Administering Our Internal IBM Deployment Hybrid Environment SCN Iris. JMP-1560 Lessons Learned John Paganetti IBM Senior Engineer

Transcription

1 Administering Our Internal IBM Deployment Hybrid Environment SCN Iris JMP-1560 Lessons Learned John Paganetti IBM Senior Engineer

2 Please Note: IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here.

3 Abstract JMP1560 Come hear an IBM development team member share his experiences administering a small internal hybrid environment. By utilizing our long standing on-premise development, Iris Domain, and building out a private cloud in Softlayer, affectionately know as SCN Iris, we help validate early releases of code in the service including Verse betas. We also utilize the Mail Onboarding Manager (MOM) tool for migrating real production users (well mostly developers, myself included) into SCN Iris while providing feedback along the way. We will share some of the recommended best practices and a variety of lessons learned along the on-going journey!

4 Notices and Disclaimers Copyright 2015 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS DOCUMENT IS DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL IBM BE LIABLE FOR ANY DAMAGE ARISING FROM THE USE OF THIS INFORMATION, INCLUDING BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFIT OR LOSS OF OPPORTUNITY. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law

5 Notices and Disclaimers cont. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. IBM, the IBM logo, ibm.com, Aspera, Bluemix, Blueworks Live, CICS, Clearcase, Cognos, DOORS, Emptoris, Enterprise Document Management System, FASP, FileNet, Global Business Services, Global Technology Services, IBM ExperienceOne, IBM SmartCloud, IBM Social Business, Information on Demand, ILOG, Maximo, MQIntegrator, MQSeries, Netcool, OMEGAMON, OpenPower, PureAnalytics, PureApplication, purecluster, PureCoverage, PureData, PureExperience, PureFlex, purequery, purescale, PureSystems, QRadar, Rational, Rhapsody, Smarter Commerce, SoDA, SPSS, Sterling Commerce, StoredIQ, Tealeaf, Tivoli, Trusteer, Unica, urban{code}, Watson, WebSphere, Worklight, X-Force and System z Z/OS, are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at:

6 Agenda Hybrid IBM SmartCloud Notes IBM Mail Onboarding Manager Tool Common Administration Tasks Interesting Administration Tasks

7 Hybrid IBM SmartCloud Notes A SmartCloud Notes (SCN) hybrid environment allows integration between your on-premises Domino systems and the cloud. Replicating your Domino Directory to the cloud provides for a seamless integration between environments. On-premises Domino administrators continue to administer onpremises Domino servers and applications. IBM administers and maintains the SCN mail servers in the cloud.

8

9 Hybrid IBM SmartCloud Notes Users can access their SmartCloud Notes mail using: IBM Verse IBM Verse Mobile Apple ios (iphone and ipad ) and Android IBM Notes Client IBM inotes IMAP Clients IBM Mail Support for Microsoft Outlook (coming soon) Users can access mail one, two or all ways simultaneously

10 IBM SmartCloud Notes Administration: Hybrid Environment Welcome to the administration documentation for SmartCloud Notes in a hybrid environment. This documentation describes how to plan for, deploy, and administer SmartCloud Notes in a hybrid environment. In a hybrid environment, the cloud service interacts with an on-premises IBM Domino domain at a company site.

11 Course: Hybrid IBM SmartCloud Notes In this course you will learn how to configure and administer IBM SmartCloud Notes in a hybrid environment, as well as support end users and configure the Traveler service and IBM SmartCloud Notes for BlackBerry Hosted Services.

12 IBM SCN Hybrid Environment On-Premises Additions Mail Routing Hub Recommend two for failover Directory Sync Server Recommend two for failover Passthru Domain Passthru Server Recommend two for failover

13

14 IBM SCN Hybrid Environment On-Premises Additions Domino Directory Synchronization Server(s) An SCN directory server will have a replica of one or more onpremises Domino directories and performs a regular pull and push replication of the directories to keep the contents of the SCN replicas and on-premises replicas synchronized Recommend two for failover

15 IBM SCN Hybrid Environment On-Premises Additions Mail Routing Hub Server(s) SCN servers and on-premises IBM Domino servers route mail to each other. You can have one or more IBM Domino servers to use as the on-premises mail routing server. Recommend two for failover

16 IBM SCN Hybrid Environment On-Premises Additions Mail Routing and Directory Synchronization Server(s) Optionally, if you are limited in the number of Domino servers, you can utilize the same servers to perform mail routing and directory synchronization

17 IBM SCN Hybrid Environment On-Premises Additions Passthru Domain The Passthru Domain is the Domino domain in which the IBM Domino Passthru servers reside. The IBM Domino Passthru Server(s) must be in a separate Domino domain from the other LLN servers. The Passthru Domain acts as the intermediary point between incoming connections from the SCN servers and the onpremises Domino servers. Important: For security reasons, Passthru servers are set up in a unique onpremises domain that does not hold your directory synchronization servers or mail hub servers. For optimum security, configure your corporate firewalls so that connections to the passthru servers occur in your corporate demilitarized zone.

18 IBM SCN Hybrid Environment On-Premises Additions Passthru Server(s) The Domino server used as the on-premises passthru server to allow SCN servers to connect to other on-premises servers. All connections from hosted SCN servers to on-premises servers are directed through a IBM Domino Passthru server to ensure secure connections. An SCN hybrid environment must have at least one Passthru server. If there will be a high volume of traffic between the two environments, set up at least two Passthru servers to minimize delays due to mail routing failover. The Passthru Server should be in a different Domino domain than the main on-premises domain. The Passthru Server Domain should be registered in the Domino Directory

19 Passthru Domain Server Documents

20 Passthru Domain Connection Records

21 Server Record -> Security Tab -> Passthru Use

22 IBM SCN Hybrid Environment Cloud Configuration Steps Uploading the certifier id Specifying servers: Passthru Mail Routing Hub Directory Sync Specifying mail server base name Domain Configuration Tool

23 IBM Connections Cloud SaaS Business Support System Business Support System The Business Support System (BSS) is a platform for managing and administering processes that support Software-as-a-Service lotus.com/ldd/appdevwiki.nsf/xpAPIViewer.xsp?lookupName=API+Reference#action=openDocument&res_ title=overview_of_ibm_smartcloud_saas_business_support_system_bss&content=apicontent

24

25

26

27

28

29 Organizational Unit (OU) Certifier A certifier ID is a file that generates an electronic "stamp" that indicates a trust relationship between users and servers. It is analogous to the device used to stamp passports -- it verifies that a person is trusted by that stamping authority. An Organizational Unit (OU) provides a way of classifying or grouping objects located in directories. When preparing your on-premises environment for a hybrid deployment, you create a Domino organizational unit (OU) certifier for your SCN servers in your hybrid environment. It is recommended that it be a unique first-level organizational unit certifier.

30

31

32

33 Bottom half - liveserverconfig.nsf document

34 Top half - liveserverconfig.nsf

35

36

37 IBM SCN Hybrid Environment On-Premises Step Issue Vault Trust Certificate After configuring your company account settings, wait for directory synchronization to replicate your company SCN ID vault document back to your on-premises directory You can confirm replication has completed in SCN Administration. Click Account Settings, and then click Directory Sync Server. Under Sync Status, the status should be OK A new ID Vault Document will be pushed from SCN to your primary On-Premises Domino Directory For example: ID Vault : /IDVault_126

38 IBM SCN Hybrid Environment On-Premises Side Issue Vault Trust Certificate Admin must issue a Vault Trust Certificate from a parent certifier of service users Notes ID files to the certifier of the service ID vault. This step is a prerequisite for user provisioning Utilize the certifier ID file of the parent certifier that applies to users to be onboarded to SCN create the Vault Trust Certificate For example, to issue Vault Trust Certificate for user Samantha Daryn/Renovations, make sure you have a local copy of certifier ID file for the /Renovations certifier After issuing the Vault Trust Certificate, give it some time to synchronize back into SCN before provisioning users

39 IBM SCN Hybrid Environment How Notes IDs populate Company Service ID Vault Import Notes ID file into mail file via Web Mail (inotes) prior to provisioning Import Notes ID file into mail file via Web Mail (inotes) after provisioning Notes ID automatically harvested into SCN Company ID Vault when Notes Client Authenticates with Service Upload Notes ID file via SCN Administration

40 IBM SCN Administration Upload Notes ID File

41 Preparing Mail Files for Onboarding Set mail file ACLs appropriately Prevent local encryption in new mail replicas Import Notes IDs into mail files Disable Roaming User Check Mail File Sizes are < 50 Gig Validate On-Premise Users are in On-Premises ID Vault Scan mail files for viruses

42 Set mail file ACLs appropriately Utilizing IBM Mail Onboarding Manager? Create Group with Group type: Multi-purpose Add abbreviated hierarchical name of Server ID utilized by MOM Optionally add self or access in Cloud Add Group to ACL User type: Mixed Group Access: Manager No more than 74 customer-defined roles

43 Utilizing IBM Mail Onboarding Manager Add Mixed group to ACL as Manager

44 Set mail file ACLs appropriately Disable Enforce a consistent ACL across all replicas

45 Prevent local encryption in new mail replicas Replication Options Uncheck Send changes in local security property to other replicas

46 Import Notes IDs into mail files If users will not use the IBM Notes client with the service and their Notes ID files are not embedded in their mail files, you might want to have them import the ID files into their mail files before the mail files are transferred to the service Procedure: 1. Logon to IBM inotes 2. Make sure that your ID is not smart card enabled 3. Click Preferences, and then click Security 4. Click Import Notes ID 5. Locate your ID file and type your password as prompted

47 Disable Roaming User Roaming User not supported in SCN Optionally maintain Roaming User Data On-Premise Disable Roaming User via Domino Administration Client onpremise, but do not delete user s roaming databases User needs to maintain/create local replicas and replication schedules of all roaming databases located on an on-premises server(s) for each Notes instance they utilize

48 Database Size Check Mail File Sizes are < 50 Gig DAOS size counts toward 50 Gig Uncompressed data counts towards 50 Gig Highly encourage users to archive as much data off before onboarding IBM Connections Archive Essentials Cloud after onboarded

49 Validate On-Premises Users are Vaulted in On-Premises ID Vault Always a good idea to know you have a backup copy of all On- Premise User Notes IDs Will touch on this later

50 Scan mail files for viruses Virus Scanning will performed during the onboarding process Admins can save some time by performing virus scans ahead of time and fixing any problems without SCN having to stop the onboarding process because of a virus found

51 IBM Mail Onboarding Manager Install Moves your on-premises IBM Notes mail to the cloud and provisions new or existing Connections Cloud accounts with SmartCloud Notes mail Installs as a Windows Service

52 IBM Mail Onboarding Manager Install Install the tool on the largest hard drive on the server. The tool copies replicas of all mail NSF files to a subdirectory (notesenv) in this folder.

53 IBM Mail Onboarding Manager Install Remotely accessed via a browser accessing MOM service

54

55

56

57

58

59

60

61 Mail Onboarding Manager Roadmap 1) Start on the Users page, and create Transfer Groups. You can do this simply by dragging names or by using the CSV (comma separated value) template and importing a CSV file. You can create as many groups as you need, and group them in a way that is meaningful to you so that they are easily identifiable.

62

63 Mail Onboarding Manager Roadmap 2) Continue to the Settings page. Here you create Transfer Group Settings that specify the setup options and subscriptions for the Transfer Groups you created. You can create as many Transfer Group Settings as you need.

64

65 Sample Post-Provision Message Welcome to IBM SmartCloud Notes! Very important for you to follow instructions below ASAP as new mail destined for you is now being delivered into the Service and you need to follow steps below to access To access your IBM SmartCloud for Social Business dashboard, please click => (SmartCloud Login) If you already have an account in SCN Iris login with address and current password

66 Sample Post-Provision Message (cont) If you are new to SCN, login with internet address and temporary password of "${PASSWORD}". You'll be prompted to enter a new password...and I highly suggest duplicating your IBM Intranet Password for now... If you wish to configure your Notes client to work with IBM SmartCloud Notes, please click => On the How would you like to use Smart Cloud Notes page, select With IBM Notes Client and follow subsequent instructions

67

68 With IBM Notes client

69 With IBM Notes client

70 Location: SmartCloud for..

71 Mail Onboarding Manager Roadmap 3) On the Staging page, schedule or begin transferring mail files and provisioning immediately.. 4) On the Staging page, troubleshoot errors at any time by clicking the errors link to view resolution actions.

72

73 Mail Onboarding Manager Roadmap 5) On the Dashboard. You can view the progress of each group and see an overall snapshot of your entire organization.

74

75 Mail Onboarding Manager Roadmap 6) On the Complete page, you can view those users whose onboarding has completed including activation of their accounts.

76

77 User Tip FT Index on SCN new mail replicas is off by default User optionally enables FT Index on SCN Mail Servers Worst is to find this out when you really need to search Best Practice recommends create local replica or managed mail replica and enabling FT Index on the local replica

78 Admin Tip: Prevent User Failback to On-Prem Once User Activated for a few days or a week Using Domino Administration Client Take On-Premise replicas Out of Service Check where other replicas are in home mail cluster are by viewing cluster.nsf Indication of Out of Service is at the view level in cluster.nsf Check Domain Catalog by Replica ID to find any other rogue replicas as I like to call them Either delete them or again just take them out of service

79 Admin Tip: Admin Access Replicate from SCN to On-Premise There is no replication of mail files between On-Premises Servers and SCN servers Admin with proper access, may optionally replicate a user mail file through their Notes Client between SCN and On-Premises Domino Servers On-Premise Validation Backups Soft Deletions Quicker if decide to move back to On-Prem

80 SCN On-boarding lowers ACL access Anything higher than Editor to Editor

81 Optionally, Power Users can pull new local replica Do not Copy Access Control List

82 IBM SCN Hybrid Environment Help Desk Call User Requests ACL Change in SCN Remember: Highest Level of Access is not Editor so User cannot add new Accessors to Mail file SCN Company Admin may go in and make some ACL changes Manage Mail File Access Admin restricted when adding or changing entries Access Level of Editor or below only

83

84

85 IBM SCN Hybrid Environment Help Desk Call User Forgets Notes ID Password User is Vaulted in SCN Admin Reset Notes Password via IBM SCN Administration Not Vaulted in SCN yet Remember the Will touch on this later Extracted ID From On-Premesis Vault using Domino Administrator Uploaded Notes ID File into Company SCN Vault Reset Notes ID Password in Company SCN Vault

86 IBM SCN Hybrid Environment Help Desk Call User Password Expired User changes password, but still gets password expired when attempting to access SCN Option 1: New password has not yet been sync d with SCN File->Security->User Security Click ID Vault Sync Button Option 2: Admin Reset Notes Password via IBM SCN Administration User restarts Notes Client and enters the reset password value Admin has provided them when prompted for password

87 Option 1: Click ID Vault Sync Button

88 IBM SCN Hybrid Environment Help Desk Call User Setting Up New Machine User DOES have a copy of his local ID file User copies their Notes ID from an existing Notes Client User utilizes copied Notes ID when setting up the Notes Client or if Notes Client is already setup user simply switches to the copied ID Download and run the Notes client configuration tool (config.nsf) to connect to the SCN mail server

89

90 With IBM Notes client

91 IBM SCN Hybrid Environment Help Desk Call User Setting Up New Machine User DOES NOT not have a copy of his local ID file Instructions can be found at URL below 10.lotus.com/ldd/bhwiki.nsf/dx/How_to_Setting_up_an_additional_IBM%C2%AE_Notes%C2%A E_client_to_connect_to_the_IBM_SmartCloud%E2%84%A2_Notes%C2%AE_service_when_y ou_do_not_have_a_local_id_file_

92

93 IBM SCN Hybrid Environment Help Desk Call User Setting Up New Machine Personally found it easier for Admin to perform the previous steps and then send the user their Notes ID file and have them download and run the Notes Client Configuration Tool

94 Interesting Admin Event Help Desk Call - User Notes ID Corrupted Important Note: Unlike On-Premises, there is no Extract ID From Vault operation for SCN Company Admin User is Vaulted in SCN Company Admin Reset Notes Password via IBM SCN Admin Ask User to: Stop the Notes Client, rename the corrupted id file.bad Start the Notes Client and login with the reset password

95 Interesting Admin Event Help Desk Call - User Notes ID Corrupted User is not Vaulted in SCN Happens many times as user s just dive right in and start using Verse and don t send or receive encrypted mail Remember the Will touch on this later Fortunately, had a copy of their ID in the On-Premises Vault Extracted the ID from On-Premises Vault and imported it into the SCN Vault via IBM SCN Admin Working on tool that shows all users in Company SCN Vault and more importantly all users not!

96 Interesting Admin Event Help Desk Call - User Notes ID Corrupted User is now Vaulted in SCN Company Admin Reset Notes Password via IBM SCN Admin Ask User to: Stop the Notes Client, rename the corrupted id file.bad Start the Notes Client and login with the reset password

97 Interesting Admin Event Help Desk Call User failing to retrieve busytime Problem: SCN Users failing to retrieve Rooms & Resources busytime info On-Premises Users busytime info SCN Users busytime info retrieved fine Resolution: Administrator mistakenly removed CalConn task from ServerTasks= line in notes.ini on Mail Routing Hubs between on-premises and SCN

98 Recent Admin Update PREVIOUS - DO NOT cut and paste Person Records in On- Premises Domino Directories of users already in SCN When changes replicated into Service, potential race conditions could leave SCN in confused state and end up with user being locked out. IBM Support Calls to resolve UPDATE Directory Sync Engineer, convinced me that work has been done in SCN so that this is no longer a problem and will be tolerated

99 Interesting Admin Event Help Desk Call Verse Mobile Problem: I get authorization denied on my iphone right after I enter my password Suggestion: What password are you entering? The one for your SCN Account or the one for your IBM Intranet account? First, see if you can authenticate through a browser from here Resolution: Ok, This was embarrassing. I had.con vs..com in internet address. I figured since I could authenticate ok with the browser url you gave me, had to be something else Thanks for opening my eyes Sent from my iphone using IBM Verse

100 Your Feedback Is Important! Based upon your session attendance, a customized list of surveys will be built for you. Please complete your surveys via the conference kiosks or any web enabled device at or through IBM Event Connect.

101 Thank you John Paganetti Meet the Developers Lab