Front cover - IBM Redbooks

8.3.6 Event-driven synchronization
8.3.7 Tools
326 Lotus Security Handbook
Events can be described as the circumstances dictate when one set of data
sources communicates with another. One example is whenever an employee is
added to, updated within, or deleted from the HR system. Another example is
when the access control system detects a keycard being used in a restricted
area. An event can also be based on a calendar or a clock-based timer, for
example, starting communications at 12:00 midnight every day except Sunday. It
might even be a one-off event, for example, populating a directory.
Events are usually tied to a data source, and are related to the data flows that are
triggered when the specified set of circumstances arise.
There are several tools available for directory synchronization. In this section, we
describe three tools that are currently available from IBM that support directory
synchronization between Lotus Domino and other third-party directories.
ADSync
The Active Directory Synchronization tool, or ADSync, allows Active Directory
administrators to manage (register, delete, and rename) users and groups in
both Active Directory and the Domino Directory as a unified operation from the
Active Directory Users and Computers Console.
To use Lotus Active Directory Synchronization, the Domino Administration client
must be installed on the same workstation used to manage users and computers
within your Active Directory. ADSync, despite its name, is not actually a directory
synchronization tool. It is more like an administrator client “conduit” that lets
Windows administrators manage both Domino Directory and AD users from a
single user interface. Domino and Windows each have their own credentials,
management consoles, and directories. ADSync links the two on a single
machine, so changes made to AD are pushed to Domino using an installed but
essentially hidden Domino Administrator client. In other words, it performs
administrator functions simultaneously, and hides the secondary changes to
Domino from the administrator’s screen.
ADSync is a new feature included with Domino 6. With it, you can create new
users and groups in Active Directory and have those changes reflected in the
Domino Directory, including the creation of person or group documents, Notes
IDs, passwords, and mail files for the users. In order to accomplish these tasks,
the Active Directory administrator must have a properly certified Notes ID and
appropriate access to make changes in the Domino Directory. The registration
server must be Domino 6 or later and the Domino Administration client must be a
6 or later client. Additionally, policies must be created that contain sub policies,