Lotus Domino Administrator 7 Help - Lotus documentation

Organization certifier ID
The organization certifier appears at the top of the name tree and is usually the name of the company --
for example, Acme. During first server setup, the Server Setup program creates the organization certifier
and stores the organization certifier ID file in the Domino data directory, giving it the name CERT.ID.
During first server setup, this organization certifier ID automatically certifies the first Domino server ID
and the administrator’s user ID.
If your company is large and decentralized, you might want to use the Domino Administrator after
server setup to create a second organization certifier ID to allow for further name differentiation -- for
example, to differentiate between company subsidiaries.
For more information on working with multiple organizations, see the topic ″Domino domains″ earlier in
this chapter.
Organizational unit certifier IDs
The organizational unit certifiers are at all the branches of the tree and usually represent geographical or
departmental names -- for example, East/Acme or Sales/East/Acme. If you choose to, you can create a
first-level organizational unit certifier ID during server setup, with the result that the server ID and
administrator’s user ID are stamped with the organizational unit certifier rather than with the
organization certifier. If you choose not to create this organizational unit certifier during server setup, you
can always use the Domino Administrator to do it later -- just remember to recertify the server ID and
administrator’s user ID.
For information on recertifying user IDs, see the chapter ″Setting Up and Managing Notes Users.″ For
information on recertifying server IDs, see the chapter ″Maintaining Domino Servers.″
You can create up to four levels of organizational unit certifiers. To create first-level organizational unit
certifier IDs, you use the organization certifier ID. To create second-level organizational unit certifier IDs,
you use the first-level organizational unit certifier IDs, and so on.
Using organizational unit certifier IDs, you can decentralize certification by distributing individual
certifier IDs to administrators who manage users and servers in specific branches of the company. For
example, the Acme company has two administrators. One administers servers and users in West/Acme
and has access to only the West/Acme certifier ID, and the other administers servers and users in
East/Acme and has access to only the East/Acme certifier ID.
Certifier security
By default, the Server Setup program stores the certifier ID file in the directory you specify as the
Domino data directory. When you use the Domino Administrator to create an additional organization
certifier ID or organizational unit certifier ID, you specify where you want the ID stored. To ensure
security, store certifiers in a secure location -- such as a disk locked in a secure area.
User ID recovery
To provide ID and password recovery for Notes users, you need to set up recovery information for each
certifier ID. Before you can recover user ID files, you need access to the certifier ID file to specify the
recovery information, and the user ID files themselves must be made recoverable. There are three ways to
do this:
v At user registration, create the ID file with a certifier ID that contains recovery information.
v Export recovery information from the certifier ID file and have the user accept it.
v (Only for servers using the server-based certification authority) Add recovery information to the
certifier. Then, when existing users authenticate to their home server, their IDs are automatically
updated.
For more information, see the chapter ″Protecting and Managing Notes IDs.″
6 Lotus Domino Administrator 7 Help