1. ® Tivoli Directory Integrator IBM Software Group Tivoli Directory Integrator Bi-directional Active Directory – Domino Sync (part II – how to build it) Eddie Hartman eddie.hartman@no.ibm.com 2007.03.07 using TDI 6.1.1 eddie.hartman@no.ibm.com ®

2. Tivoli Directory Integrator IBM Software Group 2 Bi-directional AD - Domino Sync In this scenario, users are managed in AD and need to be synchronized with Domino 1.All data is pushed into Domino when new Users are added in AD. 2.E-mail is ”owned” by Domino, so changes in AD will not overwrite the ”Internet Address” in Domino. 3.Changes to the internet mail address in Domino are sync’ed to AD. 4.Any of the above logic can be easily and quickly modified and extended. TDI AD change connector Domino Users connector Sync adds/mods/deletes to Domino LDAP connector Domino change connector Active Directory Applications Lotus Domino Applications Sync change to mail address back to AD

3. Tivoli Directory Integrator IBM Software Group 3 Agenda Preparation Set up the Connectors Build the AD -> Domino AssemblyLine Build the Domino -> AD AssemblyLine

4. Tivoli Directory Integrator IBM Software Group 4 Preparation Set the System Store in network mode. Used to persist synchronization state. For Domino access via local Notes client: Give TDI access to the Notes.jar file

5. Tivoli Directory Integrator IBM Software Group 5 Set up the Connectors Domino Domino Users Connector Domino Change Detection Connector ActiveDirectory LDAP Connector AD Changelog v2 Connector

6. Tivoli Directory Integrator IBM Software Group 6 Build AD -> Domino AL Detect changes in AD IF change is an add or modify then update to Domino ELSE IF change is a delete then delete from Domino

7. Tivoli Directory Integrator IBM Software Group 7 Domino AD -> Domino AL If delete Change Detection Connector Delete Mode Connector Update Mode Connector Yes No Do not overwrite mail address in Domino Active Directory

8. Tivoli Directory Integrator IBM Software Group 8 Build Domino -> AD AL Detect changes in Domino IF change is an modify to mail address then update to AD ELSE IF change is an add or delete then what? (log it? report it?...)

9. Tivoli Directory Integrator IBM Software Group 9 AD -> Domino AL If modify Change Detection Connector Update Mode Connector Handle this Error Yes No Only write changes to the mail address Domino Active Directory

10. Tivoli Directory Integrator IBM Software Group 10 Linking diverse data sets In order to handle deletes, we stored objectGUIDstr from AD in Domino However, objectGUIDstr is just a string representation of a binary attribute in AD...so we can’t search in AD using the string value we put in Domino So we need to store the directory ’pointer’ to each AD User entry (the ’dn’) as well.