Integrating SailPoint with HCL Domino

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an HCL Domino connector.

Supported Features

The HCL Domino connector supports the following features:

• Load HCL Domino Accounts
• *Provision Lotus Domino Accounts
• *Access Certifications (certification of entitlements connected to accounts)
• *Password management
• Delete Account

For more information on features, refer to Source Features.

Password Management

After enabling password management on the source, be aware of the following:

• SailPoint only supports password management for the HTTP password in HCL Domino.
• IQService and related fields are required for Password Management.
• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for apps connected to this source, the change will automatically be made to the source itself.

Refer to Password Management Overview for more information.

Supported Managed Systems

• HCL Domino 14.0
• HCL Domino 12.0.2
• HCL Domino 12.0
• HCL Domino 11.0
• Domino Server 10.0.x (now known as HCL Domino)
• Domino Server 9.0.x (now known as HCL Domino)

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• A HCL Notes that has the same version as the HCL Domino Server.
• Microsoft.NET Framework 4.5.2.
• Microsoft Visual Studio C++ 2015 - 2022 Redistributable 14.0 onwards.
• The PATH environment variable must contain the Notes data folder. For example, C:\Program Files (x86)\HCL\Notes

• Install IQService. For more information, refer to Installing and Configuring IQService.

  Important

  IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to Configuring TLS and Client Authentication for IQService.

  • IQService (32 Bit) needs to be installed on any Windows Server if it has HCL Notes client installed on it.

• Ensure that Domino Server notes.ini file contains the following line:

  ServerTasks=<any other tasks>, DIIOP, HTTP
  

  The HTTP task is required only if the DIIOP port is not a part of the HostName in the Application attributes.

• In the Domino Server, select Server > Full Access Administrators. This list should have the name of the user that is being used to open a session with the server.

Secure HCL Domino Source

The IQService is a native Windows service that enables this connector to participate in a Windows environment and access information only available through Windows APIs.

If you are running a 32-bit version of HCL Notes (i.e. version prior to HCL Domino Client 14.0), IQService must be running as a 32-bit process to interact with 32-bit HCL Notes. If IQService must be installed on a 64-bit Windows system, perform the following before installing the IQService:

1. Download Microsoft Windows SDK or .NET Framework SDK.
2. Extract the IQService zip file into a temporary folder. For example, C:\temp

3. Run the following command from the command prompt:

   <SDK Bin>\CorFlags.exe C:\temp\IQService.exe /32BIT+
   

   For example,

   C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\x64>CorFlags.exe
   C:\temp\IQService.exe /32BIT+
   

   This command converts the IQService.exe to a 32-bit application.

4. Copy all the files from C:\temp to the C:\Program Files (x86)\HCL\Notes path.

5. Install and start the IQService. For more information on IQService installation steps, refer to Installing and Configuring IQService.

IQService must be installed before performing the following operations:

• Sync ID file
• Delta aggregation
• Upload ID file to vault
• ID file password change through self-service
• Helpdesk HTTP (Internet) password change
• Get ID file from vault
• Reset password of an ID file stored in an ID vault
• Password management
• ID vault operations
• Before and after script

There are two possible communication paths involved based on the following options. SailPoint recommends that you secure these paths for overall security of the HCL Domino Source.

• Source (VA) and IQService - Use TLS configuration between source (VA) and IQService to secure this path. For more information, refer to TLS Configuration on Virtual Appliances.
• IQService and HCL Domino managed system - Use TLS configuration between IQService and Target System to secure this path.

Required Permissions

The Administrator user must have Manager Access to the following databases on Domino Server:

• Public Address Book (PAB) Database (default name is names.nsf)
• Administration Requests Database (default name is admin4.nsf)
• Certification Log Database (default name is certlog.nsf)

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.