Configuring the Lotus Domino server

  1. In the LD Admin Tool, configure and activate the DIIOP and HTTP services. Add the services to the file notes.ini unless you have already done so during the installation process.
    The port number of the DIIOP service (e.g., 63148) is part of the host name that will have to be entered in the "host" field in the global JustRelate configuration dialog.
  2. The DIIOP service uses an access mask. You can enter "*" (all) or individual CRM users. Users need an internet password. This is the same password CRM users need to enter in the user-specific config­uration dialog.
  3. Lotus Domino server requires a temporary directory to exchange attachments, for example. Specify the directory name in the file "notes.ini" using the Notes_TempDir variable.

Encrypted connection

For server-side synchronization in cloud solutions, a secure connection (HTTPS and DIIOPS) between the CRM (cloud) server and (in-house) Lotus Notes Domino Server is supported.

In this context, also note the firewall rules on the Domino machine so that port 63149 in particular can be reached (HTTP: Port 80, HTTPS: 443, DIIOP: 63148, DIIOPS: 63149).

Some administrative steps are required to operate the Domino Connector via HTTPS and DIIOPS:

Setting up SSL operation according to IBM documentation

Attention

Attention: There are substantial differences between Domino 8.5.x and 9.0.x (from FixPack 6)!

In any case, the Domino server must be equipped with an SSL/TLS certificate, and both HTTPS and DIIOPS must be activated.

Note: HTTP[S] is required to fetch the “IOR” descriptor (Interoperable Object Reference) from the Dom­ino server.
DIIOP[S] is the CORBA protocol used for data exchange.

Encryption

The IOR Descriptor could be fetched unencrypted via HTTP. However, since the user data should always be transferred encrypted (i.e., with DIIOPS), it is strongly recommended to always use HTTPS and DIIOPS together.

Setting up SSL operation

Domino 8.5x

Domino 9.0x

Properly set the variable DIIOP_DUP_KEYRING in the notes.ini file.

This causes the Domino server to generate a distinguishable Java class file with the SSL certificate of the server. The jar file “PsaGwcLtdCert.jar” is then created from this file (or these files if several Domino servers are in use) using the Java “jar” tool and stored next to the jar file of the Domino connector (e.g. “PsaGwcLt­d_1.3.4.jar”) in the “ext” folder of the PSA server.

A root certificate is required.

In every case, the file “dominocertsconfig” must be cre­ated in the JRE directory of the PSA server as described.

The access libraries “NCSO.jar” are not compatible if SSL/TLS is to be used!

For operation with an 8.5 Domino server, the version of this server must be used.

For operation with a 9.0 Domino server, its version of NCSO.jar is required.

This is an important limitation! Mixed operation (Domino 8.5.x and 9.0.x) is not possible if SSL/TLS (HTTPS and DIIOPS) are to be used!

Global Groupware configuration in the CRM

In the Global Groupware Configuration, set the “Type” LTD to Lotus Domino and switch on HTTPS and DIIOPS.

Domino 8.5.x requires the name of the certificate class (see DIIOP_DUP_KEYRING).

For Domino 9.0.x, the supply of the JRE (see above) is sufficient.

Master account

If you want to use a master account, create it in Domino and provide it with the required permissions for accessing the Domino databases of the individual Domino users (pure Domino administration).

If the physical server and location of the DB files rarely change, if at all, then a correspondingly high value can be entered for “Validity of results” (time in hours, e.g. 168 for seven days or more). This specification determines how often Domino fetches the user settings.