Tivoli Directory Integrator

1
Tivoli Directory Integrator

• Bi-directionalActive Directory Domino
  Sync(part II how to build it)Eddie
  Hartmaneddie.hartman_at_no.ibm.com2007.03.07
  using TDI 6.1.1

2
Bi-directional AD - Domino Sync
TDI
Applications
Sync adds/mods/deletes to Domino
AD change connector
Domino Usersconnector
ActiveDirectory
LotusDomino
Sync change to mail address back to AD
Domino changeconnector
LDAPconnector

• In this scenario, users are managed in AD and
  need to be synchronized with Domino
• All data is pushed into Domino when new Users are
  added in AD.
• E-mail is owned by Domino, so changes in AD
  will not overwrite the Internet Address in
  Domino.
• Changes to the internet mail address in Domino
  are synced to AD.
• Any of the above logic can be easily and quickly
  modified and extended.

3
Agenda

• Preparation
• Set up the Connectors
• Build the AD -gt Domino AssemblyLine
• Build the Domino -gt AD AssemblyLine

4
Preparation

• Set the System Store in network mode.Used to
  persist synchronization state.
• For Domino access via local Notes clientGive
  TDI access to the Notes.jar file

5
Set up the Connectors

• Domino
• Domino Users Connector
• Domino Change Detection Connector
• ActiveDirectory
• LDAP Connector
• AD Changelog v2 Connector

6
Build AD -gt Domino AL

• Detect changes in AD
• IF change is an add or modify then update to
  Domino
• ELSE IF change is a delete then delete from
  Domino

7
AD -gt Domino AL
Active Directory
ChangeDetection Connector
Do not overwrite mail address in Domino
No
If delete
Yes
DeleteModeConnector
UpdateModeConnector
Domino
8
Build Domino -gt AD AL

• Detect changes in Domino
• IF change is an modify to mail address then
  update to AD
• ELSE IF change is an add or delete then what?
  (log it? report it? ...)

9
AD -gt Domino AL
ChangeDetection Connector
Domino
Only write changes to the mail address
No
If modify
Yes
Active Directory
UpdateModeConnector
HandlethisError
10
Linking diverse data sets

• In order to handle deletes, we stored
  objectGUIDstr from AD in Domino
• However, objectGUIDstr is just a string
  representation of a binary attribute in AD...so
  we cant search in AD using the string value we
  put in Domino
• So we need to store the directory pointer to
  each AD User entry (the dn) as well.