SmartCloud configuration tool to Notes user connect to a mail documentation. server in the cloud. For complete documentation on using Notes, see the help that comes with the client. Prepare to If a user has trouble Technote: Could not troubleshoot any connecting the Notes connect to server problems. client to the cloud when running IBM mail server, you can SmartCloud Notes quickly resolve the liveConfig problem. application (config.nsf) (Optional) If users If mail files are not For more exported contacts transferred to the information, see the and calendar entries service, this step topic about exporting from their original enables users to and importing mail files, import the preserve their calendars in the entries into the new existing calendar and Notes client help. mail files in the contacts. cloud. (Optional) Manually One reason to do this “Manually configure the client is if you want users configuring Notes to connect to the to be able to connect clients to connect to service instant to both an the service instant messaging on-premises messaging community. community and the community” on page service community. 175

Getting started with IMAP clients If IMAP clients are used, complete the following tasks to help users get started with them.

Chapter 6. Onboarding users 237 Before you begin

Complete the procedures “Provisioning users” on page 218 and “Configuring IMAP access” on page 178. About this task Table 73. Getting started with IMAP clients Why this task is Additional Task important information Complete? Point users to the The documentation Enabling IMAP documentation. describes how to get access started with each supported IMAP client. Read the This information can IMAP client documentation on be helpful with limitations IMAP client troubleshooting. limitations.

Getting started with BlackBerry devices If BlackBerry devices supported by a Hosted BlackBerry Services subscription are used, complete the following tasks to begin using the devices with the service. Before you begin

Complete the procedures “Providing account information to users” on page 231 and “Preparing to use BlackBerry devices” on page 203. About this task

Note: If BlackBerry 10 devices are used, see “Getting started with the Notes Traveler devices” on page 233, instead. Accepting the Research In Motion terms of use An authorized person from your company must accept the Research In Motion® terms of use. This person receives an email notification with instructions that include a link to the terms of use document.

About this task

After you accept the Research in Motion terms of use, you must wait to receive a notification from an IBM Customer Service Representative indicating that your company’s BlackBerry® subscription setup is complete. You must receive this notification before you can add BlackBerry subscriptions to user accounts. Related tasks: “Preparing to use BlackBerry devices” on page 203 If you plan to use BlackBerry devices that are supported by a Hosted BlackBerry Services subscription, complete these tasks to prepare. Adding a BlackBerry subscription to a user account To enable a user to connect to the service through a BlackBerry® smartphone, add a SmartCloud Notes for Hosted BlackBerry® Services subscription to the user account.

238 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Before you begin

Before you can add BlackBerry® subscriptions to user accounts, you must receive a notification from an IBM Customer Service Representative that the subscription for your company has been set up.

About this task

The following steps describe how to add the subscription to the account of a user that is already provisioned for SmartCloud Notes. You can also add the subscription during user provisioning.

Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the arrow next to a user's name and select Edit User Account. 5. Click Next. 6. Under Subscription Add-ons, select SmartCloud Notes for Hosted BlackBerry Services. 7. Click Next and then Finish. Related tasks: “Provisioning users” on page 218 Provisioning users adds IBM SmartCloud Notes subscriptions to user accounts in the service. After users are provisioned, they can begin to access their mail in the cloud. Removing user accounts from an on-premises BlackBerry Enterprise Server If your company uses a hybrid environment and you have transferred user mail files to the service, before you activate devices for the service, remove all accounts users have from any on-premises BlackBerry® Enterprise Servers, and then wipe the user devices. If you do not complete these steps, obsolete on-premises information can be provided to the service. Completing these steps is also important to prevent on-premises servers from consuming resources by repeatedly attempting to access mail files in the service to which they no longer have access.

About this task

For information on removing accounts, see BlackBerry Knowledge Base document KB04169. Related information:

BlackBerry Knowledge Base document KB04169 Activating a user's BlackBerry smartphone After you add a BlackBerry® subscription to a user account, the user's smartphone must be activated to enable it to be used with the service.

Before you begin

The user's wireless carrier plan must be an Enterprise plan rather than a Personal plan. A smartphone cannot be activated for the service when a Personal plan is used.

Chapter 6. Onboarding users 239 Complete the procedures “Adding a BlackBerry subscription to a user account” on page 238 and “Removing user accounts from an on-premises BlackBerry Enterprise Server” on page 239.

About this task

To begin the activation process, a one-time activation password is created in the service. You can create this activation password, or the user can create it.

After creation of the activation password, the user's smartphone is ready to be activated. To activate the smartphone, the activation password and the user's service Internet email address are entered on the smartphone using the Enterprise Activation option.

The following steps are performed to activate a user's smartphone. You can perform these steps, or the user can perform them as described in Using your BlackBerry smartphone with SmartCloud Notes.

Procedure 1. If the smartphone has been used before, perform the following steps. a. Back up any existing data. For instructions, see the BlackBerry Knowledge Base article How to back up the data on a BlackBerry smartphone. b. Wipe the smartphone. For instructions, see the BlackBerry Knowledge Base article How to delete all data and applications from the BlackBerry smartphone using the Wipe Handheld option. 2. To begin the activation process, perform the following steps to create an activation password: a. Log on to the service as an administrator. b. If your account has the user role, click Admin > Manage Organization. c. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. d. Under User and Groups, click Users. e. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names.

240 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 f. Click the user's name in the search results. g. Click Manage BlackBerry Smartphone. h. Click Activate Now, create a one-time activation password, and then click Set Password.

Note: Alternatively, the user can create the activation password through the service web site. 3. To activate the smartphone, refer to the following table and perform the steps that are shown for the operating system (OS) version of the smartphone. Activation can take from a few minutes to an hour, depending on the size of the mail file. After performing these steps, look for the Activation Complete message on the smartphone, which indicates that activation is successful.

OS version Steps to activate

OS4, OS5 1. From the Home screen of the smartphone, click Manage Connections and then enable your Mobile Connection. 2. From the Home screen of the smartphone, click Options > Advanced Options > Enterprise Activation. 3. Enter your SmartCloud Notes Internet email address, for example [email protected]. 4. Enter the activation password. 5. Click the track ball and select Activate. Note: Leave the Activation Server Address field blank, if you see it.

OS6, OS7 1. From the Main screen of the smartphone, click Options > Device > Advanced System Settings > Enterprise Activation. 2. Enter the SmartCloud Notes Internet email address, for example [email protected]. 3. Enter the activation password. 4. Click the Activate button.

4. If you backed up data before activating, restore the data now. For information, see the BlackBerry Knowledge Base article How to use BlackBerry Desktop Software to restore data to a BlackBerry smartphone from a backup file. Related tasks: “Providing documentation to your BlackBerry smartphone users” on page 242 BlackBerry® smartphone users with a hosted BlackBerry subscription can activate and manage their smartphones themselves using options available through the service website at http://www.ibmcloud.com/social. To help users perform these tasks and to troubleshoot problems, point them to the user documentation. Ensuring that mail encryption is available for BlackBerry smartphone users To encrypt and sign mail with a BlackBerry® smartphone, a user’s IBM Notes ID file must be uploaded to the ID vault in the service.

Chapter 6. Onboarding users 241 About this task

A Notes ID file is uploaded to the ID vault automatically under the following circumstances: v A user connects to the service with a Notes client. The ID is uploaded to the vault at some point afterward. v An ID is imported in the user’s mail file and the mail file is transferred to the service. The ID is uploaded to the vault during user provisioning. If neither circumstance applies, administrators can use SmartCloud Notes Administration to upload an ID file to the vault. After the ID file is uploaded, the smartphone prompts the user for the password. After that point, the user no longer provides a Notes password. The user provides only the smartphone password. Related tasks: “Uploading a Notes ID to the vault” on page 269 In a hybrid environment, if a service user has an IBM Notes ID file, the ID must be stored in the ID vault in the service. In some cases, for users who have a Notes ID, but who will not use the Notes client, you might need to upload the Notes ID to the vault manually. If it is not stored in the vault, web client, Notes Traveler, and BlackBerry® smartphone users cannot perform secure mail operations. Other limitations also apply, as outlined in this topic. Providing documentation to your BlackBerry smartphone users BlackBerry® smartphone users with a hosted BlackBerry subscription can activate and manage their smartphones themselves using options available through the service website at http://www.ibmcloud.com/social. To help users perform these tasks and to troubleshoot problems, point them to the user documentation.

About this task

BlackBerry smartphone users can perform the following tasks themselves: v Activate a smartphone v Reactivate a smartphone to correct a problem v Activate a different smartphone v Wipe a smartphone

Instructions for performing these tasks can be found in the “Using your BlackBerry smartphone with SmartCloud Notes ” section of the user documentation.

Note: For information on using a BlackBerry® 10 device, see the Notes Traveler documentation for SmartCloud Notes. Related information:

Using your BlackBerry smartphone with SmartCloud Notes

Notes Traveler documentation

242 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 7. Administering user accounts

Though IBM is responsible for the administration and maintenance of the mail servers, there are tasks that you perform through an administration interface at http://www.ibmcloud.com/social. About this task

You must have the Administrator role assigned in a user account to perform most administration tasks. An exception is resetting the service login password for a user account, which can also be performed by someone with the Admin Assistant role.

Best practices for maintaining your on-premises environment Follow these best practices to help ensure that your on-premises environment remains properly configured to work with the service. Table 74. Best practices for maintaining your on-premises environment Best practice More information Run the Configuration Test tool about once a This tool detects problems with your month. on-premises configuration that can prevent proper operation of the service.

If an error in your on-premises configuration is reported, after you fix the problem that caused the error, download and run a new copy of the Domain Configuration tool on-premises. Running the tool can fix many problems with your on-premises configuration.

For more information, see the topics “Running configuration tests” on page 99 and “Downloading and running the Domain Configuration tool” on page 94. Follow the guidelines for maintaining For more information, see the server on-premises Domino servers. maintenance checklist topic in the Domino documentation. Do not delete or modify the following The Domain Configuration tool creates these entries in the ACL of any synchronized ACL entries. Download and run the tool to directory: ensure that these ACL entries are correct. v Entries for your on-premises directory If these ACL entries are missing or modified, synchronization servers directory synchronization fails and user v The LLNServers group entry provisioning fails. v The SaaSLocalDomainServers group entry. Change on-premises hub servers through Do not edit the CustomerMailHubs group administration Account Settings. For example, change a mail hub server through the Account Settings > Mail Routing Server administration page. Then download and run the Domain Configuration Tool to update your on-premises configuration.

© Copyright IBM Corp. 2011 243 Table 74. Best practices for maintaining your on-premises environment (continued) Best practice More information Do not delete or edit the following groups These groups are created and maintained by that the service creates in a synchronized the service. directory: LLNServers LLNMailHubs CustomerMailHubs Do not create groups with the following These names are reserved for use in the names: service. LLNServers LLNMailHubs CustomerMailHubs

Do not create groups with names that begin with Certifiers_ or SAAS. Disable the advanced ACL setting Enable If this setting is enabled, directory Extended Access in any synchronized synchronization fails. If the directory is used Domino directory. for provisioning, user provisioning fails. To move a synchronized directory to another Follow these steps: server or to change the file name of a 1. Move the directory or change the file synchronized directory, follow the correct name on-premises. procedure. If you are moving the directory, from Notes select File > Replication > New Replica to create a replica at the new location. 2. In the Directory Sync Server Configuration page of SmartCloud Notes Administration, update the existing entry for the directory to match the new on-premises server location or file name. Important: Do not delete the existing entry and create a new one. If you do, all directory documents are deleted and then re-created, a process that can take multiple days to complete. 3. Download and run the Domain Configuration tool. To delete a synchronized directory, follow To delete a synchronized directory, follow the correct procedure. these steps: Note: If you are moving a directory, do not delete it. 1. In the Directory Sync Server Configuration page of SmartCloud Notes Administration, open the entry for the directory and click Remove. 2. Download and run the Domain Configuration tool. 3. Delete the directory on-premises.

244 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 74. Best practices for maintaining your on-premises environment (continued) Best practice More information In environments with multiple Domino If two policies have the same name, the domains that use policies, do not use the service uses one only, which can cause same policy name in more than one domain unexpected, incorrect results. directory. The Domain Configuration tool warns you when duplicate policy names are found. In environments with multiple Domino If a group name in a mail file ACL matches domains, do not a use the same group name two on-premises groups, the one ACL entry in more than one synchronized directory. controls access for members of both groups.

If mail groups have the same name, users must choose which one to use each time they send mail to the group name. Using unique group names avoids this step.

The Domain Configuration tool warns you when duplicate group names are found. In environments with multiple Domino If sites in two domains have the same name, domains that use Resource Reservations, do the service lists resources from both sites not use the same site name in more than one under one site name. This situation can lead domain. users to reserve resources at the wrong site. See Technote 1473022 for instructions on making site names unique.

The Domain Configuration tool warns you when duplicate site names are found. Keep public key checking disabled on the If public key checking is not disabled, mail following on-premises servers: routing and free-time lookups fail. To v Mail hub servers that route mail directly disable public key checking on a server: to the service 1. Open the Server document in the v Mail servers of on-premises users that Domino directory in edit mode. look up the free-time of service users 2. Click the Security tab. 3. In the Compare public keys field in the Security Settings section, select Do not enforce key checking then click OK. Continue to use your on-premises SMTP When users on the Internet send mail to gateway server to route incoming mail. service users, the mail is sent to an on-premises SMTP server. From there it is routed to the service over NRPC. If the SMTP server is not available, service users cannot receive mail from the Internet.

For more information, see the topic “Preparing to route mail to service users” on page 55 For mail hub servers that route directly to For more information, see “Preparing to the service, configure the retry interval and route mail to service users registered in the multiple transfer threads for optimum mail on-premises hub domain” on page 55 and routing performance. “Preparing to route mail to service users in a secondary domain” on page 57.

Chapter 7. Administering user accounts 245 Changing user mail file templates You can change the mail file template assigned to a user. For example, change the mail template if the IBM Notes client of a user is upgraded to a new version. Before you begin

Make sure that users are offline when you change their templates. About this task

When you change a user's mail file template, custom folders in the mail file inherit the design of the Inbox folder. Custom folders are user-created folders or company-created folders from a custom template that is used in the service.

Note: If you change the languages of a user's IBM SmartCloud Notes subscription, you then also need to change the language of the mail file template. Procedure 1. Log on to http://www.ibmcloud.com/social using the email address and password of a SmartCloud Notes user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Select the name of each user to change to a specific template. You can search for and select more names; previously selected names remain selected. 7. Click Apply Mail Template. 8. Select the template to use. 9. Click Apply Mail Template. 10. Click Confirm. 11. Click Continue.

246 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Related information:

Integration server and user provisioning change files

Viewing assigned mail file templates You can view the mail file template that is assigned to a service user. About this task

If only the template ID displays in the field, the template assigned to the user has been removed from the template repository. Although the user's mail file is not affected, you should assign a new template. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Look in the Mail Template field, which includes the following information: v Name v Version v Language v Template ID number Related concepts: “Language versions of the standard mail file template” on page 248 The mail file template supported in the service is the IBM Notes Standard 8.5 template (STDR85Mail). This topic lists the languages in which this template is provided.

Chapter 7. Administering user accounts 247 Related tasks: “Configuring mail file templates” on page 164 Configure which mail file templates can be applied to user mail files and configure a mail file template to use by default. Language versions of the standard mail file template The mail file template supported in the service is the IBM Notes Standard 8.5 template (STDR85Mail). This topic lists the languages in which this template is provided. v English (en) v Arabic (ar) v Catalan (ca) v Czech (cs) v Danish (da) v German (de) v Greek (el) v Finnish (fi) v French (fr) v Hebrew (he) v Hungarian (hu) v Italian (it) v Japanese (ja) v Korean (ko) v Dutch (nl) v Norwegian (no) v Polish (pl) v Portuguese (pt) v Portuguese, Brazil) (pt_BR) v Russian (ru) v Slovak (sk) v Slovenian (sl) v Swedish (sv) v Thai (th) v Turkish (tr) v Chinese, China (zh_CN) v Chinese, Taiwan (zh_TW) v Spanish (es)

Assigning extension forms files to users After an IBM representative uploads an approved extension forms file to the service, you can assign the forms file to users. Extension forms file enable you to customize the visual theme, fonts, the action bar, and other aspects of the web client.

248 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 About this task

You can assign extension forms files to users explicitly. You can also assign extension forms files to users implicitly by setting a default extension forms file.

The following topics describe how to use IBM SmartCloud Notes Administration to assign extension forms files. You can also use user provisioning change files and the IBM Connections Cloud integration server. For more information, see the integration server section of the Connections Cloud documentation. Related tasks: “Using extension forms files to customize the look of the web client” on page 165 You can use an extension forms file to customize the visual theme, fonts, the action bar, and other aspects of the web client. For example, you can add graphics, change colors, and add new menu items. Related information:

IBM Connections Cloud documentation Setting a default extension forms file Optionally set a default extension forms file that applies to all current and future web client users who are not explicitly assigned an extension forms file. Before you begin

An IBM representative must upload the approved extension forms file to the service. About this task

If you do not specify a default extension forms file, users without an explicit extension forms file see the default service behavior. The default service behavior is similar to IBM iNotes 9.0. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Extension Forms Files. 5. Select the forms file and click Set as Default. Results

The change takes effect the next time web client users log in to the service.

In the list of files in the Extension Forms Files page, the text [default] is shown after the file name. The file is also shown in the Defaults page, in the Default Extension Forms File section.

To see whether a user uses the default forms file, from SmartCloud Notes Administration, click Users and select the name of the user. If the user uses the default extension forms file, the value of the Forms extension field is Default (forms file), where forms file is the name of the default extension forms file.

Chapter 7. Administering user accounts 249 You can disable a default extension forms file and revert to the default service behavior. To do so, perform this procedure and in the last step select None in the files list and click Set as Default. The extension forms file remains available and you can re-enable it as the default at any time. Explicitly assigning an extension forms file to many current users You can assign a forms file to all current users, to users who are explicitly assigned a different extension forms file, or to users who are not explicitly assigned an extension forms file who use the default behavior. Before you begin

An IBM representative must upload the extension forms file to the service. About this task

To apply an extension forms file during user provisioning, see the user provisioning topics, instead. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Extension Forms Files. 5. Select the extension forms file to assign and click Apply to Users.

Note: To remove an explicit forms file assignment and revert to the default forms file or the default service behavior, select None [default]. 6. Perform the steps in the following table that correspond to your objective. Table 75. Steps to assign an extension forms file to many users Objective Steps Assign to all users in the service. Click Apply to > All users. Note: An alternative approach is to set a default extension forms file. A default file is used by all current and future users who are not assigned an extension forms file explicitly.

Assign to all users who are not currently 1. Click Apply to > Users of a different assigned to the selected forms file. extension forms file. 2. Select the current extension forms file of the users.

Assign to all users who are not explicitly 1. Click Apply to > Users of a different assigned an extension forms file. extension forms file. 2. Select None (default).

7. Click Apply.

250 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Results

If you click Cancel or close the window before the changes are complete, the change is cancelled only for users not yet processed.

The extension forms file changes take effect the next time the web client users log in to the service.

If you click Users from SmartCloud Notes Administration and select the name of a user, the Forms extension field shows the extension forms file. Related tasks: “Provisioning users without transferring mail files” on page 219 This procedure adds an IBM SmartCloud Notes subscription to a user account and creates a new mail file for the user on a mail server in the cloud. You can also add optional subscriptions purchased by your company. “Provisioning users and mail files” on page 224 If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes. Explicitly assigning an extension forms file to individual current users You can explicitly assign an extension forms file to individual current users. The explicit assignment overrides the default behavior for your company. Before you begin

An IBM representative must upload the extension forms file to the service. About this task

To apply an extension forms file during user provisioning, see the user provisioning topics, instead. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. Display the names of the users to whom you want to assign the forms file. In the Search box, type the beginning characters of any of the following user values: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations

Chapter 7. Administering user accounts 251 v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Select the names of the users from the search results. 7. Click Apply Extension Forms File. 8. Select the file and click Apply. Results

If you click Cancel or close the window before the changes are complete, the change is cancelled only for users not yet processed.

The extension forms file changes are visible the next time the user uses the web client to log in to the service.

If you click Users from SmartCloud Notes Administration and click a user name to see details about the user, the Forms extension field shows the extension forms file.

To remove an explicit extension forms file assignment, repeat the procedure and in the last step select None in the list of file names and click Apply. Users then use the default extension forms file, if specified, or the default service behavior. Related tasks: “Provisioning users without transferring mail files” on page 219 This procedure adds an IBM SmartCloud Notes subscription to a user account and creates a new mail file for the user on a mail server in the cloud. You can also add optional subscriptions purchased by your company. “Provisioning users and mail files” on page 224 If you are transferring user mail files to the service with the assistance of an IBM partner, after the transfer manager imports a batch of users and mail files into the service, you can provision the users for IBM SmartCloud Notes.

Resetting service login passwords Users can reset their own service login passwords once within a 24 hour period by clicking Forgot password?. An administrator or administrator assistant can reset service login passwords for any user at any time. About this task

Reset passwords when userd forget their passwords, or when the password might be compromised. Users that log in by clicking Use My Organization's Login are using a federated identity and can reset their passwords only by following their company's process.

If administrators enable password synchronization, when users change their service login passwords, they can also use the new passwords to log in to the IBM Notes client.

252 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Follow these steps to reset any user's password: Procedure 1. Click Administration > Manage Organization. 2. Click User Accounts. 3. Select the arrow next to the user that needs the password changed. 4. Select Reset password and enter the new password. This password is a temporary password that the user enters the next time that they log in. At that time, the user is asked to create a password. You can also reset the password by editing the user account. Click the appropriate user name in User Accounts and enter a new password in the Account Login tab. 5. Notify the user of the password change. The user is not automatically notified that the password was reset. Make sure to communicate this change to the user, along with the new password if needed. What to do next

Administrators can enable security settings to enforce password expiration through System Settings > Security. When s user logs in with an expired password, the user is prompted to reset that password.

Resetting passwords for Notes IDs Reset the password on an IBM Notes ID file to change the current password. Typically you do this because a user has forgotten the current password. About this task

This procedure applies only to passwords associated with Notes ID files used with Notes clients, and not to service login passwords. Procedure 1. Log on to http://www.ibmcloud.com/social using the e-mail address and password of a SmartCloud Notes user with the Administrator role. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver

Chapter 7. Administering user accounts 253 This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Under Available actions for this user, click Reset IBM Notes Password. 8. Enter a new password, and then click Save Changes. The password must be at least eight characters in length. 9. Provide the new password to the user in a way that complies with your company security policies. Results

After you complete this procedure, the user can log on to a SmartCloud Notes server from an IBM Notes client using the new password. After logging on with the new password, the user is prompted to change the password.

Note: If the Wrong Password prompt is displayed, tell the user to re-enter the new password that you provided. If that step does not solve the problem, tell the user to delete the local ID file and then re-enter the password.

The user has five days from the time you reset a password to use the password to log on to a SmartCloud Notes mail server and download the new password to the Notes client. If the 5-day limit is exceeded, the user sees the following message and you must reset the password again:

Contact your company administrator to have your Notes ID password reset. Related concepts: “Notes IDs and passwords” on page 130 When users connect to their mail servers in the cloud with IBM Notes clients and Notes IDs, they are authenticated using Notes Remote Procedure Call (NRPC) authentication. Related tasks: “Resetting service login passwords” on page 124 Users can reset their own service login passwords once within a 24 hour period by clicking Forgot password?. An administrator or administrator assistant can reset service login passwords for any user at any time. “Setting password expiration for Notes IDs” on page 126 For users who access the service with the IBM Notes client, you can specify when Notes ID passwords expire. This password expiration does not apply to web users because they log in using their web login password rather than a Notes ID password. “Enabling password synchronization” on page 128 When users change their service login passwords, password synchronization enables the users to use the new passwords when they log in to the IBM Notes client.

254 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Changing a Notes user name In a hybrid environment, you use the Domino Administrator client on-premises to change a user's Notes name. The steps initiate a series of administration process requests. Before you begin

Important: Read the topic “Rules to follow when you change a Notes name” on page 257. It is important to understand these rules before you continue. About this task

After you initiate a rename on-premises, the change replicates to the service. Then, the rename is initiated for the servers in the service as well. This process changes the Notes user name, but does not change the name in the Connections Cloud user account. You or the user change the name in the user account. Procedure 1. From the IBM Domino Administrator client, on a server whose directory you synchronize with servers in the service, perform the steps that correspond to your goal. Table 76. Steps to change a user's names Goal Steps You want to change any of the following Tools > People > Rename > Change names: Common Name v Common name, for example, change For more information, see the topic about Samantha Daryn/Renovations to Samantha Brown/Renovations renaming a Notes user's common or alternate name in the Domino v Alternate name documentation. v Short name Important: If you want to change multiple names for one user, do so in one rename operation. If you want to change a name and the Internet address, do so as part of one rename operation. You want to change the certifier portion of Tools > People > Rename > Request Move the name. For example, change Samantha to New Certifier Daryn/Renovations to Samantha Daryn/PowerRenovations. Optionally, you For more information, see the topic about also want to change any of the following moving a user name in the name hierarchy values: in the Domino documentation. v Common name v Alternate name v Short name v Internet address Important: If you want to change the certifier name and other names or the Internet address for one user, do so as part of one rename operation.

2. Optional: If you changed the common name or Internet address, optionally edit the user account to match:

Chapter 7. Administering user accounts 255 Note: Users can change their common names themselves by editing the My Account Settings page. Users cannot change their own login email addresses. a. Log on to the service as an administrator. b. If your account has the user role, click Admin > Manage Organization. c. Click User Accounts, click the arrow next to the account to edit, and select Edit User Account. d. In the User Information tab, update one or both of the name fields. e. If you changed the Internet address, in the Account Login tab, optionally update the Email field to match the new address. The Email field serves only as the identity used to log in to the service from a browser; the SmartCloud Notes service uses the Internet address field in the Person document to determine the Internet address for mail routing. Results

The following table provides an estimate of the time required to complete each type of name change and how to determine whether the change is complete. Table 77. Rename time estimate and verification Type of name change Rename completion Notes name change The Notes name change is usually complete in about a day. However, because renaming is a multi-step sequential process, a delay in any step can cause the rename to take longer. While the name is being changed, the current user name remains valid.

When a rename is complete, the change is visible in the following places: v Directories1,2, database ACLs, and groups that include the name on servers in the service and on-premises servers. v Web client navigation pane and new mail messages. v The User name field in the Notes client login window. v The user's mail file ACL. v The Users page in SmartCloud Notes Administration.2

1 New short name or alternate name is visible here.

2 New Internet address is visible here. User account name change The change occurs immediately after an administrator or user edits the user account. A new name and email login address display the next time that the user logs in from a browser.

What to do next

If the name of a mail file delegate changes, the mail file owner must reassign delegation to the new name. Doing so updates the mail file ACL to allow the delegate access under the new name.

256 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Related information:

Domino documentation Rules to follow when you change a Notes name When you change a user’s Notes name, you must follow these rules. v If you want to change multiple parts of a user's name, do so in one rename request. Do not issue one request to change a common name and then a separate request to change a certifier name. For example, change Samantha Daryn/Renovations to Samantha Brown/Power Renovations with one rename request. v To change both a user's name and Internet address, change the Internet address as part of the rename request. Do not issue a rename request for the name change and then edit the Person document separately to change the Internet address. v Never start a second rename until the first rename is complete, for example, if you make a mistake in a rename request. Wait until the first rename is complete and the user accesses the service under the first changed name before you rename the user again. If the first rename is not complete, fields with names that begin with AdminpOld remain in the Person document. v Never change the Notes name by editing the name manually in the Person document. Instead, always initiate the name change through the Domino Administrator client. When you use the Domino Administrator client, the Administration Process makes the changes throughout your environment and required directory changes can replicate to the service during directory synchronization. v Never rename a user who is being provisioned or whose mail is being transferred to the service. Wait until the user accesses the SmartCloud Notes service at least one time under the current name before you rename the user. v If a rename does not complete within a reasonable amount of time, contact SmartCloud Notes Support. Do not remove the user account, the SmartCloud Notes subscription, or the Person document and attempt to re-create a user. v After you start a rename of a Notes client user, tell the user not to switch to a Location document that refers to an on-premises mail server. Doing so can cause the user to accept the new name on-premises rather than in the service, which is not allowed. v Never rename a user at the same time that you change the user’s Domino domain. v If the user has a Notes ID file and uses it in the service, the ID file must be stored in the service ID vault before you rename the user. To determine whether a user ID is stored in the vault, open SmartCloud Notes Administration, click Users, search for the user page, and look at the Notes ID file field. If the ID is not in the vault, an administrator can upload the ID file to the vault manually from the user page in SmartCloud Notes Administration. v If the rename includes a move to a different certifier, verify that the directory contains a Vault Trust Certificate issued from the new certifier (or an ancester of the certifier) to the service ID vault. If such a certificate does not exist, create one and wait for directory synchronization to replicate it to the service before you rename the user. v A web client user, Notes Traveler user, or BlackBerry® user can have a Notes ID file that is never used in the service and that is not stored in the service ID

Chapter 7. Administering user accounts 257 vault. Before you rename a user such as this, either upload the ID to the vault or delete the public key information from the following fields in the user’s Person document: – Certificate – CertificateExpiration – CertificateIssuer v If the name of a mail file delegate changes, the mail file owner must reassign delegation to the new name. Doing so updates the mail file ACL to allow the delegate access under the new name. Related tasks: “Uploading a Notes ID to the vault” on page 269 In a hybrid environment, if a service user has an IBM Notes ID file, the ID must be stored in the ID vault in the service. In some cases, for users who have a Notes ID, but who will not use the Notes client, you might need to upload the Notes ID to the vault manually. If it is not stored in the vault, web client, Notes Traveler, and BlackBerry® smartphone users cannot perform secure mail operations. Other limitations also apply, as outlined in this topic. “Issuing a Vault Trust Certificate” on page 101 You must issue a Vault Trust Certificate from a parent certifier of service users’ Notes ID files to the certifier of the service ID vault. This step is a prerequisite for user provisioning.

Changing an Internet email address Use this procedure to change a user's Internet email address if you are not also changing the user's Notes name. About this task

There are two places that an Internet address is used. The SmartCloud Notes service uses the Internet address in the Person document for Internet email addressing and delivery. In addition, there is an Internet address in the Email field in the service user account. This address is the account identity used to log in to the service with any subscription from a browser. Changing the value of the Email field to match the new Internet email address in the Person document provides a consistent experience for the user.

Important: If you are changing both the Notes name and Internet address, complete the steps for changing a Notes user name, instead. Procedure 1. To change the Internet email address in the on-premises Domino directory if you are not also changing the Notes name: a. From an on-premises Domino Administrator, open the Domino directory in which the user is registered. b. From the People view, select the user's Person document. c. Click Edit Person. d. In the Basics tab, in the Mail section, change the address in the Internet address field. e. Click Save & Close. f. Wait for the change to replicate to the service during directory synchronization.

258 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Tip: To verify that the change has been made in the service, open the Users page in SmartCloud Notes Administration, search for the user, and in the user page look at the Internet address field. 2. To change the account login identity to match the new Internet email address: a. Log in to the service as an administrator. b. If your account has the user role, click Admin > Manage Organization. c. Click User Accounts. d. Click the arrow next to the user account to change and select Edit User Account. e. Click Account Login. f. In the Email field, click change. g. In the New email address field, provide the new address and click Finish. What to do next

Provide the user with their new address and account login identity. Related tasks: “Changing a Notes user name” on page 255 In a hybrid environment, you use the Domino Administrator client on-premises to change a user's Notes name. The steps initiate a series of administration process requests.

Removing a SmartCloud Notes subscription from a user account When you remove a SmartCloud Notes subscription from a user's account, the subscription is available for another user. The account identity still exists, unless you delete the user account, and is still active, unless you suspend the user. The user can still log in to the cloud service, but the user no longer has access to SmartCloud Notes. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the name of the user to edit the user account settings. 5. Click Next to select the Subscriptions tab. 6. Perform one of the following steps: v If the user has more than one subscription, select Customize the subscriptions for this user and in the Mail field select None selected. v If the user has only a SmartCloud Notes subscription, select None. 7. Click Next and then Finish. 8. The Edit User Summary window indicates that subscription removal is in progress. When you click Back to User Accounts, SmartCloud Notes is removed from the Subscription column for the user. Results v The subscription is no longer assigned and is available for another user. v The mail file becomes inactive. The owner, or a user who has delegation access, cannot open it. Mail is no longer delivered to the mail file.

Chapter 7. Administering user accounts 259 v User data (including the mail file and vaulted Notes ID) remains on the servers in the service for 30 days. To see whether a user's data is still in the service, from SmartCloud Notes Administration, click Users and then Deleted Users.If the user's name is listed, the data is still in the service. You can force the data to be deleted by clicking Delete Data. What to do next

If you want to add the subscription to the user account once again, be aware of the following considerations: v If you removed the user's SmartCloud Notes subscription and the user name is still shown in the Users > Deleted Users page of SmartCloud Notes Administration, the user data is still in the service. In this case, to add back the subscription, you edit the Connections Cloud user account. The user regains access to the mail file and the name is removed from the Deleted Users page. v If you removed the user's SmartCloud Notes subscription and the user name is no longer shown in the Users > Deleted Users page, the user data has been removed from the service. In this case, to add back the subscription, you must provision the user again through SmartCloud Notes Administration. The user starts with a new mail file, unless you transfer the mail file to the service before you provision the user. Related tasks: “Deleting a user account” on page 261 When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality. “Suspending a user account” You can suspend a user account. When an account is suspended, the user cannot log in to the service. If the user is logged in at the time the account is suspended, the user can continue working, but cannot log in again after logging out. No subscriptions are available to the user, but they remain assigned to the user. Also, the user identity and user data remain on servers in the service. Related information:

Integration server

Suspending a user account You can suspend a user account. When an account is suspended, the user cannot log in to the service. If the user is logged in at the time the account is suspended, the user can continue working, but cannot log in again after logging out. No subscriptions are available to the user, but they remain assigned to the user. Also, the user identity and user data remain on servers in the service. About this task

Use these steps to suspend a user account, which affects all subscriptions assigned to a user.

If a user has other subscriptions that you want to remain available to the user, a Customer Service Representative can suspend a subscription, rather than suspending an entire account. In that case, the user can log in to the service and there is no interruption to other subscriptions.

260 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the arrow next to a user name and then click Suspend. Results

The following results occur when a user account is suspended: v Subscriptions remain assigned, and cannot be assigned to other users. v The user cannot log in and is not listed in the company directory. v The mailbox becomes inactive and the owner cannot open it. However, someone who has delegation access to the mail file can open it. v Mail is not delivered to the mailbox. v You can reset the user account password.

Note: To return a suspended account to active status, edit the user account using the previous steps, and in Step 4, click Unsuspend Account. When the account is returned to active status, the mail file is once again available to the user. Related information:

Integration server

Deleting a user account When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the arrow next to a user name and then select Delete User. 5. Optional: Enter the email address of a user in your organization to whom you want to transfer the deleted user's collaboration resources, such as files.

Note: You cannot transfer ownership of the mail file. 6. Click Trash. Results

The user whose account is deleted can no longer log in to the service. If the user is logged in at the time of account deletion, he or she can continue to use the service until the session expires.

Up to 30 days from the initial account deletion, the following conditions exist: v The user account has the status Trash in the User Accounts page. v The mail file is inactive and cannot be opened by the owner, or by another user who has delegation access to the mail file. Mail is not delivered to the mail file.

Chapter 7. Administering user accounts 261 v The subscriptions associated with the deleted account cannot yet be assigned to other users. v The user data remains in the service. If you deleted the account by mistake, you can restore the account to full functionality, including mail. v You can permanently delete the account to remove the user data and free the subscriptions to be assigned to other users.

31 to 90 days from the initial account deletion, the following conditions exist if you did not permanently delete the account: v The account is no longer visible and you cannot restore it or permanently delete it. v An IBM customer service representative can restore the account. v The subscriptions associated with the deleted account cannot yet be assigned to other users.

After 90 days from the initial account deletion, the account is permanently deleted and the following conditions exist: v The account subscriptions can be assigned to other users. v The user data for collaboration subscriptions is permanently deleted. v The SmartCloud Notes user data, such as the mail file, remains for 30 more days. You can permanently delete this data yourself, if you do not want to wait the 30 days.

Note: While the SmartCloud Notes data remains, you cannot create a user account with the same common name and email address as that of the deleted account.

After 120 days from the initial account deletion, SmartCloud Notes user data is permanently deleted, if it was not deleted previously. Related tasks: “Restoring a deleted user account” on page 263 After you delete a user account, you have up to 30 days to restore it if you change your mind. Restoring the account returns it to full functionality, including full mail file access. “Permanently deleting a user account” on page 263 After you delete an account, it remains inactive in the service, and you have 30 days to restore it. If you are sure that you will not need to restore the account, you can permanently delete it within 30 days of the initial account deletion. Permanently deleting an account frees its subscriptions for other users. “Removing the SmartCloud Notes data for a deleted user account or subscription” on page 264 After a user account is permanently deleted or an IBM SmartCloud Notes subscription is removed from a user account, the SmartCloud Notes data such as the mail file remains for 30 days. Use this procedure to force the deletion of the user data from the service, if you do not want to wait the 30 days. Related information:

Integration server

262 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Restoring a deleted user account After you delete a user account, you have up to 30 days to restore it if you change your mind. Restoring the account returns it to full functionality, including full mail file access. About this task

An IBM customer service representative can restore a user account up to 90 days after the account deletion. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Select Status in the drop-down box and then select Trash to show the deleted user accounts that can be restored. 5. Click the arrow next to the user name and select Restore User. 6. In the window that is shown, click Restore. Related tasks: “Deleting a user account” on page 261 When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality.

Permanently deleting a user account After you delete an account, it remains inactive in the service, and you have 30 days to restore it. If you are sure that you will not need to restore the account, you can permanently delete it within 30 days of the initial account deletion. Permanently deleting an account frees its subscriptions for other users. About this task

You cannot restore an account after you permanently delete it. If there is a chance you might need to restore the account, do not complete this procedure.

A user account is permanently deleted automatically 90 days after the initial account deletion. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Select Status in the drop-down box and then select Trash. 5. Click the arrow next to the user name and then select Delete User. 6. Optional: Enter the email address of a user in your organization to whom you want to transfer the deleted user's collaboration resources, such as files.

Note: You cannot transfer ownership of the mail file. 7. Click Delete.

Chapter 7. Administering user accounts 263 Results v The account cannot be restored. v The subscriptions associated with the account are free to be assigned to other users. v The SmartCloud Notes data such as the mail file remains for 30 more days and is automatically deleted after that period. You can delete this data before then yourself. While this data remains, you cannot create a user account with the same common name and email address as that of the deleted account. What to do next

If you want to permanently delete the SmartCloud Notes data immediately, complete the procedure “Removing the SmartCloud Notes data for a deleted user account or subscription.” Related tasks: “Deleting a user account” on page 261 When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality. “Restoring a deleted user account” on page 263 After you delete a user account, you have up to 30 days to restore it if you change your mind. Restoring the account returns it to full functionality, including full mail file access.

Removing the SmartCloud Notes data for a deleted user account or subscription After a user account is permanently deleted or an IBM SmartCloud Notes subscription is removed from a user account, the SmartCloud Notes data such as the mail file remains for 30 days. Use this procedure to force the deletion of the user data from the service, if you do not want to wait the 30 days. About this task

In most situations, there is no need to force the deletion of the SmartCloud Notes data. However, if an account is permanently deleted and you want to create a new account that uses the same email address and common name, the SmartCloud Notes data must first be deleted.

You can delete the data of a user whose SmartCloud Notes subscription was removed but who still has a user account. However, do so with caution; to add back the SmartCloud Notes subscription, you must provision the user again through SmartCloud Notes Administration. In this case, the user starts with a new mail file, unless you transfer an on-premises mail file before you provision the user again. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. In SmartCloud Notes Administration, under Users and Groups, click Users. 5. In the navigation pane, click Deleted Users.

264 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 6. Optional: To search for a name if many users are listed, type the beginning characters of any of the following user values: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 7. Click Delete Data next to the name of the user whose data you want to remove, and then confirm the deletion. Results

The user data is removed from the service and the user name is removed from the Deleted Users page. Related tasks: “Deleting a user account” on page 261 When you delete a user's account, the user no longer has access to any cloud services. If you change your mind about the deletion, you have up to 30 days to restore the account to full functionality. “Permanently deleting a user account” on page 263 After you delete an account, it remains inactive in the service, and you have 30 days to restore it. If you are sure that you will not need to restore the account, you can permanently delete it within 30 days of the initial account deletion. Permanently deleting an account frees its subscriptions for other users. “Removing a SmartCloud Notes subscription from a user account” on page 259 When you remove a SmartCloud Notes subscription from a user's account, the subscription is available for another user. The account identity still exists, unless you delete the user account, and is still active, unless you suspend the user. The user can still log in to the cloud service, but the user no longer has access to SmartCloud Notes.

Moving users to different Domino directories You can move the Person document of a user who is currently provisioned in the service to a different Domino directory. About this task

If an on-premises Notes rename request is underway for a user, wait until the request is complete before moving the user’s Person document.

Chapter 7. Administering user accounts 265 Procedure

Copy the Person document to the new Domino directory and then delete the original Person document. Follow these guidelines: v Move a Person document only to a Domino directory that is used for provisioning. In other words, move a Person document to a full Domino directory that is listed in the Directory Sync Server Configuration window of SmartCloud Notes Administration. The Do not use this Domino Directory for user provisioning must not be selected for the directory. v If you want to change the values of the following fields in the new Person document, do not do so yet. These values must be the same as in the original Person document while the move of the Person document is underway. You can change the value of any other field. – First name (FirstName) – Middle name (MiddleInitial) – Last name (LastName) – User name (FullName) – Internet address (InternetAddress) – Domain (MailDomain) v The deletion of the original Person document can replicate to the service before the addition of the new Person document, or vice versa. The replication order is not important. v The document identifier value of the new Person document will be different from the one in the original Person document. A document identifier, for example Notes:///632576F5004E65D4/85255E01001356A8852554C200753106/ 14BD98F6358E2E818525785C0041046, is displayed in Notes document properties. What to do next

If you want to change the user name, Internet address, or Domino domain name, contact Support before you do so. Support must verify that the Person document change is complete in the service before you make these changes. After Support confirms that the Person document change is complete, make the additional changes. v If you want to change the Domino domain name, do so before you change the user name or Internet address. To change the domain, edit the Domain (MailDomain) field. v To change the user name, follow the documented procedure for changing a Notes user name. Do not edit name fields directly in the Person document. Related tasks: “Changing a Notes user name” on page 255 In a hybrid environment, you use the Domino Administrator client on-premises to change a user's Notes name. The steps initiate a series of administration process requests. “Configuring directory synchronization” on page 89 A directory server in the service has a replica of one or more on-premises IBM Domino directories. To support directory synchronization, provide the name of the primary server and file path of at least one on-premises directory that you want to synchronize. The directory server performs a regular pull and push replication of the directories to keep the contents of both the service and the on-premises replicas synchronized.

266 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 “Contacting Support” on page 303 If you are unable to resolve a problem, contact Support.

Converting a service user to an on-premises user in a hybrid environment If you use a hybrid environment, you can convert a service user to an on-premises user. Conversion removes the SmartCloud Notes subscription from the user account. You then switch the user to a Domino mail server at your company site. About this task

Steps1-5inthis procedure assume that you want to create a replica of the current SmartCloud Notes mail file on your on-premises server. By creating a replica, you preserve the current content of the mail file. However, replicating the mail file is not required. You can instead convert the user to a new mail file or to an existing mail file that you have on-premises. In this case, substitute Steps1-5with your own procedure to create the user mail file on your server.

After users are converted to on-premises mail servers, they cannot be delegates for the mail files of service users.

Perform the following steps to convert a service user to an on-premises user. Procedure 1. Perform the following steps to create a local replica of the service mail file on an IBM Notes client that can connect to the service:

Note: The owner of a mail file who uses a managed mail replica already has a local mail file replica and can skip this step. a. Make sure that you have a SmartCloud Notes subscription with the User role. b. From the Notes client, log on to the service using a Notes ID that has access to the mail file in the service. The IDs of the following users have access to the mail file: v The owner of the mail file v Someone who the owner gives delegate access v Someone who has access through an entry in a customized mail file ACL. c. Open the mail file on the SmartCloud Notes server, following the appropriate procedure in the following table: Table 78. Opening a mail file in the service Person Steps Owner Open your mail file as you normally do. For example, from the home page, click Mail. Delegate Open your mail file as you normally do, then complete the following steps: 1. In the navigation pane, expand Other Mail. 2. Click Open Other Mail. 3. Select the name of the mail file owner from the company directory.

Chapter 7. Administering user accounts 267 Table 78. Opening a mail file in the service (continued) Person Steps Administrator with access to the mail file Determine the mail server name and mail through a custom ACL file name in the service: 1. From SmartCloud Notes Administration, click Users. 2. Click the name of the mail file owner. 3. In the Mail servers field, note the name of the first server that is listed, for example, MAIL16/SCN/RENOVATIONS. 4. In the Mail databases field, note the name of the first database that is listed, for example, data0/20559530/ 20892244.nsf. Open the mail file: 1. From Notes, click File > Open > IBM Notes application. 2. In the Look in field, type the mail server name. 3. In the File name field, type the mail file name. 4. Click Open.

d. From the open mail file, click File > Replication > New Replica. e. Make selections in the Create Replica dialog box: v In the Server field, be sure to select Local. v If you plan to use an operating system command to create the replica on the on-premises server in Step 3, do not select Encrypt the replica using. 2. (Optional) To minimize message loss during the conversion process, perform the following steps to suspend the account for the user. Suspending the account stops mail delivery to the Notes mail file. a. Perform a final replication between the mail file replica on the SmartCloud Notes server and the replica on the Notes client. b. Log on to the service as an administrator. c. If your account has the user role, click Admin > Manage Organization. d. From the navigation pane, click User Accounts. e. Click the arrow next to the name of the user being converted and select Suspend Account.

Note: This step suspends all of the subscriptions that the user has. 3. Replicate the mail file on the client to the on-premises mail server the user is switching to. 4. Adjust the mail file ACL as necessary, for example, to allow access by on-premises servers. 5. Apply an on-premises mail file template to replace the template from the service. 6. Perform the following steps to remove the SmartCloud Notes subscription from the account of the user. a. Log on to the service as an administrator. b. If your account has the user role, click Admin > Manage Organization.

268 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 c. From the navigation pane, click User Accounts. d. If you completed Step 2, click the arrow next to the name of the user to convert and select Unsuspend Account. e. Click the arrow next to the name of the user and select Edit User Account.

Note: If the user has only a SmartCloud Notes subscription, you can instead select Delete user to delete the account. In this case, skip the remaining substeps. f. Click Next to move to the Subscriptions tab. g. Perform one of the following steps: v If the user has more than one subscription, select Customize the subscriptions for this user and in the Mail field select None selected. v If the user has only a SmartCloud Notes subscription, select None. h. Click Next and then Finish.

Note: You can reinstate the account for up to 30 days. To reinstate, add the SmartCloud Notes back to the account, or restore the account, if you deleted it. If you continue to step 7, the 30-day period does not apply; the user is returned to being an on-premises user, and the account cannot be reinstated. 7. To switch the user to an on-premises mail server and mail file, edit the Domino directory Person document of the user as follows: v Change the Mail server field to refer to the on-premises mail server v Change the Mail file field to refer to the on-premises mail file Results

After Step 7 is completed and directory synchronization occurs between the service and the on-premises environment, the user can no longer access the mail file on the SmartCloud Notes server.

Uploading a Notes ID to the vault In a hybrid environment, if a service user has an IBM Notes ID file, the ID must be stored in the ID vault in the service. In some cases, for users who have a Notes ID, but who will not use the Notes client, you might need to upload the Notes ID to the vault manually. If it is not stored in the vault, web client, Notes Traveler, and BlackBerry® smartphone users cannot perform secure mail operations. Other limitations also apply, as outlined in this topic. Before you begin

Make sure that you have a copy of the user's Notes ID file and password.

If you are unsure whether to store a Notes ID in the vault for web client users, read Planning for Notes IDs. About this task

Upload a Notes ID to the ID vault for users who have an ID file, but who do not use the Notes client: v If they are starting with new mail files.

Chapter 7. Administering user accounts 269 v If the mail file was transferred to the service without an imported Notes ID. In this case, if you do not store the ID in the vault, the user cannot read old encrypted messages if there are any.

Note: Alternatively, web client users can upload Notes IDs themselves. For more information, see the topic about importing a Notes ID in the SmartCloud Notes web section of the SmartCloud Notes user documentation.

Typically, this procedure is not necessary in these situations: v For Notes client users, because the ID is automatically uploaded to the vault at some point after the client connects to the service. v For web client users whose existing on-premises mail files were transferred to the service, and whose Notes ID was imported into the mail file before the transfer. In this case, the Notes ID is uploaded to the vault the first time a user performs a secure mail operation, such as signing mail, or reading or sending encrypted mail. v For web client users who never had a Notes ID and who do not want to perform secure operations.

For users who have a Notes ID, if the ID is not stored in the service vault, the following limitations apply: v Web client, IBM Notes Traveler, and BlackBerry® smartphone users cannot perform secure operations, which include signing mail, and reading or sending encrypted mail. v Notes ID password resets and ID recovery are not available. v If a user's name changes, the user's Notes name cannot be changed.

You can also use this procedure to replace a Notes ID in the vault.

Note: You cannot use this procedure to upload an ID file that is enabled for Notes shared login (NSL). To allow the ID to be uploaded manually, disable NSL. Or, use the Notes client with the service, so that the ID file can be uploaded to the vault automatically. For more information about Notes shared login, see the security section of the IBM Domino documentation. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations

270 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Under Available actions for this user, click Upload Notes ID File. 8. Browse for the Notes ID file, and optionally provide the password if one exists. Results

The Notes ID is stored in the vault. Note, however, that the password for the ID is not stored in the vault. Related information:

SmartCloud Notes user documentation

IBM Domino documentation

Viewing subscriptions You can view the subscriptions assigned to existing users, or view the subscriptions that are available to assign to new service users. In addition to the mail service, other subscriptions can include collaboration services. Third-party integrated applications may also display if your organization has enabled them. About this task

Use these steps to view the available subscriptions, and find out how many user accounts are available for each subscription. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click Subscriptions. Viewing assigned subscriptions About this task

To view the subscriptions that are assigned to an existing user, perform the following steps. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Locate the user name. The assigned subscriptions are listed in the Subscription column.

Chapter 7. Administering user accounts 271 Managing IBM Notes Traveler devices For each user with an IBM Notes Traveler subscription, you can view information about the user's mobile device. You can also wipe the device to remove sensitive data from it, for example, if the device is lost or stolen. About this task

Note the following information about wiping a device: v After you issue a wipe request, the device cannot be used with the service again unless you cancel a pending wipe or reactivate the device. v If you remove a user's IBM Notes Traveler subscription, the device information is no longer available in the service and you cannot perform this procedure. In this case, the user can request a device reset through the mobile carrier. v If you cancel a pending wipe, the data is not wiped from the device. v Wipe options can be shown for devices that do not support them. If you select a wipe option, the status field indicates if a device does not support it. v If a wipe is done outside the IBM Notes Traveler service, for example, if a user resets a device, the status is not shown. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Click Users in SmartCloud Notes Administration. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Click Manage IBM Notes Traveler Devices to see information about the user's device such as the name, the time it was last synchronized, and the status of a wipe request.

272 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 If you do not see this option, the selected user does not have a IBM Notes Traveler subscription. 8. To remove data from the device, click one of the following options:

Option Description Wipe Device Select this option to remove the IBM Notes Traveler application and all personal data and settings from the device. After device confirmation, the device is reset to the factory default settings. This option affects all users of the device. Wipe Traveler Data Select this option to remove only the IBM Notes Traveler application and its data, but leave personal data on the device. This option affects only the selected user.

9. If you issue a wipe request, the following options are available:

Option Description Refresh Device List Shows the status of a wipe request. Cancel Wipe Cancels a wipe request that shows the status Wipe pending. Reactivate Reactivates a device in the service after a wipe request is complete or fails with an error.

Results

The following table describes the messages that you might see in the Wipe status field after you issue a wipe request and click Refresh Device List. Table 79. Wipe status messages Wipe status message Description Wipe pending Wipe Device or Wipe Traveler Data was selected. The request will be processed when the device is turned on. Deactivated The device was wiped successfully and is no longer connected to IBM Notes Traveler. If Wipe Traveler Data was selected, Wipe Device can still be selected. Hard reset failed Wipe Device was selected but the device cannot be reset to factory default settings. This error usually indicates that the device is an older model that does not support hard resets. Hard reset confirmed Wipe Device was selected and the device confirmed the request. Application wipe failed A Wipe Traveler Data request failed. This error can occur for older device models. Application wipe confirmed Wipe Traveler Data was selected and the device confirmed the request. Not requested No wipe has been requested.

Chapter 7. Administering user accounts 273 Related tasks: “Enabling application passwords” on page 139 Application passwords can be used to provide a secure login for applications that do not support forms-based authentication. For example, they can be used to access applications that require passwords on a mobile device or for organizations that use federated identity and service login passwords are not used. When you enable application passwords, you also have the option of requiring the use of application passwords, and of allowing mobile users to bypass IP restrictions. “Preparing for Notes Traveler devices” on page 195 Before enabling users to use IBM Notes Traveler mobile devices with the service, prepare your environment and the devices.

Managing BlackBerry smartphones After activating a user’s BlackBerry® smartphone, perform any of the following tasks to manage it. Related concepts: “Settings enforced for BlackBerry smartphones” on page 205 This topic describes the settings that the service currently enforces for BlackBerry® smartphones. Related tasks: “Getting started with BlackBerry devices” on page 238 If BlackBerry devices supported by a Hosted BlackBerry Services subscription are used, complete the following tasks to begin using the devices with the service. Reactivating a user's BlackBerry smartphone If a user experiences a problem using a BlackBerry® smartphone, activating it again often resolves the problem. Before activating again, back up the smartphone and then wipe it. Wiping removes all data and prevents duplicate Contacts and Calendar entries from occurring when you activate it again. About this task

Alternatively, the user can reactivate the BlackBerry. Procedure 1. Back up the smartphone. For instructions, see the BlackBerry Knowledge Base article How to back up the data on a BlackBerry smartphone. 2. Log on to the service as an administrator. 3. If your account also has the User role, click Admin > Manage Organization. 4. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 5. Under User and Groups, click Users. 6. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching

274 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 7. Click the user's name in the search results. 8. Click Manage BlackBerry Smartphone. 9. Perform the following steps to wipe the smartphone: a. Click Wipe b. Click Wipe again to confirm. 10. To begin the activation process, perform the following steps to create an activation password: a. Click Reactivate or Activate Now, depending on the option that is displayed b. Create a one-time activation password and then click Set Password. Remember the password because you or the user enter it on the smartphone in the next step. If you do forget it, you can simply repeat this step to set a new one. 11. To activate the smartphone, refer to the following table and perform the steps that are shown for the operating system (OS) version of the smartphone. Activation can take from a few minutes to an hour, depending on the size of the mail file. After performing these steps, look for the Activation Complete message on the smartphone, which indicates that activation is successful.

OS version Steps to activate

OS4, OS5 1. From the Home screen of the smartphone, click Manage Connections and then enable your Mobile Connection. 2. From the Home screen of the smartphone, click Options > Advanced Options > Enterprise Activation. 3. Enter your SmartCloud Notes Internet email address, for example [email protected]. 4. Enter the activation password. 5. Click the track ball and select Activate. Note: Leave the Activation Server Address field blank, if you see it.

Chapter 7. Administering user accounts 275 OS version Steps to activate

OS6, OS7 1. From the Main screen of the smartphone, click Options > Device > Advanced System Settings > Enterprise Activation. 2. Enter the SmartCloud Notes Internet email address, for example [email protected]. 3. Enter the activation password. 4. Click the Activate button.

12. If you backed up data before activating, restore the data now. For information, see the BlackBerry Knowledge Base article How to use BlackBerry Desktop Software to restore data to a BlackBerry smartphone from a backup file. Wiping a user's BlackBerry smartphone if it is lost or stolen If a user's BlackBerry® smartphone is lost or stolen, wipe it to remove all data and deactivate it. About this task

Wiping a smartphone removes all data from it and deactivates it. If the smartphone is off, it is wiped the next time it is turned on. Alternatively, users can wipe their smartphones themselves.

For information on wiping a smartphone as part of reactivating it to correct a problem, see “Reactivating a user's BlackBerry smartphone”. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Under User and Groups, click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado

276 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Click Manage BlackBerry Smartphone. 8. Click Wipe 9. Click Wipe again to confirm. Setting a device password on a user's BlackBerry smartphone A device password helps to prevent unauthorized access to a user's BlackBerry® smartphone. Use this procedure to set an initial device password on a user's smartphone or to set a new device password if a user has forgotten the current one. About this task

The device password is a different password than the one-time activation password used to activate the smartphone. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the System Settings section of the navigation pane, click IBM SmartCloud Notes. 4. Under User and Groups, click Users. 5. In the Search box, type the beginning characters of any of the following user values to display the user's name: v Distinguished name, for example, Samantha Daryn/Renovations. v Internet email address, for example, sdaryn@renovations. v Last name, for example, Daryn.

Note: You cannot use the wildcard character (*) when you search. A “starts with” search is done and the names of any users with matching values in the directory are displayed. For example, the results of a search on ma include the names of users with the following values in the directory: v Madison Armond/Renovations v masmith@renovations v Kristin MacGyver This search does not match the following values: v Emarie Klein/Renovations v tamado@renovations v Ted Amado Search results can include a maximum of 1000 names. 6. Click the user's name in the search results. 7. Click Manage BlackBerry Smartphone. 8. Click Set Device Password. 9. Enter a password and then click Set Password. The password must be at least eight characters, including at least one numeric character and at least one alphabetic character.

Chapter 7. Administering user accounts 277 Results

A message indicating that you have changed the password is displayed on the smartphone. What to do next

Provide the password to the user. Related concepts: “Settings enforced for BlackBerry smartphones” on page 205 This topic describes the settings that the service currently enforces for BlackBerry® smartphones. Removing a BlackBerry subscription from a user account You can remove a BlackBerry® subscription from a user account. Procedure 1. Log on to the service as an administrator. 2. If your account also has the User role, click Admin > Manage Organization. 3. In the navigation pane, click User Accounts. 4. Click the arrow next to a user's name, select Edit User Account, and click Next. 5. In the Subscription Add-ons section, clear SmartCloud Notes for Hosted BlackBerry Services. 6. Click Next and Finish. Results

The user can no longer use a BlackBerry smartphone with SmartCloud Notes. Frequently asked questions about BlackBerry smartphone administration

Table 80. Frequently asked questions about BlackBerry® smartphone administration Question Answer

How do I know if a user has a BlackBerry 1. From SmartCloud Notes Administration, smartphone subscription? click Users. 2. Search for the user's name and then select it. 3. Do either of the following steps: v Select Show BlackBerry only to show only users with BlackBerry smartphone subscriptions and see if the user's name is listed. v Click the user's name and see if the value of the BES subscription field has been set to Enabled.

278 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 80. Frequently asked questions about BlackBerry® smartphone administration (continued) Question Answer

How do I know if a user's smartphone is 1. From SmartCloud Notes Administration, activated? click Users. 2. Search for the user's name and then select it. 3. Click Manage BlackBerry Smartphone. 4. If the user's smartphone is not activated, a message is displayed indicating that it needs to be activated. What do I do if BlackBerry activations fails? Perform these steps: 1. If the BlackBerry smartphone is an OS5 or earlier version, from the Home screen click Manage Connections and then enable your Mobile Connection. 2. Make sure that the user has an Enterprise plan with the wireless carrier rather than a Personal plan. If there is no Enterprise Activation option on the smartphone, the user has a Personal plan and needs to change to an Enterprise Plan. After changing to the Enterprise Plan, reactivate the BlackBerry. 3. Reactivate the BlackBerry smartphone. If I set an activation password, can a user Yes, the activation password is the last one override it? set by either the administrator or the user. What do I do if there are duplicate Calendar Wipe the smartphone and then reactivate it. or Contact entries on a smartphone? How do I tell which operating system (OS) See the BlackBerry Knowledge Base article version a BlackBerry smartphone uses? How to check the model number and version of installed BlackBerry device software on a BlackBerry smartphone.

How can I display a user's BlackBerry 1. From SmartCloud Notes Administration, smartphone device model and other device click Users. information? 2. Search for the user's name and then select it. 3. Click Manage BlackBerry Smartphone.

Chapter 7. Administering user accounts 279 280 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 8. Integrating a single domain (Example)

This example illustrates how a fictitious company, Renovations, integrates servers in a single IBM Domino domain with the IBM SmartCloud Notes service. About this task

Renovations plans to move the mail files of 500 of its 1000 users to mail servers in the service. The mail files of the other 500 users will remain on-premises on the company mail servers. The service users and the on-premises users will communicate by mail, look up free time for each other, schedule meetings with each other, and reserve shared meeting resources.

The current Domino deployment at Renovations consists of a single Domino domain, Renovations. This domain includes the servers described in the following table. Table 81. Servers in the Renovations domain Domino server name Current Domino version Current server function Dirhub1/Renovations 8.0 Directory hub that replicates to the other servers in the domain Mailhub1/Renovations 8.0 Mail routing hub that routes mail to and from other servers in the domain Mail1/Renovations 8.0 User mail server that is also used to look up the free time of users Mail2/Renovations 8.0 User mail server that is also used to look up the free time of users

To integrate these on-premises servers with the service, Bill Ranney, the lead Domino administrator at Renovations, performs the following steps. 1. Preparing the on-premises environment. 2. Configuring the service.

Note: This example does not illustrate the process of provisioning users, which occurs after the service is configured.

Preparing the on-premises environment (Example) To prepare the on-premises environment, Bill Ranney prepares the on-premises directory synchronization and mail hub servers, prepares the on-premises passthru server domain, configures firewalls, prepares the Global Domain document, and creates the certifier and names for mail servers.

© Copyright IBM Corp. 2011 281 Preparing the on-premises directory synchronization and mail hub servers (Example) Bill Ranney prepares a directory synchronization server and a mail hub server in the Renovations domain. About this task

A directory synchronization server is an on-premises server with which the service connects to replicate Domino directories. The service regularly initiates a Pull and Push replication operation to synchronize the on-premises Domino directories with replicas on servers in the service.

A mail hub server is an on-premises server used to route mail between service users and on-premises users.

After getting input from other members of the Renovations IT staff, Bill decides to use one directory synchronization server, the existing server, Dirhub1/Renovations. He also decides to use one mail hub server, the existing server, Mailhub1/Renovations.

Bill upgrades all of the servers in the domain from Lotus® Domino 8.0 to the latest version available, Lotus Domino 8.5.2. He also upgrades the user mail servers, Mail1/Renovations and Mail2/Renovations, so that on-premises users who use those mail servers can look up free time for service users.

The following information about this task is important to remember. v On-premises mail hub servers must run Lotus Domino 8.5.1 Fix Pack 2 or higher. v Mail servers of on-premises users that look up free time for service users must run Lotus Domino 8.5.1 Fix Pack 2 or higher. v One or two on-premises directory synchronization servers are allowed. v One or two on-premises mail hub servers are allowed. v One server can function as both a directory synchronization server and as a mail hub server. Preparing the on-premises passthru server domain (Example) Bill Ranney prepares the on-premises passthru servers, placing them in their own Domino domain. The service uses the servers in the domain as passthru servers through which it connects to the on-premises directory synchronization servers and mail hub servers. About this task

Bill installs and sets up two new Domino 8.5.2 servers, Passthru1/Renovations and Passthru2/Renovations, in a new Domino domain, SCNPassthru.

During server setup, he selects the option "I want to use an existing certifier ID file" so that he can certify the new servers under the existing /Renovations

282 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 organization certifier. Although an organization certifier and Domino domain often share the same name, they are independent entities. In this case, the passthru domain name and the certifier name are different.

When Bill runs the Domain Configuration tool later, connection documents are created that enable the passthru connections to Dirhub1/Renovations and Mailhub1/Renovations in the Renovations domain.

The following information about this task is important to remember. v For optimum security, a on-premises passthru server domain should be in a dedicated Domino domain that is located in the corporate demilitarized zone (DMZ) between an inner and outer firewall. v Servers in an on-premises passthru server domain must be certified under the same organization certifier as the directory synchronization servers and mail hub servers. v One or two servers passthru servers are allowed. In this example, they are in one Domino domain, but they can be in separate domains. v A passthru server domain manages only incoming connections from the service. Connections from on-premises clients and servers to the service do not use the passthru domain. v Install Domino 8.5.2 or later on servers in a passthru domain for fastest response time for freetime requests from service users to on-premises users Configuring firewalls (Example) Bill works with the Renovations IT staff to configure inner and outer firewalls. About this task

The following tables summarizes the configuration. Note that this example illustrates just one approach to firewall configuration; others are possible. Table 82. Outer firewall - inbound connections Setting Value Port TCP/IP port 1352 Source addresses Unpublished IP addresses that the service firewall generates. The IBM Customer Service Representative provided these to the company. Destination addresses passthru1.renovations.com

passthru2.renovations.com

Table 83. Outer firewall - outbound connections at Renovations Setting Value Port TCP/IP port 1352 Source addresses All

Chapter 8. Integrating a single domain (Example) 283 Table 83. Outer firewall - outbound connections at Renovations (continued) Setting Value Destination addresses notes.na.collabserv.com

Table 84. Inner firewall - inbound connections at Renovations Setting Value Port TCP/IP 1352 Source addresses passthru1.renovations.com

passthru2.renovations.com Destination addresses dirhub1.renovations.com

mailhub1.renovations.com

Table 85. Inner firewall - outbound connections Setting Value Port TCP/IP 1352 Source addresses All Destination addresses notes.na.collabserv.com

Preparing the Global Domain document (Example) Bill Ranney ensures that the Internet domain, renovations.com, is correctly defined in a Global Domain document. About this task

Renovations owns the Internet domain renovations.com. The domain is used to form the Internet address of users in the Renovations Domino Directory, for example, [email protected].

Bill performs the following steps to verify that the domain has a Global Domain document that is correctly configured. 1. Open the Renovations Domino Directory. 2. Select Configuration > Messaging > Domains. 3. Open the Global Domain document for renovations.com. 4. Verify that the document is correctly configured.

The following table shows the verified Global Domain document for renovations.com Table 86. Verified Global Domain document for renovations.com Tab Field Value Basics Domain type Global Domain Basics Global domain name renovations.com Basics Global domain role R5/R6/R7/R8 Basics Use as default Global Not applicable because there Domain is only one Global Domain document in the Renovations Domino Directory.

284 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Table 86. Verified Global Domain document for renovations.com (continued) Tab Field Value Restrictions Domino domains and aliases Not applicable because the service does not use Domino domain information for routing. Conversions - SMTP Address Local primary Internet renovations.com Conversions domain Conversions - SMTP Address Alternate Internet domain None Conversions aliases

The following information about this task is important to remember. v Each Internet domain that a company owns and uses for Internet mail requires a corresponding valid Global Domain document. The document must be in a Domino Directory that replicates to the service during directory synchronization. During account setup, the Global Domain document is used to show the domain in a list of domains to be verified. v Routing of incoming Internet mail addressed to service users is configured and done on-premises. The service performs outbound Internet mail routing only. v Only two fields in the Conversions > SMTP Address Conversions section of a Global Domain document are used by the service: Local primary Internet domain and Alternate Internet domain aliases. The remaining fields in the SMTP Address Conversions section apply to incoming Internet mail and are therefore ignored by the service. Creating the certifier and names for mail servers (Example) Bill Ranney creates the OU certifier used to certify and name the Renovations mail servers in the service. About this task

Bill decides to use Mail as the base name for the company mail servers in the service. He provides the base name later when configuring account settings. The base name and OU certifier combine to form mail server names Mail1/SCN/Renovations, Mail2/SCN/Renovations, and so on.

Bill creates the OU certifier /SCN/Renovations to use to certify and name the Renovations service mail servers. He saves the password-protected certifier ID file, scn_renovations.id, to a local, secure location so that he can easily select it when uploading it to the service when configuring account settings later.

The following information about this task is important to remember.

Chapter 8. Integrating a single domain (Example) 285 v It is important that you choose and create your service mail server OU certifier carefully. After you upload the OU certifier ID to the service, you cannot change to an ID with a different certifier name. v The OU certifier you provide for your service mail servers must be under the same organization certifier as the passthru servers, directory synchronization servers, and primary mail hub servers. It can be at any level below the organization certifier. This OU certifier must be unique and used only for the service mail servers; the OU certifier cannot be used on-premises. v The certifier used for service users must trust the service mail server OU certifier, and vice versa. If any users are certified under a different organization than the OU certifier, you must create the required cross-certificates to establish trust. The cross-certificates must be replicated to the directory synchronization servers.

Configuring the service (Example) After preparing the on-premises environment, Bill Ranney perform the steps required to configure the service to integrate with on-premises servers. Completing an account settings worksheet (Example) Bill Ranney completes the following worksheet to gather the information required to configure account settings. About this task Table 87. Account settings worksheet Information required to configure account settings Value Local file path of the OU certifier ID file C:\scn_renovations.id (password-protected) used to certify the mail servers of service users (Certifier name: /SCN/Renovations Domino passthru server domain SCNPassthru Primary Domino passthru server Passthru1/Renovations Primary passthru server hostname or IP passthru1.renovations.com address Secondary Domino passthru server Passthru2/Renovations Secondary passthru server hostname or IP passthru2.renovations.com address Primary Domino on-premises mail hub Mailhub1/Renovations server Secondary on-premises mail hub server None Base name for mail servers of service users Mail Primary on-premises directory Dirhub1/Renovations synchronization server Local file path of each Domino Directory on C:\syncdir\names.nsf the primary directory synchronization server to replicate to the service Secondary directory synchronization server None

286 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Configuring account settings (Example) Bill Ranney uses IBM SmartCloud Notes Administration on http:// www.ibmcloud.com/social to configure account settings for the company. About this task

Bill logs on to http://www.ibmcloud.com/social as the first company administrator. He uses the completed account settings worksheet to configure account settings. He performs the following tasks to configure account settings, as described in the topic Roadmap to configuring a hybrid environment. v Providing a certifier ID file v Specifying one or more passthru servers v Specifying a mail routing server v Creating a base name for your mail servers v Specifying a Domino Directory synchronization server

The following information about this task is important to remember. v An IBM Customer Service Representative must add the SmartCloud Notes subscription for a company before account settings can be configured. v Adding the company subscription creates the first company administrator account for the company. The first company administrator receives an email invitation with a URL to use to log on to the Connections Cloud website for the first time. v When configuring account settings, the company administrator uploads the organizational unit certifier ID file to use for certification of the mail servers of service users. It is important that the administrator verifies that the selected Certifier ID file is correct before clicking the Upload button. After the certifier ID file is uploaded, it cannot be changed to an ID with a different certifier name. v When configuring account settings, you can provide the host name or the IP address of a passthru server. Best practice is to provide a host name. If you provide an IP address and the IP address changes in the future, you must configure account settings and run the Domain Configuration tool again. Downloading and running the Domain Configuration tool (Example) After Bill Ranney configures account settings, he downloads and runs the Domain Configuration tool. The tool takes the information Bill provides in account settings and makes required changes to the Domino directories of the SCNPassthru domain and Renovations domain. About this task

The directory changes made by the tool configure connections, routing, and replication between the servers in the service and the on-premises servers.

Chapter 8. Integrating a single domain (Example) 287 The following information about this task is important to remember. v Do not edit the directory content added by the tool. For example, do not edit changes to the ACL or to Connection documents. Doing so prevents proper operation of the service. Refer to the report generated by the tool to see the exact directory changes the tool makes v The IBM Notes client from which the tool is run must be able to connect to the passthru servers in the passthru domain. The client must also be able to connect to the directory synchronization and mail hub servers in the on-premises hub domain. Firewall rules at your company might prevent connections from systems inside the firewall to the passthru servers. In this case, use a Notes client running on a system connected outside the firewall. Allow a direct connection to the passthru servers, and through them, connect to the servers in the on-premises hub domain. v The person who runs the tool must have Full Remote Console access to the passthru servers, directory synchronization servers, and mail hub servers. This access is granted through the Full Remote Console Administrators field in each Server document. Verifying the Internet domain name (Example) After Bill Ranney tests network connections, he verifies ownership of the Internet domain, renovations.com. About this task

This step confirms that the service is allowed to use renovations.com for the Internet mail address of users at Renovations. To verify ownership, Bill creates a CNAME record for renovations.com through the domain hosting service that the company uses. A CNAME record is a type of resource record for a domain. The fact that Bill can access DNS settings to create a CNAME record for renovations.com is what proves ownership of the domain to the service.

To verify domain ownership, Bill follows instructions in the topic "Verifying Internet domain names in a hybrid environment." When he clicks Verify Ownership in the Internet Domain Verification window, he is given the following information just for his company to use to add to a new CNAME record: v The unique key, domino-3ktteaarn-rules v The domain to point to, collabserv.com He clicks Begin Verification and then creates the CNAME record on the hosting service with the required information. To verify ownership, the LotusLive Notes™ service connects to domino-3ktteaarn-rules.renovations.com.

The following information about this task is important to remember.

288 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 v The list of domain names to be verified that is shown in the Internet Domain Verification window is derived from on-premises Global Domain documents. These documents replicate to the service during directory synchronization. v The key that is provided in the Internet Domain Verification window must exactly match the key used to create the CNAME record. If there is a mismatch, domain verification fails. v The service can take up to 48 hours to verify ownership, but it usually takes less time. Testing network connections (Example) After Bill Ranney runs the Domain Configuration tool, he waits for directory synchronization to complete, and then tests network connections between on-premises servers and the service. About this task

To test network connections, Bill first performs the task described in "Checking network connections from the service to on-premises servers." After doing so, he sees the following pair of messages listed for the server Dirhub1/Renovations and for the server Mailhub1/Renovations. These messages indicate that the service can connect to the on-premises servers.

"Successfully accessed mail.box"

"Successfully accessed Domino Directory"

Next, Bill performs the task, "Checking network connections from on-premises servers to the service." He tests that the on-premises mail hub server Mailhub1/Renovations can connect to the service mail server Mail1/SCN/ Renovations. To do so, he enters the command trace Mail1/SCN/Renovations from the Domino server console of the Mailhub1/Renovations server. He sees the message Connected to server Mail1/SCN/Renovations in the output, which indicates a successful connection.

When using the trace command, Bill ignores the message Error connecting to server_name: Server error: You are not authorized to use the server. This message indicates only that an attempt to connect anonymously failed. Anonymous connections are not allowed, so this is expected behavior.

The following information about this task is important to remember. v The on-premises directory synchronization servers and mail hub servers in the on-premises hub domain must be running. Issuing a Vault Trust Certificate (Example) Bill Ranney issues a Vault Trust Certificate to the ID vault in the service. The Vault Trust Certificate establishes that the vault is trusted to store user IDs that are certified under the certifier that issues the certificate.

Chapter 8. Integrating a single domain (Example) 289 About this task

All the service users at Renovations are certified under the /Renovations certifier, so just one Vault Trust Certificate is required, issued from /Renovations. Bill follows the steps described in Issuing a Vault Trust Certificate. From an on-premises Domino Administrator client, he issues a Vault Trust Certificate in the Domino Directory of the Renovations domain. He sees the vault document /IDVault_97656623 for Renovations in the Configuration > Security > ID Vaults view of the Domino Directory. He issues the trust certificate from the certifier /Renovations to /IDVault_97656623.

The following information about this task is important to remember. v After the Vault Trust Certificate is created, it replicates to the service during directory synchronization.

Example illustrations The following topics provide pictures to illustrate the operation of the service at Renovations with single-domain integration. Directory synchronization at Renovations This picture illustrates directory synchronization of the Renovations domain Domino Directory.

290 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 The directory synchronization servers in the service regularly perform a pull and push replication operation. The servers pull changes from the Renovations Domino Directory on the on-premises directory synchronization server, Dirhub1/Renovations. They push directory changes from the service to Dirhub1/Renovations. The directory synchronization servers in the service connect to Dirhub1/Renovations through a passthru server in the SCNPassthru domain.

The Dirhub1/Renovations server performs two-way replication of the Renovations Domino directory with the other on-premises servers. Directory synchronization servers and mail servers in the service also replicate directory changes. Service user sending Notes mail to an on-premises user This picture illustrates how Notes mail is routed from a service user to an on-premises user at Renovations.

Chapter 8. Integrating a single domain (Example) 291 1. The client of the service user connects to the service user’s mail server, Mail1/SCN/Renovations, to send the message. The client connects through the service proxy, notes.na.collabserv.com. 2. The Mail1/SCN/Renovations server routes the message to a mail hub server in the service. 3. The mail hub server routes the message to the on-premises mail hub server, Mailhub1/Renovations. The server connects through a server in the SCNPassthru domain. 4. Mailhub1/Renovations routes the message to Mail2/Renovations, the mail server of the on-premises user. 5. The client of the on-premises user connects to Mail2/Renovations to open the message.

The service scrubs viruses from the outbound messages. On-premises user sending Notes mail to a service user This picture illustrates how Notes mail is routed from an on-premises user to a service user at Renovations.

292 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 1. The client of the on-premises user connects to the on-premises mail server, Mail2/Renovations, to send the message. 2. Mail2/Renovations routes the message to the on-premises mail hub server, Mailhub1/Renovations. 3. Mailhub1/Renovations routes the message to a mail hub server in the service. The server connects through the service proxy, notes.na.collabserv.com. 4. The mail hub server in the service routes the message to the service user’s mail server, Mail1/SCN/Renovations. 5. The client of the service user connects to Mail1/SCN/Renovations to open the message. The client connects through the service proxy, notes.na.collabserv.com.

The service scrubs viruses from the inbound messages.

Chapter 8. Integrating a single domain (Example) 293 Service user receiving Internet mail This picture illustrates how Internet mail is routed to a service user at Renovations.

1. A client on the Internet addresses mail to the service user at renovations.com. The mail is sent to the on-premises SMTP router on Mailhub1/Renovations, which is configured to route incoming mail for users in the renovations.com domain. 2. Mailhub1/Renovations routes the message to a mail hub server in the service. Malhub1/Renovations connects to the hub server through the service proxy, notes.na.collabserv.com. An SMTP server in the on-premises DMZ performs mail hygiene on the message beforehand. 3. The mail hub server routes the message to Mail1/SCN/Renovations, the service user’s mail server. 4. The service user client connects to Mail1/SCN/Renovations to open the message. The client connects to the server through the service proxy, notes.na.collabserv.com Service user sending Internet mail This picture illustrates how Internet mail is routed from a service user at Renovations. The service manages the routing; a company-controlled SMTP host is not used in this example.

294 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 1. The client of the service user sends the mail to the service user’s mail server, Mail1/SCN/Renovations. The client connects to the server through the service proxy, notes.na.collabserv.com. 2. Mail1/SCN/Renovations sends the mail to the mail hygiene servers in the service for virus checking. 3. The SMTP server routes the mail to the mail hygiene servers. 4. The mail hygiene servers route the mail to the Internet. Service user requesting the free time of an on-premises user This picture illustrates a service user at Renovations requesting the free time of an on-premises user.

Chapter 8. Integrating a single domain (Example) 295 1. The client of the service user sends a free-time request to the server user’s mail server, Mail1/SCN/Renovations. The client connects to the server through the service proxy, notes.na.collabserv.com. 2. Mail1/SCN/Renovations sends the free-time request to the on-premises mail hub server, Mailhub1/Renovations. It connects to Mailhub1/Renovations through a passthru server in the SCNPassthru domain. 3. Mailhub1/Renovations sends the free-time request to Mail2/Renovations, the mail server of the on-premises user. 4. Mail2/Renovations looks up the free time of the on-premises user in its Free Time database and returns the free time to Mailhub1/Renovations. 5. Mailhub1/Renovations returns the free time to Mail1/SCN/Renovations. 6. Mail1/SCN/Renovations returns the free time of the on-premises user to the client of the service user. On-premises user requesting free time of a service user This picture illustrates an on-premises user at Renovations requesting the free time of a service user.

296 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 1. The client of the on-premises user sends a free-time request to Mail2/Renovations, the on-premises user’s mail server. 2. Mail2/Renovations sends the free-time request to Mail1/SCN/Renovations, the service users’s mail server. Mail2/Renovations connects to Mail1/SCN/Renovations through the service proxy, notes.na.collabserv.com. 3. Mail1/SCN/Renovations looks up the free time of the service user in its Free Time database and returns the free time to Mail2/Renovations. 4. Mail2/Renovations returns the free time to the client of the on-premises user. Service user requesting the free time of a resource This picture illustrates a service user requesting the free time of a resource at Renovations.

Chapter 8. Integrating a single domain (Example) 297 1. The client of the service user sends a request for the free-time of the resource to the service user’s mail server, Mail1/SCN/Renovations. The client connects to Mail1/SCN/Renovations through the service proxy, notes.na.collabserv.com. 2. Mail1/SCN/Renovations sends the free-time request to Mailhub1/Renovations, the on-premises mail hub server. It connects to Mailhub1/Renovations through a server in the SCNPassthru domain. 3. Mailhub1/Renovations looks up the free time for the resource in its local Resource Reservations database and returns the free time to Mail1/SCN/Renovations. 4. Mail1/SCN/Renovations returns the free time for the resource to the client of the service user.

298 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Service user reserving a resource This picture illustrates a service user reserving a resource.

1. The client of the service user sends the resource reservation to the service user’s mail server, Mail1/SCN/Renovations. The client connects to the server through the service proxy, notes.na.collabserv.com. 2. Mail1/SCN/Renovations mails the reservation to a mail hub server in the service. 3. The mail hub server mails the reservation to the Mail-in Resource document for the resource on Mailhub1/Renovations, the on-premises mail hub server. The mail hub server connects to Mailhub1/Renovations through a server in the SCNPassthru domain. 4. Mailhub1/Renovations creates the reservation in its local Resource Reservations database.

Chapter 8. Integrating a single domain (Example) 299 300 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 9. Integrating additional domains

You can integrate additional domains in a hybrid environment. About this task

For an example of integrating a secondary Domino domain in a hybrid environment, see the wiki article Integrating additional domains with the SmartCloud Notes service.

© Copyright IBM Corp. 2011 301 302 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 10. Troubleshooting the service

Use the following tools and resources to help you troubleshoot a problem with the service.

Using the Configuration Test tool In a hybrid environment, you can use the Configuration Test tool inIBM SmartCloud Notes Administration Account Settings on an ongoing basis. The tool checks for problems with your on-premises server environment that can prevent proper operation of the service. About this task

If you change Account Settings, for example, add a new directory to be synchronized or change a mail hub server, you must download and run the Domain Configuration tool to enable the change in the service. After running the Domain Configuration tool, run the Configuration Test tool to ensure that the change has not introduced any problems.

It can be useful to run the Configuration Test tool even if you have not changed Account Settings. The tool can detect inadvertent changes in your environment that cause problems in the service. For example, it can detect directory changes made on-premises that prevent directory synchronization. Related tasks: “Running configuration tests” on page 99 After you run the Domain Configuration tool, verify that servers in the service can connect to your on-premises servers.

Finding troubleshooting tips in the Support Portal If you need additional troubleshooting information, go to the IBM SmartCloud Notes Support Portal. There you can find troubleshooting information authored by IBM specifically for SmartCloud Notes.. Related information:

SmartCloud Notes Support Portal

Contacting Support If you are unable to resolve a problem, contact Support. About this task

For information, go to http://www.ibmcloud.com/social and select Support > Technical Support.

© Copyright IBM Corp. 2011 303 304 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Chapter 11. Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd. 19-21, Nihonbashi-Hakozakicho, Chuo-ku Tokyo 103-8510 Japan

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

© Copyright IBM Corp. 2011 305 IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtml.

Intel is a registered trademark of Intel Corporation or its subsidiaries in the United States and other countries.

306 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

The RIM and BlackBerry families of related marks, images and symbols are the exclusive properties and trademarks of Research In Motion Limited — used by permission. Research In Motion, RIM, BlackBerry, BlackBerry Enterprise Server and “Always On, Always Connected” are registered with the U.S. Patent and Trademark Office and may be pending or registered in other countries.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Privacy policy considerations IBM Software products, including software as a service solutions, (“Software Offerings”) may use cookies or other technologies to collect product usage information, to help improve the end user experience, to tailor interactions with the end user or for other purposes. In many cases no personally identifiable information is collected by the Software Offerings. Some of our Software Offerings can help enable you to collect personally identifiable information. If this Software Offering uses cookies to collect personally identifiable information, specific information about this offering’s use of cookies is set forth below.

Depending upon the configurations deployed, this Software Offering may use session cookies that collect each user's user name, session ID, or other application-specific state information for purposes of session management, authentication, or enhanced usability. These cookies cannot be disabled.

If the configurations deployed for this Software Offering provide you as customer the ability to collect personally identifiable information from end users via cookies and other technologies, you should seek your own legal advice about any laws applicable to such data collection, including any requirements for notice and consent.

For more information about the use of various technologies, including cookies, for these purposes, See IBM’s Privacy Policy at http://www.ibm.com/privacy and IBM’s Online Privacy Statement at http://www.ibm.com/privacy/details the section entitled “Cookies, Web Beacons and Other Technologies” and the “IBM Software Products and Software-as-a-Service Privacy Statement” at http://www.ibm.com/software/info/product-privacy.

Chapter 11. Notices 307 308 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 Index

BlackBerry documentation A providing to users 242 D access BlackBerry on-premises servers delegation restricting to on-premises servers 235 removing accounts 239 planning for mail files 208 access control lists BlackBerry smartphones deployment see ACL 168 backing up data 274 planning 17 accessibility encrypted mail 242 Desktop Settings described 5 frequently asked questions 278 restrictions 114 account management tasks 274 device passwords activating 99 resetting passwords 277 resetting for BlackBerry devices 277 enabling 94 wiping 276 device wipe account identity BlackBerry subscriptions for SmartCloud Traveler devices 272 deleting 261 adding a subscription 239 differences removing 263, 264 removing a subscription 278 between service and on-premises restoring 263 deployments 12 account settings dir sync configuration example 287 see directory synchronization 89 in a hybrid environment 89 C directories ACL calendar details adding photos 147 customizing for mail files 168 enabling 170 finding names in 142 preparing for mail file transfer 212 calendar scheduling preparing for synchronization 45 ActiveX planning 32 replicating 21 enabling 159 preparing for 73 directory synchronization administration tasks certifier configuring 89 best practices 243 creating for organizational units 39 example 291 described 13 mail server example 285 explanation 26 in a hybrid environment 8 organization 37 planning 21 administrative policies certifier ID file preparing for 45 See also policies providing 92 requirements and limitations 22 for user registration 222 certifier requirements setting up servers 46 Notes Traveler 118 in a hybrid environment 37 directory synchronization server overview 105 chat example 282 preparing 105 See also instant messaging Domain Configuration tool restrictions 114 see instant messaging 176 downloading and using 94 administrator role checklists example 287 requirement 243 for configuration preparation 87 domain documents administrators client configuration tool Global Domain documents 49 first logon 86 changes made to Notes client 199 domains Alias domains Client Configuration tool aliases 207 addresses for 207 for Notes client 199 integrating additional 301 application passwords CNAME records verifying Internet domains 97 enabling for mobile applications 139 in Internet domain verification 97 Domino directories application servers comparison preparing for replication 47 connecting to 82 service and on-premises 12 Domino versions attachment size limits configuration required 38 Traveler devices 118 Configuration Test tool 303 hybrid environment roadmap 83 inbound connections 41 testing hybrid setup 93, 99 E B troubleshooting 303 ECLs bandwidth configuration tasks custom templates 163 Notes client 196 hybrid environment 83 EDC web client 193 control documents see extended directory catalog 48 base name for mail file transfers 214 EDNI creating 91 custom templates see External Domain Network best practices execution security alerts 163 document 82 maintaining on-premises preparing 161 enabling federated identity environment 243 management 136 BlackBerry devices encrypted mail activating 239 on BlackBerry smartphones 242 reactivating 274

© Copyright IBM Corp. 2011 309 examples FTP account settings downloading journal files 181 J completing a worksheet 286 transfer method 214 journal files configuring 287 using for mail file transfer 215 downloading 181 creating mail server certifier 285 Notes client sessions 184 directory synchronization 282, 291 Notes mail 182 firewall configuration 283 G overview 180 free time request getting started of a resource 298 preparing a communications of on-premises user 296 plan 206 L of service user 297 Global Domain documents Licenses Global Domain document 284 example 284 Notes 11 integrating a secondary domain 301 preparing 49 logon integrating single domain 281 groups 104 first time by administrator 86 internal mail routing between Domino domains 66 between users in a secondary domain 62 H M from on-premises to service 293 hybrid account setup Mail from service to on-premises 292 checking status 94 archiving policy settings Internet mail routing hybrid environment document 107, 110 from external user 69 account activation 99 mail file inbound 294 administration 8 reducing size of file 157 using company SMTP host 71 best practices 243 mail file templates using service SMTP host 70 configuring 89, 94 changing 246 issuing Vault Trust Certificate 290 overview 6 configuring 164 preparing a passthru server preparing 39 language versions 248 domain 282 testing the configuration 99 preparing custom 161 preparing your environment 282 viewing assigned template 247 testing network connections 289 mail file transfer 210 using the Domain Configuration I mail file transfers tool 287 control documents 214 IBM iNotes control verifying Internet domains 288 initiating a request 214 enabling 159 execution security alerts preparing 209 IBM Notes clients custom templates 163 preparing ACL 212 described 11 extended directory catalog preparing for 209 preparing for deployment 196 preparing for replication 48 using FTP 215 ID files synchronizing 89 using NAS 215 for certifier ID 92 extension forms files using removable storage device 215 Notes IDs 131 assigning 249 mail files uploading 213 assigning with integration server 249 changing templates 246 ID vault overview 165 configuring mail settings 154 storing a Notes ID 213 requirements 167 configuring trash retention 156 IMAP using as default 249 customizing access 168 configuring access 178 External Domain Network document deleting on-premises files 228 folder names 180 creating 82 planning delegation 208 information preparing the staging server 210 available resources 15 quotas 207 instant messaging scanning for viruses 213 F configuring 171 viewing templates 247 FAQs configuring communities 175 mail hub servers administering the service 13 described 176 example 282 BlackBerry administration 278 on-premises 172 setting up 52 FAS integration server mail routing transfer method 214 journal files 180 between Domino domains 66 federated identity checklist 135 Internet domains example 294 file deletion verification example 288 examples 62 on-premises 228 verifying 97 external mail routing examples 69 firewalls Internet email addresses from external to service user 69 configuration example 283 changing 258 internal examples 60 configuring inbound connections 41 multiple 207 planning 29 configuring outbound 42 IP range preparing preparing 41 bypassing in mobile applications 139 from service to on-premises 53 folders from service users 53 trash folder management 156 to service users 55 free time to service users in a secondary example of request 296, 297 domain 57

310 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015 mail routing (continued) Notes links proxy servers preparing (continued) setting style 155 using 44 to service users in on-premises hub Notes Traveler domain 55 adding subscriptions 234 using SMTP 54 deleting users from on-premises Q specifying server 90 servers 236 quotas using SMTP 70, 71, 160 policies 118 for mail files 207 mail rules preparing devices 195 limiting use 154 removing accounts from on-premises mail servers servers 235 base name 91 restricting access to on-premises R certifier 39 servers 235 reactivation decommissioning 229 NRPC for BlackBerry smartphone preparing for routing 55 authentication 130 devices 274 mail settings NRPC connections for Traveler devices 272 configuring 154 in a hybrid environment 44 references configuring Notes links 155 information resources 15 deleting older mail 157 Registration Settings limiting incoming message size 154 O restrictions 115 preventing automatic forward 154 replication on-premises accounts Mail Settings preparing extended directory removing Notes Traveler 235 restrictions 116 catalog 48 on-premises environment mail transfers preparing for 47 preparing 39 provisioning users 225 Research In Motion on-premises servers mail-in database accepting terms of use 238 decommissioning 229 creating 211 reservations organizational unit meetings for resources 36 certifier 92 calendar scheduling 32 resource databases OU messages in a hybrid environment 36 See also see organizational unit limiting size 154 restricting access 104 see organizational unit 92 mobile applications RIM enabling passwords for 139 see Research In Motion 238 roadmap P hybrid configuration tasks 83 N passthru servers Roaming Settings preparing 40 restrictions 118 name finder preparing on-premises domain configuring 142 example 282 Name finder see pass thru servers 40 Standard and Advanced options 145 S specifying 91 names Sametime password rules changing 255 configuring 171 by authentication method 141 NAS feature comparison 176 passwords using to transfer mail files 215 on-premises 172, 175 enabling for mobile applications 139 network bandwidth scheduling resetting Notes client 196 preparing for 73 for Notes ID 125, 253 web client 193 security set expiration dates 125 network connections planning 17 setting expiration for Notes planning 19 Security Settings clients 126 testing 289 restrictions 117 setting for BlackBerry testing using the trace command 100 server ID smartphones 277 networks registering 210 synchronizing 128 preparing 40 server requirements Person documents new user accounts Domino version 38 alias domains 207 providing information to users 231 servers resolving duplicate documents 28 registering on-premises 222 connecting to on-premises 82 photos Notes client connecting to the service 44 adding to directories 147 deciding whether to use 188 directory synchronization 46 policies Notes clients mail routing 90 see administrative policies 105 authentication 130 passthru 91 Pre-configuration Test tool changes made by Client Configuration service user using to test configuration 93 tool 199 converting to on-premises user 267 preparing federated identity Notes ID settings management 135 importing 213 for BlackBerry smartphones 205 Provisioning on BlackBerry smartphones 242 size limits checking status 229 resetting passwords 125, 253 mail files 207 described 219 uploading to the vault 269 SmartCloud Notes overview 1

Index 311 SmartCloud Notes (continued) Troubleshooting what's new 2 Resetting Notes ID passwords 125, SmartCloud Notes entry 253 described 10 troubleshooting tips SmartCloud Notes web in the Support Portal 303 described 10 SmartCloud Traveler managing devices 272 U SMTP server user accounts using to route mail 160 administering 243 software versions converting from service to for Domino servers 38 on-premises 267 staging server 210 deleting 261 enabling for status reports 211 provisioning 225 preparing 210 provisioning without mail file server ID 210 transfer 219 status registering on-premises 222 hybrid account setup 94 removing from BlackBerry status reports on-premises servers 239 from client configuration tool 211 restoring 263 subscriptions revoking 263, 264 activating BlackBerry service 239 suspending 260 adding user experience BlackBerry services 239 in a hybrid environment 8 Notes Traveler 234 user names converting changing in a hybrid from service to on-premises environment 255 user 267 in suspended account 260 removing BlackBerry services 278 V SmartCloud Notes 259 Vault Trust Certificate status of new 229 example of issuing 290 viewing 271 issuing 101 support viruses troubleshooting tips 303 scanning for 213 suspended account status 260 synchronization W directory synchronization 26 web client requirements and limitations 22 customizing 165 description 10 preparing for 193 T what's new 2 templates changing 246 configuring 164 language versions 248 using custom 246 viewing assigned 247 third-party email using IMAP 178 trace command using to test network connections 100 transfer method FTP and FAS 214 transfer requests initiating 214 troubleshooting contacting support 303 execution security alerts 163 hybrid configuration 93, 94 lost BlackBerry smartphone 276 tools and resources 303 using the Configuration Test tool 303

312 SmartCloud Notes: Administering SmartCloud Notes: Hybrid Environment March 2015



Printed in USA