Tivoli Directory Integrator

IBM Software Group

Tivoli Directory Integrator

Bi-directional Active Directory Domino Sync (part II how to build it)
Eddie Hartman
2007.03.07 using TDI 6.1.1

eddie.hartman@no.ibm.com

Tivoli Directory Integrator

IBM Software Group

Bi-directional AD - Domino Sync

TDI
Applications Sync adds/mods/deletes to Domino
AD change
connector

Applications

Domino Users
connector

Active Directory Sync change to mail address back to AD

LDAP
connector

Lotus Domino

Domino change connector

In this scenario, users are managed in AD and need to be synchronized with Domino 1.All data is pushed into Domino when new Users are added in AD. 2.E-mail is owned by Domino, so changes in AD will not overwrite the Internet Address in Domino. 3. Changes to the internet mail address in Domino are synced to AD. 4.Any of the above logic can be easily and quickly modified and extended.

Tivoli Directory Integrator

IBM Software Group

Agenda
Preparation Set up the Connectors Build the AD -> Domino AssemblyLine Build the Domino -> AD AssemblyLine

Tivoli Directory Integrator

IBM Software Group

Preparation
Set the System Store in network mode. Used to persist synchronization state. For Domino access via local Notes client: Give TDI access to the Notes.jar file

Tivoli Directory Integrator

IBM Software Group

Set up the Connectors

Domino
Domino Users Connector Domino Change Detection Connector

ActiveDirectory
LDAP Connector AD Changelog v2 Connector

Tivoli Directory Integrator

IBM Software Group

Build AD -> Domino AL

Detect changes in AD IF change is an add or modify then update to Domino ELSE IF change is a delete then delete from Domino

Tivoli Directory Integrator

IBM Software Group

AD -> Domino AL
Change Detection Connector

Active Directory
No

If delete

Do not overwrite mail address in Domino

Yes
Delete Mode Connector Update Mode Connector

Domino
7

Tivoli Directory Integrator

IBM Software Group

Build Domino -> AD AL

Detect changes in Domino IF change is an modify to mail address then update to AD ELSE IF change is an add or delete then what? (log it? report it? ...)

Tivoli Directory Integrator

IBM Software Group

AD -> Domino AL
Change Detection Connector

Domino

Only write changes to the mail address

If modify

No

Yes
Update Mode Connector Handle this Error

Active Directory
9

Tivoli Directory Integrator

IBM Software Group

Linking diverse data sets

In order to handle deletes, we stored objectGUIDstr from AD in Domino However, objectGUIDstr is just a string representation of a binary attribute in AD
...so we cant search in AD using the string value we put in Domino So we need to store the directory pointer to each AD User entry (the dn) as well.
10