Front cover - IBM Redbooks

450 Lotus Security Handbook
organization uses. In addition, the service provider administrator must create and
maintain a mechanism that the hosted organization's administrators use to
communicate problems and issues that require the intervention of the service
provider administrator.
Securing the Domino service provider environment
The Domino service provider environment uses all of the standard Domino
security features to ensure complete security for the service provider and the
hosted organizations that subscribe to the service provider’s services. An xSP
environment that has multiple hosted organizations has potentially thousands of
users whose access must be restricted to their own data only.
In addition, the service provider configuration uses extended ACLs in the Domino
Directory to protect the data of each hosted organization from access by users in
other hosted organizations. The extended ACLs required to support the xSP
security model are automatically established when new hosted organizations are
created. Plan and test carefully if you want to modify ACLs and extended ACLs in
an xSP environment – security is extremely important.
The authentication controls in Site documents control only who can authenticate
and use the Internet protocols. After authentication, ACLs and extended ACLs
control the data that can be read from and written to the Domino Directory.
A user in a hosted organization cannot directly access databases in any
subdirectories other than the hosted organization's directory. Exceptions are the
“help” and “common” subdirectories of the Domino data directory, which contain
databases accessible to users in all hosted organizations.
To provide users with access to databases outside those of the hosted
organization's subdirectory, create a directory link within the hosted
organization's directory.
11.4 Roaming users
New for
Domino 6
Users who access Notes from more than one Notes client can access their
customized settings and personal information automatically from any Notes
client in the domain. Data for these users, known as roaming users, replicates
between the user's machine and a roaming user server, where these files are
stored. When a roaming user logs on from a different Notes client, it
automatically retrieves the user's ID file, Personal Address Book, bookmarks,
and journal from the roaming user server. Any changes the user makes in these
files replicate to the roaming user server. This enables the roaming user to have
a consistent experience from any Notes client.