You can now recall mail messages that have been sent to other users within a Lotus Domino environment. Previously, administrators needed to manually delete a message that had been inadvertently sent. This process was painstaking and often did not fully provide the ability to recall messages. The new message recall feature will allow the end users to initiate the recall of messages and (as long as the message has been routed only through the NRPC protocol) the recipient's mail server will attempt to recall the message.

The message recall feature will only work for users using the Notes 8 mail template with servers running Domino 8. It will work across domains as long as the message was only routed via NRPC; messages that get sent over SMTP through the Internet will not be able to be recalled.

The message recall feature is enabled and configured for the entire Domino 8 environment through a server configuration document. This server configuration document allows administrators to configure the service to recall messages, depending on whether or not they have been read by the end user, or depending on the age of the message.

In addition to a global setting for the environment, message recall can be applied more granularly through the use of a mail policy. The mail policy can be configured to change the parameters for the end users, but the use of a policy does not override the global configuration. Within the policy document, administrators can set whether the end users can recall messages and whether messages sent to end users can be recalled. In addition, the policy can define whether or not to recall messages based on whether they have been read by the end user or have passed a predefined age.

In previous releases of Domino, "Out of Office" functionality was only offered as an agent. As a result, there was a delay in processing "Out of Office" messages for the end users. Typically, senders of messages to end users that had enabled their "Out of Office" agent would not receive notice for up to four hours based on the default configuration, but this could be greater based on internal implementations. Some environments were modified to inform senders of their "Out of Office" status at a more frequent interval. This shortening of the interval could affect the performance of the servers, because they would need to process the agent on a more frequent basis. The Domino 8 environment allows administrators to configure the "Out of Office" feature as a service on the server, rather than as an agent.

The configuration of the "Out of Office" feature as a service is not a requirement in Domino 8; the environment can continue to be configured via an agent. It is important to note that the utilization of Notes 8, the Notes 8 mail template, and a Domino 8 server is required for this feature to work. If the Notes 8 template or all servers (including cluster pairs) are not running Domino 8, you must configure the "Out of Office" feature as an agent.

Configuring the "Out of Office" feature as a service allows Domino 8 to send the "Out of Office" notification as soon as messages are received, after the server and end user mail rules are applied. Another enhancement of running the "Out of Office" feature as a service is that, once an end user enables the feature, upon the completion of the "Out of Office" time frame, the service is turned off after the first message is acted upon or through normal server maintenance routines.

Mail threads were introduced in early versions of Notes and Domino. The earlier implementation of mail threads within the inbox in Notes had some limitations, specifically when messages within the mail thread were deleted thus breaking the thread. Additionally, messages that were received from outside systems were not included in the mail thread. The Domino 8 support for client-based mail threads has been enhanced to ensure that the threads are persistent and that deletion or archiving of messages within the thread will not cause problems. In addition, enhanced support for messages outside of the Domino environment has been extended and can be included within the mail threads.

The enhanced mail features are delivered through the Domino server to the end user, therefore the Domino 8 mail thread functionality is not dependent on Notes 8 (since the Notes 7 client will provide the mail threads within the inbox view), the Notes 8 mail template, or the Domino 8 server for the senders or intermediate servers that will route the mail. The end user's mail server must be running Domino 8 for it to deliver the enhanced functionality.

An excessive number of documents in a single view can be a significant end-user performance issue, particularly the primary view when the database is open. The number of documents in the Inbox view within the mail database can hinder performance by increasing the time required to build the view. When end users leave all of their incoming messages in the inbox view and do not archive messages or place them in folders, the inbox can become unwieldy. Domino 8 introduces the Automated Inbox cleanup process that removes messages from the inbox.

The Automated Inbox Cleanup feature can either be set through the server configuration document:

or through the use of a mail policy:

This feature doesn't require Notes 8 or the Notes 8 mail template, but your mail databases need to be hosted on a Domino 8 server. Through the server configuration document and the mail policy document, administrators can set the schedule for inbox maintenance based on the day and time.

Administrators can add this functionality for all users or a select group of users. The inbox cleanup can occur with a specified time frame and can leave documents in the inbox if they have not been read.

As spam filters and other technologies proliferate, so has the use of reverse lookups for ensuring the proper address is used so that messages are not rejected. When a mail rule is set to forward messages within Domino 8 and the forwarded message contains a null value, some spam filters may reject the message. The new reverse path setting feature in Domino 8 allows for the setting of the path so as to ensure that messages are not rejected. Within the server configuration document, administrators have the ability to set the reverse path for forwarded mail.

In some SMTP configurations, the environment is set up so as to conduct lookups to the directory before routing messages within the infrastructure. When this setting is configured, the server will reject ambiguous addresses for end users and groups.

Upon rejection of the message, a return message is routed to inform the sender that the message has been rejected by the Domino environment based on a corporate policy.

There are a number of other new and enhanced features in Domino 8 including router group expansion, transfer and delivery of delay reports, and improved HTML rendering for email. Refer to Domino 8 Administrator Help for more information on these and other topics.

The end user renaming process in Domino is executed by leveraging the AdminP process. When the request for a change in the user's name or shift in the hierarchy is submitted, the AdminP process begins to execute the renaming process in all databases throughout the environment. This ensures that ACLs, reader fields, and so on are updated with the new information. These requests are very intensive and (depending on the size and complexity of the environment) can take a considerable amount of time.

In Domino 8, the new names list feature builds a list of author and reader names found in the database, which the AdminP process can then use. If the name is found in the list, the AdminP process will make the appropriate changes to the fields. This new feature will increase the efficiency with which the AdminP process executes name changes throughout the environment. The limitation for the names list is 4K; if the list is larger, the AdminP process reverts to looking through the entire database to identify the fields where the name exists.

If your servers are running Domino 8 and have the new On-Disk Structure (ODS) applied (see the section on the new ODS structure later in this chapter), then the AdminP process will be able to use this new names list feature.

The Lotus Domino environment invokes the AdminP process for executing requests (user renaming, database moves and deletes, and so on) and uses the AdminP database, which is built from the AdminP.ntf template. A replica copy of the database is placed on every server. As AdminP requests are generated, they are recorded on the administration server and then pushed out via replication to the other Domino servers. The servers will then look up and execute the tasks as required.

In Domino 8, requests that are generated for a specific server will be directly placed on that server as long as there is connectivity between the servers. The implementation of placing requests directly on the executing server should speed up the processing of the requests, because the replication of the AdminP database is removed from the process (which can cause some delays due to scheduling issues). There is no dependency on Notes 8 or the Notes 8 template to deliver this functionality, but the source server must be upgraded to Domino 8.

This enhancement of the AdminP process is the default setting in Domino 8. To disable this feature, set the following in Notes.ini:

ADMINP_DONT_ATTEMPT_DIRECT_DEPOSIT=1

Domino Domain Monitoring (DDM) was introduced in Domino 7. The goal of DDM is to reduce the administrative workload required to troubleshoot and manage issues in the Domino environment. Prior to the introduction of DDM, administrators had so as to review a number of sources to collect the appropriate information to conduct problem determination. Domino 8 includes several enhancements to DDM.

WebSphere Services Probe

Domino 8 includes the ability to monitor the Lotus Connections' (the Lotus Connections software is not bundled with Domino, this function only enhances the monitoring capabilities) Activities function, which is hosted on a WebSphere server. A new WebSphere Services probe has been introduced so as to give the Domino administrator the ability to monitor the connectivity status of the activities servers.

LDAP Search Reporting

Domino provides a robust LDAP server built into its base server functionality. As more and more environments become dependent on the LDAP services provided by Domino, it is important to ensure that searches are completed with appropriate response times. The new LDAP Search Response probe allows you to monitor and track response times as they relate to LDAP searches.

Common Actions Quick Access Feature

The DDM database within the Domino 8 environment provides a set of common tasks that are performed by administrators. From within the DDM database, you can simply click on the Common Actions drop-down menu and access routine administrative actions without switching to another view or client.

By Database View

Working through the DDM database can be difficult when you are trying to work on specific issues related to a single database. In Domino 7, administrators were required to search through the database or create a custom view and then maintain that view as new releases of the product were deployed. The new By Database view allows you to research specific issues related to a troublesome database or respond to a customer issue without having to ensure that the view is brought forward if it was customized in previous versions.

Other Domino 8 administration features include Domino Administrator integration with IBM CommonStore Archive Services, Web Administration Server Bookmarks, automatic report closing (administration probe subtype); execute CA role, modular documents, and others. For a more complete review of the DDM features, you should refer to the Domino 8 Administrator Help.

The cluster replication process moves information between the cluster member servers to ensure that, in case of a server outage, users maintain access to the most up-to-date information. As a new item is received on one server, the cluster replication process pushes the information to the other server. A typical configuration of the cluster replication task is to have one instance enabled on each server. You can increase the number of cluster replication tasks within the environment, but doing so increases disk I/O requirements, and this may have an effect on performance.

Domino 8 introduces a new feature for the cluster replication process, streaming replication. Streaming replication allows for the immediate transfer of information from one server to its cluster mate, without requiring the server to write to disk. The replication process occurs within the memory, thereby reducing I/O requirements. Cluster replications works closely with the normal replication process to ensure that the impact on the environment is reduced. Streaming replication is a server-based feature that does not require Notes 8 or the Notes 8 mail template.

Domino 8 includes a new On-Disk Structure (ODS) that will allow the implementation of new features to increase performance and reduce the amount of overhead required to maintain and manage the environment. The new ODS 48 is not a requirement when moving to Domino 8. Instead, it is an option that takes advantage of the design note compression and on demand collation features. To upgrade the databases, add the line Create_R8_Databases=1 to your server's Notes.ini file. To upgrade databases to the new ODS and compress the design, run a copy-style compaction. (The design note compression and view collation features require ODS 48.)

Design Note Compression

Design note compression is a new feature provided in Domino 8 to assist in reducing the space required by the database templates. The compression feature allows design elements to be compressed, thereby reducing disk requirements. Based on preliminary testing, database size could be reduced up to 55% to 60%. Design note compression does not require Notes 8 or the Notes 8 mail template, but since this is a server feature, the Domino 8 server is required.

The Notes/Domino environment allows for feature rich searching capabilities. These capabilities leverage the full text index created for a database. If a full text index has not been created when the user searches for the information, the server attempts to locate the information within the database. The process of searching the database without a full text index can significantly impact the performance of the server. In Domino 8, a new enhancement is introduced so as to eliminate the use of simple search and thus increase server performance.

By checking the Don't Allow simple search checkbox within the database properties tab, you can significantly enhance performance. If the database does not have a full text index and this feature is enabled, the end user will receive an error and the search will not be completed for the database.

There are a number of other new performance-related features and enhancements in Domino 8. These include improved server availability in a cluster and critical request scheduling.

One of the most complicated problems to solve when implementing Domino (or any system that requires a directory to function) is locating the single authoritative source to use for access or identity management. Tivoli Director Integrator (TDI) is a directory integration engine that provides a system that allows business rules to be applied to synchronize data in any direction. TDI provides different "assembly lines" (integration components that use the TDI API to connect various stores so as to allow TDI to apply those business rules).

For example, if you have Microsoft Active Directory for file and print services, an LDAP store for web authentication, SAP or Peoplesoft for HR, or Lotus Domino, then TDI will allow granular control of user properties across all systems with TDI serving as the arbiter and synchronizing "master".

This applies to Domino as follows. With email, every message or calendar invitation that is sent requires a directory lookup to find the recipient for delivery. In typical organizations, the email directory and the authoritative directory are not the same. Domino 8 includes a license for TDI to synchronize these directories in a manner that previously has been extremely difficult and expensive.

The following illustration shows a connection from Microsoft Active Directory as the directory partner for Lotus Domino, where directory entries flow bi-directionally between the two systems.

Previous versions of Domino included a tool known as ADSynch to perform a similar function. However, this tool was not as flexible or scalable as TDI. As the name suggests, ADSynch only synchronizes Active Directory and Domino. TDI can connect to nearly any system.

This model provides a single user interface for ID generation and management. If a user is created on either side, IDs and ancillary entries are created on the other. This could be with two systems as illustrated above, or with many systems and entries flowing to all the other systems user-specific attributes as defined by TDI.

When implementing Notes/Domino 8 in a "green field" environment or as a migration, the directory integration piece is a primary component, not just another feature to be added. With the addition of TDI, Notes/Domino 8 lets you bring in many different directories and provide services much more easily than before. However, this does not mean that directory integration should be considered less important just because it's not as difficult. Disparate directories in organizations today are more prevalent than five years ago, so this directory integration functionality has become more logistically complicated, as tools such as TDI have evolved to make the technical aspects simpler. (For a more complete review of the TDI features and functionality, you should refer to the IBM Tivoli Directory Integrator documentation.)

Domino 8 introduces a new tool called DirLint. This tool lets you verify the information that is contained within the directory. It runs against the directory and helps you identify issues, including invalid syntax in names and issues with the naming hierarchy scheme. It also validates that users' names found in groups through Directory Assistance are consistent.

DirLint is a command line utility that is loaded by simply typing, "load dirlint" on the server console. It provides an XML document as output. This document can be read using any Internet web browser.

The information that is produced will be stored in \DominodataIBMIBM_TECHNICAL_ SUPPORTlintout_(ServerName)_(Date) as shown above. An example of the information provided in the XML file is as follows:

In previous releases of Domino, Directory Assistance provided all directories for both authentication and name resolution when addressing messages. This created a situation where ambiguous names would be displayed while a message was being addressed if there was an "authentication only" directory included in the Directory Assistance task. In Domino 8, you have the option through Directory Assistance to specify that the server only references directories contained within the document during the authentication process. This allows you to effectively deploy Directory Assistance for authentication without affecting end users during the addressing of messages.

Domino 8 offers configuration wizards for LDAP directories. In previous releases, you needed to know a significant amount of information about the LDAP directories that were being connected via Directory Assistance. You still need to understand basic Directory Assistance and LDAP concepts, but the new Suggest and Verify buttons on the configuration document help you complete the document thus ensuring the proper connectivity to the LDAP servers. Some of the wizard buttons run scripts on the Domino server or connect to the LDAP server directly.

As users log into Domino, the AdminP process captures the Notes version used to access the server. The information is stored within the Person documents in the Domino Directory.

The new People | by Client Version view allows you to go to the Domino directory and identify the clients that the users are using to access the server. In previous releases, this was a custom view that was needed to be developed and maintained.

Domino 8 now offers an Internet password lockout feature. This feature provides a mechanism (via the inetlockout.nsf database) to track all access attempts to the HTTP environment so that the status of the login attempt is logged. The creation of the Internet lockout database can be done manually, during server startup after the process has been configured, upon the first request to view a document, or when a document needs to be created within the database. The only caveat is that the service must have been running for a period of 10 minutes if the server is not to be rebooted.

The Internet password lockout feature can be enabled for the entire environment through a configuration document, or via a policy that more granularly assigns the ability to lockout users from the HTTP access. The configuration setting does the following:

The lockout feature only applies to HTTP access, and traditional anti-spoofing mechanism is leveraged within the rich Notes client so that services such as LDAP, POP, IMAP, DIIOP, Lotus Quickplace, and Lotus Sametime are currently not supported with this feature. If your Domino environment is using a customized DSAPI filter, there is a possibility that the Internet password lockout feature will not function, because customized DSAPI filters can be coded to bypass the standard Domino login facility.

When configuring Internet password lockout via a security policy, the same options are presented as with the configuration document.

It is important to note that enabling this feature could increase the initial call volume to your Help desk or the administrative overhead required to manage passwords if the HTTP password feature is used significantly within the organization. Also, malicious attacks can occur on the Domino servers through denial of service attacks. This type of an attack could significantly reduce effectiveness within the environment.

In Domino 8 the encryption level for all new databases will be set for strong encryption. The ability to encrypt databases with an end user's ID to prevent access by other users' IDs is necessary so as to ensure the protection of data once a database is brought to the local workstation. In previous releases, databases had the ability to be encrypted at the simple, medium, or strong levels, depending on the needs and requirements of the environment and the end users. Domino will still provide backwards compatibility for the simple and medium encryption models, but going forward, all new replicas will be encrypted as strong.

Domino administrators can assign a new set of public and private keys to a Domino certificate authority. These keys are used to certify the keys of OUs, servers, and users in that organization. The process of assigning news keys is known as key rollover. Rolling over a CA key may become necessary if the current key is considered too short for adequate encryption, the current key is too old, or if the value of the current private key has been compromised.

When an administrator assigns a new set of keys to a Domino certificate authority, they are created and self-certified and added to the top-level certifier ID file in the pending key area of the ID file. The keys that were previously used are added to the archived keys area of the ID file, and rollover certificates binding the new and old keys are added to the rollover certificate area of the ID file.

In order to support certifier key rollover, the Domino trust model has been extended to include a new type of certificate, rollover certificates. These certificates are issued by an entity to itself. In a hierarchical certificate, there is a single issuer name, a single subject name, and a single subject key. In a rollover certificate, there is a single name (which is both the issuer and the subject) and two subject keys; one key is used to sign the certificate and attests to the fact that the subject name is legitimately in possession of the other key.

Generally, when a key is rolled over, two roll-over certificates are issued; one of them is signed by the old key saying that the new key is valid, and the other is signed by the new key saying that the old key is valid. Each certificate has its own expiration date.

Rollover certificates are essential for limiting the expiration dates of certificates issued to the older keys. One of the reasons for rolling over a key is that a former key has been compromised or considered to be old enough for the danger of compromise to be unacceptable. In such cases, limiting the expiration date of a rollover certificate limits the lifetime of a formerly issued child certificate. This is done by specifying an early enough expiration date in the rollover certificate.

Multi-server session-based authentication, also known as single sign-on (SSO), allows web users to log in once to a Domino or WebSphere server, and then access any other Domino or WebSphere servers in the same DNS domain that are enabled for SSO without having to log in again. The SSO feature makes logging in and using multiple servers in a mixed environment easier for users. Web browsers must have cookies enabled since the authentication token that is generated by the server is sent to the browser in a cookie.

SSO may be set up by creating a domain-wide configuration document in the directory and enabling the multi-servers option for session-based authentication in a web site or a server document.

The Online Certificate Status Protocol (OCSP) enables applications to determine the revocation state of an identified certificate. OCSP checks are made during S/MIME signature verification and mail encryption by the Notes client. OCSP is enabled through a policy, using the Enable OCSP checking setting on the Keys and Certificates tab.

Other new Domino 8 directory/security features include LDAP server improvements for WebSphere Member Manager (WMM) and larger key support.

Lotus Domino 7 introduced the ability to use IBM DB2 software as an alternative to the Lotus Notes storage facility (NSF) for storing Lotus Domino data on a per-database basis. This feature, called the Lotus Domino and DB2 feature, enables you to use both DB2 and Lotus Domino databases, accessing and viewing data stored in either format.

When you run Domino with DB2, there are three distinct interactions that occur between Domino and DB2:

Domino 8 introduces two new features for integration with DB2:

A future release of WebSphere Portal will introduce an enhanced integration wizard that reduces the complexity required to enable Lotus Domino 8 and WebSphere Portal integration. This includes the setting up of the Common PIM (personal information management) portlets (CPP) and the Lotus Domino Extended Products portlets (DEPP).

The wizard will automate the following

Perhaps the most dramatic improvement is the Notes 8 rich client. Notes and Domino 8 software makes it easy for you to integrate line-of-business solutions and data into a new class of applications, called composite applications. Both Domino 8 and WebSphere Portal 6 servers can host composite applications. This will allow clients to run both Domino applications and portlets (as well as servlets and Internet applications). The following diagram depicts the Notes/Domino infrastructure, a rich client, as well as a web client and necessary components to facilitate this architecture.

The Tivoli Enterprise console consolidates events from networks, hardware, and software throughout the environment, and presents them in a single monitoring interface. Domino 7 allowed you to configure events generated by operating system probes to be viewed with other events in the Enterprise console.

Domino 8 allows you to configure any events to be forwarded to the Enterprise console. The first thing you need to do is configure the connectivity to the Tivoli Enterprise Console through the Lotus Domino server configuration document.

It is then necessary to forward the events to the Tivoli Enterprise Console. You do this by configuring the events.nsf database so as to describe the proper Event Handler documents required by the Enterprise console.