Front cover - IBM Redbooks

gets the user's Notes ID out of sync, which in the long run will cause lockout
issues for the user.
Since client-side warnings occur before the user accesses the server (for
example, “Warning: Your password will expire on dd/mm/yy”) disabling password
checking in the Server document will not suppress these warnings. It will,
however, allow the Notes user ID to continue to gain access to the server even if
the password has expired. To remove the warnings, the user should continue to
change passwords at the frequency of the Last Change Date, Grace Period, and
Expiration Date values stored in the ID.
Note: Clearing the Last Change Date in the person document is not sufficient
to unlock a user ID and allow them to log back into the server.
Should the administrator need to lock a specific user out of the server, they can
submit an adminp request to “Lockout the user.” When adminp processes the
request the person document is modified so that the “Check Passwords” field is
set to Lockout ID. When the user tries to access this server again they will
receive an error message like the one shown in Figure 11-20.
Figure 11-20 Authentication denied dialog box (user lockout)
Throughout this example we have concentrated on a single server installation.
With a multiple server install there are some “gotcha's” that may deny users
access to certain servers. Since all the changes are made in the administration
server’s names.nsf file, Domino relies on replication to ensure that other servers
receive updates. Modifying a person document (for example, clearing the
password digest) to reset a user account on one server will give the user back
their access to all the other servers that have password checking enabled, but
only after the Domino Directory has replicated the changes out.
In pre-rollout testing, customers may experience behavior different to that
documented here. The common problems are that adminp requests do not get
processed before test results are recorded. It its also not recommended to test
password checking with Grace Periods and Change Intervals of only 1 or 2 days.
Before each step you should confirm that the pending adminp requests for the
user being accepted are being processed. This also applies to production
Chapter 11. Domino/Notes 6 security features 497