Lotus Evangelist

HCL Domino 14.5, Fix your iNotes Redirector for Verse

noreply@blogger.com (Keith Brooks) — Sun, 29 Jun 2025 07:38:00 +0000

By now, if you have updated your Domino server and relied on iNotes, you have found that it no longer works.

HCL was clear about this, and there is no workaround, so if you want iNotes and not Verse, better keep a server on 14.0 and point everyone there.

For the rest of us that move forward with the times, we will have seen that logging into the iNotes URL gets you to a pop-up which looks like this:

It states that iNotes is no longer available, and you need to open HCL Verse. If you click on the link, it directs you straight to Verse.

The URL for verse is something like https://companyname.com/verse, and you change your bookmark, but that doesn't work exactly. When you hit that URL, you will get the framework of Verse but this message:

So, you try the manual way, https;//companyname.com/mail/brooks.nsf, and that lets you in, via the 1st pop-up as above..

The next morning, you open your browser, and the /verse URL is not working with the same error about recent contacts.

What is going on here?

iNotes required the iNotes redirector. Well, there is no new redirector, but it did get renamed to Verse redirector(same template name), but it does include some options you probably hadn't considered, and this is how you resolve the problem.

If you haven't changed any settings in a while, now is a great time to update them. The redirector has been updated periodically along the way.

These are the ones to change or review:

Server Settings Button:

Do you wish to force SSL for the entire session? Yes

UI Setup Button:

Your company logo should be there, so your users know it is a legitimate site.

Enable Personal Options: Set to No, they were really about iNotes anyway.

Enable HCL Verse: Yes, you need this now.

Enable SAML options: If you use SAML, enable this option, which displays a secondary option for the Default Mail Application. Select Verse.

When you have finished all your changes, click Save & Exit and then test to ensure everything works properly.

And no more weird error messages about recent contacts.

This tech doc can help those who want more details: https://help.hcl-software.com/verse_onprem/2.0.0/admin/vop_configuring_server.html

Update June 30: I found that I now see this error the next morning.

Googler search shows up this Technote: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0089441

Which leads to this: https://help.hcl-software.com/verse_onprem/3.1/admin/vop_configuring_server.html

Step 19 is what you want.

Which leads to this: https://help.hcl-software.com/domino/12.0.0/admin/secu_creating_the_credential_store_application_on_a_single_domino_server_t.html

In my case, I already had a credstore created, and this new key would not get added to that credstore.

I went back to the original technote, vop_configuring_server, and added a new entry in my domcfg for DWA, but that now redirects me to a different domain on my server, which has TOTP.

Also verified that the 'inotes/verse' tab in the configuration document met the proper configuration as per the document.

As it turns out, my secondary domain was set for SAML instead of single server in my Internet Site document, Domino Web Engine tab. Probably because I was testing something. Changing that back to single server now allows me to log in correctly with https://companyname.com/verse. With my erse redirectpr in place and everything now correct.

What was my session about at Engage? Money and your Job

noreply@blogger.com (Keith Brooks) — Thu, 29 May 2025 18:59:00 +0000

It was a cathartic, contrarian approach to our current situation, in which we, the admins, developers, and business partners, are supporting our Domino worlds.

I wish this were all in my head. But every single person in the room for my session at Engage was nodding their head at some point and others had very serious faces when confronted with my thoughts. The couple of people that talked with me afterwards were very happy they came to it. After all they gave up the Domino IQ roundtable for my session.

How did we get here?

The road that got us here is not the road that will get us out of here.

But enough cliché’s let’s be realistic.

We put ourselves in this situation.

Some items to think about:

(Almost) Every time we had a chance to ask for a budget, we failed.

We got what we needed, but this is not what an Enterprise solution desires, deserves, or requires.

We are selling our environments short if we only ask for licensing money, salaries, and some equipment. Way too short.

If your annual budget request does not include enough money that a respected enterprise solution requires, your request will not go up to the budget committee. Each company sets these meetings at various levels. Enterprise ready products have a staggeringly large annual budget, because that is how you know what is important. Or so the executives believe.

Maybe you think this is too much for “your team”.

Here is a little secret: Security budget money usually does not come from your team. It comes from the security budget. Leverage that every year.

Your environment needs to maintain perpetual security, which includes external and internal resources, people, apps, disaster recovery, development architectures, and more.

Everything you do in your Domino environment is for the company's greater good, and extending easier, faster processes for everyone, in a secure and meaningful way, needs to be backed by a secure environment.

I am not talking about 10k, 5k, or even 50k. You probably need to be asking for at least 100/250 or 500K to get to the budget executive committee. These days, maybe starting at a million. This is obviously relative to your situation and industry.

Some of you reading now might think I am out of my mind, but I am just a contrarian who has learned from 30 years of mistakes.

Maybe licensing is handled by a different group, so you didn’t need to ask for a budget. This also happens.

Once you stop asking for a budget, you don’t get invited to ask for one in the future. You mysteriously get left off the group email, or worse, your boss stops asking you about it. It is very hard to get back on the budget list. VERY HARD.

For those who say, "No, we submit a budget," my question is, do they take it seriously, and do you get funding beyond the licensing basics?

Developers, you fall under this spell as well.

How many times have you said (as an employee), "Oh, I can put something together. Give me a few days or a week or two." Every time you did this but did not chargeback some business units' code or lay out the process and document why the app is needed and what it does for the company, you have also failed your Domino infrastructure.

If you were an outside vendor, you would have a project plan and bill X amount of hours or a total cost.

But you think that as an employee, you can’t do that, and you are wrong.

Everything goes to a cost center somewhere.

The group you are writing this for should be paying your team some of their budget.

But I bet few of you have done this.

While internal cost centers are a BS accounting move, they do work with your budget, so play ball by their rules, not the ones in your head.

Fear of Unemployment

I understand your predicament. You don’t want to lose your job, and I don’t want you to, either. However, no one has ever been fired for asking for budget money. A raise is a different matter.

For some reason, employees started to think they would get punished if they asked for the budget. You don’t get everything, but have you budgeted for the 2-8 various updates (now multiply by how many servers you have) you may need to do all year for your Domino environment? That number gets large fast, especially if you assign a value to it.

Why assign a value?

Because you should be clawing back money from every cost center. Again, internal budget money matters. Think about your budget if you had been "paid back" by the other cost centers.

When Lotusphere/Connect/Connected existed, you had to beg your company to go sometimes. How many of you went to the HCL Factory Tours? I hope you all knew they did these. If not, why not? You should all have been at them.

Did you think you would get fired for asking to go?

No, usually, the fear is to do anything that will get Domino seen inside your company. The CIO may demand someone's head for saying the D word, or your boss gets pushback for the old software. Whatever the reason, I understand, but keep in mind, you are not helping yourself in the long run because you aren't giving your company any reason to stick with Domino.

I also blame the HCL sales rep at this point because they should be talking to you regularly by phone, email, WhatsApp, SMS, X, TikTok, set up an Ai auto message, whatever, I don't care, but they need to be on your side and not just "we have a webinar" or licensing renewal times.

To be fair to the HCL rep, they do what makes them money first before anything else, but if they don't want to lose customers, they could be more proactive, so could most of us, that's all I will say here.

Money is everything, and you don’t understand what money means.

Money means one thing to you, but it is totally different to executives.

You think asking for 10k is too much when the executive deals with million-dollar deals.

I am not saying deals don’t get lost because of price; that does happen. However, when properly laid out and defined, a solution for your company is not a 25k over-the-weekend app. If you want the executives to take it seriously, it is a 500k project or equivalent for your organization.

They will take it even more seriously if you can show that the new app either helps make money or manages some part, if not all, of your company's manufacturing, selling, marketing, or finance.

Do this, and you can ask for even more money.

I am not talking about fake ROI projections of “time saved,” but real money tied to real work processes.

If you used your budget for licensing, what else would you ask for? I have listed what I expect to be in your budget in the spreadsheet I have uploaded for everyone. I presume you are the budget submitter; otherwise, you must bother your boss more.

Spreadsheet for download.

It includes guideline pricing, multiple items, education, conferences, T&E for these events, and other items that should be clawed back from cost centers.

It is also laid out as though you built an environment properly, and you can understand why, as you start playing with it, how the numbers multiply easily the more servers you have, and some costs also multiply. I aimed to show that all your costs after the Year 1 hardware purchases should be budgeted for you and cover your expenses.

Some of you may find this enlightening, while others may find it far from reality. I will wager that few of you even have something laid out like this, on which you are basing your budget. I hope I am wrong.

UI/UX is NOT HCL's Fault

All the BS talk about a poor UI/UX falls on your developers, now.

Older apps did have limitations, but this is not 2001 and R5, why haven't you refreshed them? Even just using Restyle would help. NOMAD web can be your friend here to reduce the web overhead to convert an app from Notes only to web, but you probably do need a nicer UI.

There are some gorgeous apps, Notes and web ones, so we know it is possible.

Again, who is to blame for this? Your app's UI/UX is not HCL’s fault.

Your executives see it as IBM/HCL's fault, but that only relates to the mail template. Your apps are your own to be creative.

Speaking of executives.....

New Executives have no idea what Domino does for your company

Because NO ONE has told them.

In this situation, I am talking about apps here. Mail is basically a cost of doing business. While on-premises and keeping your data inside are essential and more secure, email is a cost.

Some of you have been trapped by this “cost” term. Just because email is a cost and you are told to reduce expenses(notice they never drop new applications or revise older ones to save money), you may have been mistaken in thinking you shouldn’t ask for more money. But this, again, is what got us into this mess in the first place.

Servers do not update themselves; they can now under v14.5, but you get my point.

But apps, apps run your world, make you money, reduce paperwork (hopefully), and should be so good that no one is looking to replace them.

Every time a new executive comes on board —and let’s face it, executives bounce between companies every 2-5 years—how have you briefed them on your Domino apps and what they do for the company, what they make for it, or what they provide that would cripple you if it suddenly stopped?

Have you? Has your HCL rep? Have you even told your rep what your apps do? Your HCL rep can't help you be that internal champion if you don't help them with what exists.

In my session, I used one of my clients as an example. They make millions of dollars a day using their Domino app worldwide inside their company. It handles everything from initial email requests for pricing and online sales to shipping, inventory, and manufacturing, tracking everything along the way. It is typical of Domino and an insanely elaborate application put together over two decades of teams of developers.

And yet, EVERY MEETING that involves leadership, I have to go to bat for my client and their app. Their internal people are too afraid to be connected to the “old server” stuff. See the above section Fear of Unemployment".

Imagine that meeting, discussing when we will move off Domino (I have been managing their environment for over 10 years or so) soon, but hearing this every year from me that it keeps them running.

They back down and then ask what is replacing it, which I suggest nothing, since it is an active and constantly changing environment, why would they replace it. Keep in mind that they only know the app by its internal name, which is how I introduce the topic, because they have zero idea it is a Domino application. But it always comes up from the Microsoft guy.

Of course, the business units say some cloud thing or an app made out of another database or workflow solution. Anything they move to would be a considerable cost, and ALL THEY WILL DO IS REWRITE WHAT THEY ALREADY HAVE, and from experience, end up with less functionality. I offer our help with whatever route they choose.

Like I said, 10 years, same meetings, every year. Many partners have similar stories, because we believe in the product, management believes in their bonus and their next salary when they move on.

This is exactly what one person in the meeting said about his situation. While he isn’t happy about the reduction in physical servers (personally I prefer less, but clustered, even when you have remote locations) he agreed that he will be there until he retires, nothing is moving that fast.

Management has made the decision in his case, but to be fair, their environment might be faster and perform better with less overhead from the dozens of servers being consolidated.

Details matter, but for every excuse or peculiar circumstance, a completely normal one is ignored or under-budgeted until it becomes too late.

I hope my session and this blog post help you never reach that point of no return.

Conclusion

TL:DR The problem is and has been us.

I hit on other items that we all see or hear when advising clients. But almost everyone should know how to handle those by now.

If not, reach out to me. The lack of integration FUD, the “old software” line, the “lack of knowledge out there” hiring managers, and the perpetual “everyone uses <insert some other company>” lazy man excuse from someone that doesn’t want to be accountable for anything.

But we could turn this around by addressing the money issue and how we handle pricing/budgeting.

If you need help with this discussion, contact me, my fellow HCL Ambassadors, your Business Partner (or dump them for me), your HCL sales Rep/ Customer Success Manager/Customer Success Executive.

We are at a fulcrum. The cycle is coming back to in-house data from Cloud data, and now is the best time to Make Domino Great Again in your company and champion it as a proper Enterprise solution.

My IQ has gone up thanks to Engage

noreply@blogger.com (Keith Brooks) — Thu, 22 May 2025 08:52:00 +0000

Engage just finished. The first one is under new management, and it is in safe hands.

I don't think I have ever seen Theo so happy with a big grin on his face the whole time. Tom and Kris did really well for their first time out. And they told us next year Engage will be in Belgium.

I had to miss last year's due to the timing and circumstances of the war at home, so it was great to talk to everyone. Thank you all for asking about the situation and the family. It means a lot.

The star attraction was Domino IQ, which adds AI to the core product. As an Admin, all I can say about this is that you will need to spend time building this out properly if you want to move beyond the basic regurgitation of your knowledge base or other internal documents. Also, IQ needs some extra hardware and configuration, so be prepared and read the what's new and requirements docs. Your developers will be busy.

It will be available starting with v14.5, which is coming out June 17! IQ is part of your license if you are under CCB Term(I believe). If you are a perpetual license org, this is your incentive to change licensing plans.

I was happy to see friends from past Engage shows, and in some cases people I hadn't seen in many years. Yes, we all got older, but we still have fun together.

There was a tease of Notes.Next but it is far from prime time ready so don't ask about it yet.

Roadmap sessions were broad with partial timelines for new items.

One thing that also stood out is the added accessibility to all the products which need to be up to certain laws soon and so that is taking over a lot of dev time.

As an Admin, I want to let everyone know to go get Cormac's slides from his session. His session was filled with great ideas and details about cleaning up your administrative items, and as he said, even old admins can learn something new, which I did about SMTP failover routing.

His blog is here, and hopefully, he will post his slides there or at the Engage website.

Lastly, the Lotus brand might return for at least one product. Or not. While this was from Richard Jefts' opening keynote, later on, other HClers implied the name may not stay.
I will leave the debate about the brand to others, as both sides of the argument have their validity.

I was also in some partner/ambassador/HCL Roundtable sessions, which I can't say much about, but there are plans that will help the partners in the long run, which in turn will help you, the customers.

I think my own session scared a lot of people, but I hope it also helped them rethink how they and their teams interact with upper management and budget committees. My slides will not be posted, and I don't publish my Competitive Intelligence info. I will probably make a second blog post about it over the weekend.

Safe travels home everyone, talk to you soon or see you, at least virtually, some time soon.

SnTT - Does TOTP Work for users in a Secondary Directory via DA

noreply@blogger.com (Keith Brooks) — Tue, 20 Aug 2024 09:40:00 +0000

TOTP, DA, and Domino

For the last 3 years, I have worked with TOTP inside HCL Domino and customers with unique requirements.

This has provided fodder for my blog, and today, we have a new entry into the TOTP Mystical Ways of the World.

Let me state my usual caveat upfront: TOTP is about the URL, not the server, the database, or the user.

You enable TOTP for each URL you want on your server.

PSA is completed. Let's discuss the circumstances that brought me here.

Like many of our customers, a customer has a large external user community relying on their applications.

The customer has licensed this with HCL, so I am not going to get involved in that discussion. However, be warned: It is not a comfortable one if you have been relying on some old licensing options and now fall under the new ones.

We have about 7,000 external customers. Some are undoubtedly old customers, but 7,000 is a lot of people.

Previously, I wrote about how to bulk add these people into your ID Vault, and that was all fine and good where we have only one names.nsf for everyone and everything. We may have had 2-3 servers in that org.

Now, the 7,000 are in a secondary external names.nsf via DA (Directory Assistance).

The Problem

1) How do you register and maintain the people in a secondary Directory?

2) Does the DA even work with TOTP?

The Options I See

Officially, there is only one place, and one place only, where everyone gets registered: the names.nsf.

This is not very helpful, especially given the reliance on the ID Vault for many things these days. By changing licenses, there is no way to "convert non-ID people to Notes ID people."

What do you do?

1) Copy, not replicate, the name.nsf, to extnames.nsf, move the actual names.nsf out of the way, rename extnames to names and then register everyone to it. Once done, put back the original names.nsf and off you go.

As pointed out in our Openntf.org Discord channel, the problem with this is that the user and ID would not be properly found for encryption/certification. This is a very valid point I wasn't thinking about at first. Thank you, Ulrich and Detlev.

2) register all 7,000 into the names.nsf properly, like normal. Then, manually copy the 7,000 to the extnames.nsf. Then delete, just regular delete, not Adminp delete, the 7,000 from the names.nsf.

By doing this, we preserve the user's encryption/certification, and should a name need to be renamed/edited, we can copy the user back and fix it. One could also just create a new account etc.. and remove the bad one from extnames.nsf.

3) Create a new Domain and register everyone to it and cross certify it with the existing domain. This may or may not be the answer as well, depends on circumstances.

4) I have no other idea otherwise. However, there is an AHA idea asking HCL to think about a way to register people to some other .nsf. Take a look and vote over here.

If anyone has any ideas, let me know in the comments.

I will get to the DA question shortly.

Details and Planning

I started with my blog post and the CSV file I needed with 4 test users.

Copied the 4 test users from the extnames.nsf to the names.nsf.

Went to register the users, verified information etc..

And got this error: "The user's flat name matches another user with a different hierarchical name."

You should know that I ran into a bug in the Notes Admin and Domino Server v12.0.2, which you can read about here. Upgrading the client/server is the basic answer to resolve this one. Since Domino was already at 14.0FP1, my Notes Admin client had yet to be updated.

Once updated, everything went as it should.

Well, only some things.

I need to do more testing, but I think the "just updating an existing user" registration option is not working properly because I now have 2 completely different entries for each test user.

My theory is the existing users being "unregistered web users" with "other mail" were not seen as the same people, and so Domino created the new entries. I know the ways to work around this if it is the case, but more testing will validate what I need to do. After all i will have 7,000 to update, fixing one manually is fine, but all of them? For that, I have my Openntf Admin Snippets to help me. I will blog about this after testing is completed.

In any event, I copied the 4 people out of names.nsf, put them in the extnames.nsf, and reindexed both directories as it was testing time.

Testing TOTP and DA

Ready for testing, I turned on TOTP in the Security setting, edited the domcfg.nsf for the test URL, and checked that the extnames.nsf was enabled in the DA, then restarted Domino.

When Dominno comes up, everything looks okay. I open a browser, put in the URL, and see the login screen with the MFA details. So far, so good.

The first test is my own log-in. I am in the names.nsf, and my ID is in the ID Vault. I passed, and there are no issues.

It seems, and this may be a customer agent, that the users are not supposed to have a web password. I added there password back, it was in my CSV, and reindexed and tried again.

Different error. User not found type error.

I was logging in as FirstName LastName, which is how I logged in, but there is only one record of me, but 2 of the test users. I logged in with the Org domain name and got one step closer, this time it just crashed on me.

Ok, I cleared the browser cache, restarted Chrome, and tried again.

This time I received a invalid access error.

This is important because the HCL documentation does not say anywhere that the DA will work with TOTP on its own. It only discusses the DA via Cross-Domain Authentication, as you can see here.

I looked at how the DA was set up and changed the Group Authorization setting to Yes from No.

Made sure Trusted for Credentials in the Naming Contexts tab was set to YES.

Then I tried it again.

And it worked this time. I was prompted to set up the MFA and log in as the extnames test user.

Conclusion

I still have more procedures to test and document, but the ability to leverage TOTP in a secondary directory via DA is not a limitation for the rollout.

Stress testing HCL Domino and your "Other" Mail Infrastructure

noreply@blogger.com (Keith Brooks) — Wed, 31 Jul 2024 11:48:00 +0000

How does 1.2M emails sound?

There are people out there who say HCL Domino can't handle the stress of modern times.

It is an old system(truth be told, Exchange isn't much younger) with limitations.

Well, yesterday, I did an unintended stress test of Domino and a client's internal infrastructure.

Like most large and well-known companies, they run many Domino applications that handle millions of dollars a day but also have an O365 infrastructure.

Mail doesn't come into Domino, but it does go out from there, and this is where it got interesting.

Domino sent over 275,000 emails over about 15 minutes +/-.

This was all internal SMTP, so we didn't get spam blocked or anything,

Normally, a company would have a choke hold option on mail sent per minute, but for some reason, that was not in place or was avoided due to routing configurations yet to be determined.

And my 275K grew to 1.2M inside the network architecture.

Fun day at the office, right?

No, I caused the problem and also knew how to fix it, but that small window of time was enough to unleash the tsunami.

Sometimes, the simplest things become the hardest things, and this was such a case.

Even veterans of the email wars screw up.

I now have a great session for F*uck Up Nights if anyone is interested.

Definitely used up one of my IT 9 lives, this brings me down to about 5 left.

HCL Domino was amazing throughout. Not only did the servers not complain about anything, but they just kept going and going and going. Multithreading FTW!

O365/Exchange did not do so well, got clogged up and had issues because it still is not a multithreaded service.

I pulled the numbers from the Mail statistics and showed them on my Admin client Monitoring dashboard. The left side is tasks, which I covered in my previous blog post. On the right side, you can add statistics, something not many people do, but I like to see some things there and probably should do a separate session on the statistics, but that is for another time.

My peers, I am sure, can guess what caused the tsunami, so there is no reason to elaborate. But let's just say when you are a junior admin, this is one of the outcomes of your trial-by-fire Domino Administration education.

For those who think Ambassadors and long-time Yellowbleeders are these great Gods of tech, some really are titans, I admit my mistake and that, indeed, you are never too young or old to learn something new....or mess up royally.

Domino RESTAPI Bug and WorkAround

noreply@blogger.com (Keith Brooks) — Tue, 30 Jul 2024 12:05:00 +0000

This is not my usual line of thought as an Admin, but sometimes, AdminOps is better than DevOps because troubleshooting is not an exact science.

While customers over the last year or so have been asking about the HCL Domino REST API, my reply is usually something like, I can install it, but you are on your own afterward, or I point them to a Developer friend.

To be fair, HCL will help them/me with getting started or "where is/How do I" questions. But this is about the bug my client and I discovered and how to work around it.

While updating the v1202FP3 servers to v14FP1, all went okay, even with the change in Java classes, until we got to the REST API server.

If you had downloaded and added my tasks update for the Admin client, you would see that RESTAPI was running on the machine, as I saw. I let the customer know I would upgrade it from 1.04 to 1.014.

Usually, it's not a big deal; you run a long string of commands or broken down into 4 lines like the example shown in the documentation which I prefer as my typing is not perfect.

java -jar restapiInstall-14r.jar ^ -d="C:\Program Files\HCL\Domino\Data" ^ -i="C:\Program Files\HCL\Domino\notes.ini" ^ -p="C:\Program Files\HCL\Domino" ^ -r="C:\Program Files\HCL\Domino\restapi" ^ -u

You then type an A to accept the update, which will upgrade the REST API code.

It replaces the existing files with new ones and any updated files.

Great. I rebooted the server, and it looks like everything is up. The task view in the Admin client shows REST API is up.

Test a few things, but Swaager is not connecting to anything.

My initial thought was that the developers had some code that had been deprecated or maybe not valid with something in v14. I wasn't far off. I tried a few things to get it to work, and then I decided to look at the schemas. I found them deactivated, which seemed wrong to me, so I enabled one to test.

And it worked again.

Great! I did the same trick with the others, and they also worked.

One last test, shut down Domino and reboot the box clean to ensure it was ok.

No luck. Back to square one, but now the schemas all showed activated, but still just errors like this one:

This not being my first effort, I figured let's deactivate everything and reactivate it and test it.

Sure enough, it worked.

So, in my mind, the problem was somewhere between the REST API code and some type of flag on the schemas/databases that just wasn't being accepted.

Opened a ticket with HCL to discuss the bug I found.

After the usual back and forth, get us this, debug that, a copy of the NAB, a db, schema db, etc.. HCl said they could not recreate my problem, yet here it was.

We had an online meeting so the dev team could get a good luck at my testing and poke around deeper.

They agreed something was fishy and went off to look into it further.

In the interim, given this was a key production server, we wanted to revert back to the old REST API version, which worked fine prior to the upgrade. But would it work on v14, among other questions we had?

HCL and I discussed it with the customer, and this is how you revert to an older version.

We had the old code downloaded, which is key as sometimes HCL has a way to make older versions "disappear" from the public. The steps included:

Shut down Domino
Copy the Domino\restapi folder contents out from Domino to a backup space.
Once the RESTAPI folder is empty, you can then walk through the installation steps as I showed them above, but the last line instead of -u should be -a.
This will reinstall all you need(presuming all URLs, folders, etc are NOT being edited/changed)
Start Domino
Test

This worked well, and the customer was back up and running on V14FP1, albeit with the older REST API code.

After a few days, we got back some information from HCL, which I quote directly below:

Problem:
REST API 1.014 Running the APIs in local swagger returns Error "Failed to Load API Definition"

Possible cause
The issue is that the scope's Server name is not correct.
This setting was not working correctly in older versions of DRAPI and was fixed in v1.0.6. It was pretty much ignored in v1.0.4.

Possible solution/Workaround:
With DRAPI 1.0.14 you have to add the CN name/hierarchical name of the Domino server instead of host name for example: CN=customerTest/O=HCLLabs in the Edit scope>>Server field>>CN=customerTest/O=HCLLabs or CustomerTest/HCLLabs
Earlier server name field in scope>>Server field was: Host name of the server i.e keithbrooks.com

Change it to either CN name or the hierarchical name of the Domino server or can be left blank stating any server that has this scope in the KeepConfig.nsf assumes the database / schema exists.

Moving further the product dev team is going to update the error message in the product code as 'You need to query a different server' so it makes more sense to the testing on affected DRAPI versions.

There you have it. My guess initially was partially correct.

The configuration was correct for the old version, but because the customer did not upgrade the RESTAPI code along the way, they missed the changes in code at 1.06, which would have probably prompted an HCL ticket at that time as well, but it would have been easier for all of us to see as the issue at that time. as the change would have been fresh in their mind.

The story's moral is, of course, ABU or "Always Be Upgrading" because of security, code, and functionality adjustments over time. While we don't want to break production, sometimes you must do so for your benefit.

The second moral is to have a Development or Staging environment for these critical applications. In this case, the lower environment did not match the upper one entirely, so the problem was not seen when we updated the lower environment.

An Admin Present You Didn't Know You Needed

noreply@blogger.com (Keith Brooks) — Thu, 04 Jul 2024 12:21:00 +0000

Hi, welcome back to my burnt out blog. 1,500 posts and, well, I am kind of burnt out, but that doesn't stop me from giving to the community these little bits.

I'd like to write more but a lot of things have been internal client items that I can't write about, but I am active.

Preamble, excuses out of the way, so, who wants some goodies?

About 2 weeks ago, I gave an impromptu webinar for Openntf.org as a last-minute fill-in.

Openntf, for those that don't know, is the Notes/Domino+ community, where devs, admins, business people, HCL, and others share code and ideas, templates, and projects for the benefit of the greater worldwide community.

I wanted to inform people that monitoring Tasks in the Administrator client has some changes.

Why is this important? Because unless you are a 1 server company, you have a lot of information to remember, such as:

How do you know if DBMT ran?
How do you know which server Certmgr runs on?
Which web server do you run the Domino REST API on?
Which server handles your Backups and Restores, presuming you leverage the v14 options?
Is NOMAD running?
Is your DirSync working?
Are you sure the awesome OnTime Group calendar is running?
Have you enabled Aautoupdate yet? One look and you know.

Intriguing questions, right?

Between v9 and v12, nothing changed in the tasks that could be monitored. Traveler seems to have been the last item added, and that was from 8.5, but it found its way into the Monitoring Dashboard in v9.

Now comes v14 and HCl has cleared out some older items, like x500 info and the Fax server....but did not add any of the newer tasks that have come along since v9.

To be fair to HCL, it is not as simple as a few fields and renaming a file.

But fear not my fellow Admins, for I have not only explained it all in my presentation, which you can watch over here on the Openntf YouTube page, I have made the tasks available for everyone to update their Admin Monitoring Dashboard.

If you just want the slides, go here.

And because I know you are probably as lazy as I am, I have made the forms available with instructions to help you get more from your Monitoring Dashboard.

Go get the tasks from my Openntf project over here.

If I missed a task that is not listed, let me know, and I will update the project database.

SSL Cert Renewed in Certmgr but no one could see it

noreply@blogger.com (Keith Brooks) — Tue, 19 Dec 2023 06:39:00 +0000

Certmgr is the greatest thing in Domino these days if you are an admin.

Autorenewing SSL saves so many problems, delays, and potential loss of revenue for customers that it is, in my opinion, one of the best things HCL has added to Domino.

Much of the credit for it goes to HCL Lifetime Ambassador Daniel Nashed.

When you see him at Engage or DNUG, buy him a beer.

Daniel was on hand to help me with my problem tonight, and he was correct with his original assessment, Certmgr should just work.

I agreed, and it was working, or so it showed in the view when verifying it using "tell certmgr show certs" at the server console, but we could not see the validated certificates for 2 domains.

Since I had manually renewed them today, we should have seen a date of expiration for March 18. Instead, we saw December 17th for the one that expired yesterday, and the other showed January 21.

The TLS cache should be auto-refreshing when it gets the new certificates, but appeared to not be doing the task.

We reviewed the basic configuration and tried some test requests, which should have triggered a cache refresh and resolved the issue. But that didn't help us see the correct certificates in our browsers.

While Daniel asked me about different parameters, I learned something about the updated certmgr, we don't need to put the .kyr name in the Security tab, TLS options field.

Instead, we should be using the DNS name. I totally missed this. The .kyr name in the field is there for the legacy people who have yet to move to V12 or V14. See page 36 of the slide deck mentioned below.

You can read Daniel's slides from his OpenNTF session, which is full of deep technical information. https://blog.nashcom.de/presentations/openntf2021_domino_certmgr.pdf

The other part, which I did know, but had yet to remove from the customer server is the Internet Sites Basics tab, DSAPI Filters field no longer requires ncertmgrdsapi.

After doing these bits of cleanup, and restarting HTTP a few times, we were still left with the issue of incorrectly reported SSL certificate dates.

We turned on debugging for the cache using set config CERTSTORE_CACHELOG=1.

Page 47 in the above slide deck.

And we got nothing.

Which surprised both of us.

And then we went to look at the notes.ini to see if anything was pointing to the wrong place.

And this is where we found the problem.

Now, there is a parameter that should not have been there at all, and there was only one Google reference for it that we found. Evidently, that reference should not have been public, but it was, and someone at the customer site had added it sometime in the last 60 days or so because Certmgr had been running fine for over a year already.

For the sake of some poor admin out there troubleshooting this, I will say that if you experience the same problem as I did, look in your Domino notes.ini for a line that starts with "SSL_DISABLE_TLS".

I will not put the rest of the command here because, as Daniel said, no one should be using it.

If you find something like this, just remove the line outright from your notes.ini.

You can use "set config ssl_disable_tls(rest of the name)=" to remove it from your active server.

There is no 0 or 1 to put to remove it.

Then, at your server console, type "restart task HTTP," which is the better way to restart HTTP.

And poof, like magic, it all worked again.

That command blocks the newer TLS Cache refresh implementation from running. Thus even though Certmgr could get the updated certificates, it could not run the refresh because this line was telling it not to run.

Customers are so cute when they tell you they didn't change anything.

Domino V14 - A New User Capability - Mail Merge

noreply@blogger.com (Keith Brooks) — Wed, 13 Dec 2023 10:38:00 +0000

I have asked for this for many years, and we got it in V14!

This is my guide and first reaction.

If you have Admin Assistants or need to do your marketing, you need to use Word or some 3rd party to do what should be a simple effort.

HCL has given us a nice Mail Merge inside the notes client.

It may take some testing for your first one, but hang in there, it is much easier than other methods I have used.

I will elaborate on these topics below:

Where is the Mail Merge option
What you need to set up the Mail Merge
Creating your Mail Merge
Previewing and Running a Mail Merge

Where is the Mail Merge option?

Naturally, the first place to get information is the HCL Documentation.

https://help.hcltechsw.com/notes/14.0.0/client/mail_create_mailmerge.html

I'd like to say this is well-documented, so someone who is not a developer or in IT can follow along.

But it isn't, which is one of my few issues and why I am writing this blog post.

Presuming you updated your Notes client to V14 and updated your mail file template to V14, Mail Merge is a newly added option in your Mail inbox view, when you select New > Mail Merge.

(1st screenshot is from the HCL Docs and presumably a Mac client, the 2nd is from my Windows client, How do I get the Stationery option in Windows?)

What you need to set up the Mail Merge

Like most Mail Merges, you need your data, usually in a spreadsheet. HCL asks for Excel. I did not test any other spreadsheets.

The documentation says, but doesn't show or provide an example:

Create an Excel spreadsheet.
Each column represents an aspect of the email body that will be personalized; each row should specify every user receiving the email and their personalized information.
Save the Excel file.

Took me a few tries to figure this out.

Naturally, every row should be a name, easy enough.

What is the column story exactly?

At first, I tried putting in details, but that didn't work right.

You need to provide a Title to each column.

I thought I needed the Notes designer name for each field, which would be crazy for an end user, but I was wrong.

The title can be anything you want; this is cool because oftentimes, you get hard requirements for naming.

But make it easy to follow, as you will see in the next steps.

Here is an example of my simple test Excel file, without the attachment column.

Then save your file.

Creating your Mail Merge

This is what you came here for, and it is set up like a Wizard to help you.

After selecting New>Mail Merge and you select the Excel file you created, you will see this dialog box:

(1st screenshot is the documentation and a mac client, 2nd is my windows client. Note the differences, Stationery, and Attachments are not consistent)

If you click on the drop-downs you can see all the column titles you created and in my screenshot below, it recognizes some names directly.

Attachments in Excel are messy, but I tested using a local file link.

Once your basic fields are defined, you move to the memo form.

NOTE: The attachment(s) do not appear anywhere in this form! But they are there, as we will see shortly.

I did not know what to expect, so I created a "Body" column with the text I wanted. Normally, this is where you would paste your Word document or email template, so the body field I created is not needed, but I added the field there to show an example of fields and text.

People who are used to creating a Mail Merge will understand that you format the mail/body text like usual and you can include graphics and other changes to fonts, etc..

NOTE: In my testing graphics that appeared in the preview did not come through to the recipient.

Usage cases for this include bulk email senders, bill notifications, or other similar types of standardized messages, but if you don't need heavy, intensive graphics, this will do quite well for your marketing team, too. YMMV.

When you need your fields from the Excel file, click on the Insert merge field, and it will add the block. You can then move it or work around it, as i did with BODY below.

Once your mail is ready, click the Preview and Send button.

Previewing and Running a Mail Merge

I grabbed a side-by-side screenshot to show you how the form looked compared to the preview.

You can see the attachment is now shown and takes up the top part of the mail, I would prefer it be on the bottom, and this causes a different issue when NOT including attachments, as we will see below.

There is a little arrow and number for you to check your previews, and if you need to edit it, select the Continue Editing button, or if it is ok to send, click on the Send Mail Merge button.

The screenshot below is how the email looks in my Verse client, and Gmail, when I receive it.

NOTE: I need to verify what went on, but the Mail merge seems to include an auto bcc to the sender. Be nice if this was documented or stopped, because why would I want 100s of emails flooding my inbox?

Note the long line across and how the message doesn't start on top but only under that long line? That area is the attachment area.

My hope is HCL fixes this in the future because it looks like the mail got cut off or is missing something.

For a fresh Out of The Box benefit for people, I like it and hope to use it in my marketing efforts.

Hope this helps you and your team that needs mail merge and thank an HCL person for listening to the customer voice.

V14 Notes, Domino, Traveler are out Now

noreply@blogger.com (Keith Brooks) — Thu, 07 Dec 2023 13:35:00 +0000

But your Notes install may have an issue.

NOTE: This post will be updated/edited as I figure out more of what is going on. Domino install-info after the Notes client info below.

I tried installing HCL notes, only comes in 64-bit now, on 2 different machines.

The installation was on top of the existing ones.

You may want to use the NICE tool to clean up the prior install first, might save you some headache.

1st is my usual laptop, 6 months old, Windows 11 Pro which already had 1202fp2(64-bit), and while it looked ok after about 20 minutes of waiting to finish, it gave me this, with no more details. It possibly happened while uninstalling or disabling something.

And then backed out the installation.

Subsequently, what I did was extracted the installer to a new location.

Then ran the setup, RunAs admin.

And this time it worked. Thank you Marc Thomas for the hint that there may be some extraction issue and to try it this way.

So, 2 clients installed, a server with traveler installed and it took about an hour and a half including troubleshooting/retries.

The 2nd installation on my Windows Server 2019 which is a hosted VM gave me this message:

And after trying again to click ok said this:

Never had something like this happen before during an install.

I extracted the 1202 notes client as requested to get the MSI file and then the installation continued on its way. Also takes about 20 minutes.

So the Server install completed, even after asking for the 1202 code.

Now to figure out what is wrong with my Windows 11 install.

Domino Install

If you do a custom install, like I do, you will see the options to install Nomad and Ontime and I think Verse, my screen capture did not capture, sorry.

You will also see something my beta code did not do which is confirm the Domino login name for the startup services.

You may want to be careful with that if you don't know how you are logging in because your server may not start afterward.

Time to update was between 5-10 minutes including restarting the server and updating the Directory.

Traveler is also available and installs like usual in a few minutes.

Nomad works just like it did before, so the update did not change that, but it would be nice if it told us which version it was, instead of developer code which is 1.0.9.5525-3341. How do I know if mine was even updated? Maybe 1.0.9 was what was installed, but i already was at that level.

Verse works as well. 3.2, which I had installed, need to look up what version is installed as V14.

Ontime kept my configuration, and the booking settings still work as well.

Pretty cool when you think about all the stuff HC has to verify on the Domino side given these things are now included in the installation.

SMTP BlackListing, WhiteListing and Log and Reject/Tag

noreply@blogger.com (Keith Brooks) — Thu, 05 Oct 2023 08:02:00 +0000

If you rely on your Domino server to handle all your mail, you probably have had numerous attacks on your server over time or even lately, as I did last week.

My personal Domino server is a mix of real code, websites, and active email, with various half-coded things and weird templates or customer testing.

However, I started getting harassed by sites looking for open SMTP accounts recently and figured something was amiss in my configuration document.

The official blacklist servers worked fine, but some of these rogues were missing.

Looking at my log file, I found a few domains/IP addresses and put them into the deny access group known as the Private Blacklist Filter found in the Servers Configuration document, as shown below.

But that wasn't enough to stop them. They kept coming.

I wondered if 12.02.FP2 had some problems, so I opened a ticket with HCL.

Turns out the problem was on my end, but I still have some questions, but first, what was the problem?

I had a default configuration document, which was fine, but I also had a separate one for my server explicitly named a relic from a test issue.

The explicit one took over the default one, and so while I thought I was maintaining one list, I was wasting my time.

I deleted the explicit one and just focused on the default document, it is my server after all.

And all was good, sort of.

I wanted to understand why I was still getting a few spam emails.

I had set the server to Log and tag instead of Log and reject.

Here is where the problems got worse.

I decided to block all spam and set all fields to Log and reject messages. You probably can guess what happened next.

My inbox was very clean. Very few emails came through.

I thought I would whitelist what I needed, like bank mail, and HCL support mail (not so simple, someone at HCL should look into their SMTP issues that have them on a blacklist).

Still not getting lots of mail.

Next, I looked at what else was set in the doc and saw the verify domain lookup option was set, and rightly so as this does a great job.

However, I have learned that many organizations don't have good, clean SMTP/DKIM/SPF entries, and thus, they are getting blocked.

Sadly, I had to revert back to Log and tag to interact with customers and business partners.

Customers of mine with issues were notified, as was HCL, but if you have been playing with SMTP, something else always pops up. It needs babysitting.

While my mail is more stable now, I know I lost a few entities that got the denied server message and probably will not resend anything in the future. Which is a problem as some are bills and other items of usefulness.

If you are a new Domino administrator be careful with how you edit your Configuration document.

Data Extraction Help for Rich Text Field

noreply@blogger.com (Keith Brooks) — Tue, 03 Jan 2023 12:56:00 +0000

Preamble:

This post is being written more for my long-term memory benefit than for its genius of development.

A customer wanted to export their data from an NSF to import into Salesforce.

They thought they could just export the view.

Sure, if the view had all the data, which of course, it did not.

Thus how it ends up in my inbox.

Action:

I created a view and proceeded to add a column for each field in their form.

No problem, done this many times.

When I verified the data before giving it to them, I found it was missing one field.

For unknown reasons, one can not see rich text in a view column even when specifying the field. Oh, and you can't specify a rich text field, either.

Developer friends are shaking their heads, they understand, but us admins, we figure it should just work, right?

Work Around Solution:

UPDATED EDIT: Thomas, in the comments pointed out, rightly so, that "Rich Text items can contain not only formatted texts, but tables, images, file attachments and more. But the abstract item will only contain the unformatted text."

In this case, my client only has some textual notes in the field, but if they had other items, you should seek a proper developers help.

This is what I did after mentioning it in the openntf.org Discord chat, where I learned about the @abstract formula.

I used Jake's blog post, from 2001, http://www.codestore.net/store.nsf/unid/DFOU-4PRG73?OpenDocument, as the guide. But that was only one part of the story, and I had to fix the code.

Jake wrote: First thing to do is to create a Computed field, of type Text, and call it something like "Abstract". The formula for this will be somthing like :

@If(@IsAvailable(name_of_the_rt_field); @Abstract( [Abbrev]; 200; ""; "name_of_the_rt_field");"" )

Jake included a * at the end of the formula. My designer client balked at it, so I removed it, and it accepted the code as shown above.

I added a field to the original form, called it Abstract, and set it to type Text and Computed field.

Then entered the formula, substituting the name of my Rich text field, where Jake wrote name_of_the_rt_field.

I also changed the 200 to 2,000, so I could get all the text in the field.

Saved it all, refreshed my view, and ..... nothing.

2nd Part Work Around Solution:

Further Googling found that the rich text field would only show up now if it was resaved.

I tested this, and sure enough, I resaved a form and magic, the rich text was shown in my view.

Great, but, I can't re-edit all 1,500 documents, nor know even if they have anything in the rich text field without opening it, so what do I do?

I asked Bruce Lill what he uses, and he said to create an agent, with a Forumla and a target set to none.

The formula to include is @Command([ToolsRefreshSelectedDocs])

And after saving it, selected a few forms and ran the agent, and now the rich text shows up.

And I can give the client their data for importing into Salesforce.

Conclusion:

Domino developers have dealt with this for many years and created workarounds for it. Admins have just lived in pure ignorance all this time about this issue.

Welcome to 12.0.2, Please Uninstall Your 32-bit Notes Client Edition

noreply@blogger.com (Keith Brooks) — Fri, 18 Nov 2022 09:00:00 +0000

I just got back from the HCL Factory Tour in Milan, will post about that next week, but first, I need to explain this.

As you may, or should know, HCL created a 64bit client that is now available as of 12.0.2. Yesterday it appeared on Flexnet.

I asked in Milan what HCL did to help customers upgrade from their 32-bit clients to the 64-bit one because, in the beta, one would get the error message above when trying to run the installer.

2 different HCLers told me you could just install one over the other, but it is not recommended.

I pointed out that the beta said one could not, but they insisted.

Well, I am here to point out you can not install over the 32-bit client to reach 64-bit nirvana.

The error still appears.

So, off I went to uninstall 12.0.1FP1 32-bit client.

I did this on my personal server, which doubles as my test client, then started the 64-bt install.

One should run the NICE tool, yes there is a new NICE64 tool, and if you wish, restart your PC before running the 64-bit 12.0.2. installer. But I did not.

If you have to ask why HCL is doing this, then turn in your IT badge, it has been a long time waiting for this to arrive.

Now the installer is free to get moving. The entire process, including downloading the code, took under 30 minutes and that was with me trying to install over my 32-bit client, grabbing the screenshots, writing this post in between clicking ok, etc.. Your time should be about 10 minutes.

By the way, the 64-bit client download file is 1GB. Domino is only 800MB, just sayin'. It used to fit on some floppies.

Anyway, the bottom line is if you are doing a client/laptop/OS refresh soon, you need to go to the 64-bit client.

It was implied by HCL, well strongly hinted, that the next version would be the last 32-bit client, so you need to start planning for it.

There will no doubt be more posts by people pointing out aspects that still need 32-bit parts like Jesse did here: https://frostillic.us/blog/posts/2022/11/17/notes-domino-12-0-2-fallout.

Other Ambassadors have posted in our private chat about various issues the 64-bit client has with some application items, more info will be coming, no doubt, so developers, your time to test is here.

You may also need to think about which version of Microsoft office you installed and if anything depends on it, so test it, but you should have installed the 64-bit of that as well. This is from a conversation I had with a customer on the way to the train and airport which made me wonder what might happen.

So caveat emptor and start testing and preparing your plans and progress.

Starts right up, all of the .nsfs I had, and the workspace is there just like before. I did not clean out my notes.ini, but you should or just strip it down to the basics and let it update, but that is for another post.

As always, feel free to reach out for help from me, fellow HCL Ambassadors, your Business Partner, or HCL rep.

Happy Installing! Now on to my server update, Traveler, Nomad, Verse, and Ontime Freemium Group Calender updates(their video here: https://www.youtube.com/watch?v=JxCIEQ5fjOQ). I will post updates once each is done and how long it took to do them.

Server Update Info: Including shutting down Domino, installing the update, restarting the server, and then all the server updates running, the total time was 6 minutes until I could access it from my client. Naturally, in full corporate environments, your timing will vary.

Traveler Update Info: Traveler 12.0.2. now enforces that you shut down Domino before installing it. So, although the actual time to install Traveler is a minute or 2, the process takes longer due to the shutdown, and then I did a clean reboot as well.

NOMAD Update Info: Delayed, no 12.0.2 documentation has been indexed yet, so there are no details about it beyond downloading the 1.0.5 code which I got in beta, unzipping it to the domino root folder, and running NOMAD as a server task. Product Management says 1.0.5/12.0.2 version is not up yet on Flexnet. Will update this once available.

Verse Update Info: Although I thought it would be inside Domino 12.0.2, it seems that is not the case, so it is still a separate update. The current version is 3.0, which you can download from Flexnet. Follow these instructions, https://help.hcltechsw.com/verse_onprem/3.0/admin/vop_configuring_server.html. You should have it up in about 10 minutes if you have all the other parts in place. If not, you may need an hour or so to configure whatever you are missing. URL looks like this example if you need to run in parallel to iNotes: https://keithbrooks.com/verse

Ontime Freemium Group Calendar Info: It will probably get done over the weekend.

A Domino TOTP PSA

noreply@blogger.com (Keith Brooks) — Thu, 10 Nov 2022 08:44:00 +0000

SnTT - Which Database has an FTI?

noreply@blogger.com (Keith Brooks) — Thu, 03 Nov 2022 07:28:00 +0000

Earlier this year, Martin Vogel and I gave a session at Engage titled "Teaching Young and Old Dogs New Tricks: Notes & Domino Shortcuts You Wish You Knew," It was a great session with a filled capacity of the room.

But I was neglectful; I had planned to post some essential tips in my blog at the time but did not get to it. I will try to make up for it over the next few weeks.

The first one that not everyone may know about is how to find out which databases have a FTI, Full Text Index.

Here is the scenario:

You are asked to build new servers for your customer or organization and while looking at the old server, notice some indexing on some databases. This causes you to think, how do I find out which databases have an FTI so they can be rebuilt on the new server?

Good question, right?

I will first provide an answer for anyone not on R12 and then post the R12 way.

Pre R12 FTI Details for any given Database

Open the catalog.ntf in the designer client
Open the Views List
Edit the Applications\by Server view
Insert a column where you want it, and name it FT Index
Change the field for this new column to DbFullTextIndexed
Set the column to sort both ways
Save your changes
Replace the design of your catalog.nsf

NOTE: This presumes all your databases are set to show in the catalog.nsf, so not 100% foolproof

The R12 way to see FTI Details for all Databases on Your Server

Open the Administrator client

Go to the Files tab

Click on File-Preferences-Administration Preferences

Select the Files Tab

Add the FT Index (see screenshot below, FT Index is the last one in the list)

Reorder the column location, or it may end up in the 27th column

Restart the Administrator client to see the change

If you need it, you can copy and paste the full view into Excel if that helps you track what you are doing.

Pretty cool if you ask me that this got added in R12. I had asked for it in an Aha request, and it got done, so Aha is listened to by HCL, here is the link to that request:

https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-264

It was the first item added to the column list since before R9 at least.

How to Enable, or Disable, TOTP for HCL Traveler and Verse

noreply@blogger.com (Keith Brooks) — Thu, 27 Oct 2022 12:00:00 +0000

After a discussion with fellow HCL Ambassador David Hablewitz, I realized I did not fully explain the HCL Traveler/Verse (will just refer to it as Verse) and TOTP issue in my blog post the other day,

I intended to explain the pros and cons of using TOTP and Verse, but I neglected to explain how to enable or disable TOTP and what you do if you have one server or separate servers.

The how-to is what this post is about.

It is pretty easy to do in a proper environment where Verse sits on its own server.

You probably see something similar to this in your Internet Sites for the Verse server (ignore the 404 error page I was testing):

If you double-click on the head item on the Web Site, you will see where you turn TOTP on or off. I am presuming you have set TOTP up already. The option is there because of the names.ntf template changes in R12 and R12.0.1.

If you don't want TOTP, change the selected option to "Yes" instead of "Yes with TOTP."

Simple, right?

What if you are a smaller organization that relies on one Domino server to do anything and everything? What if you don't want Verse to have TOTP, but access to applications, or mail, should have TOTP?

My suggestion from a security perspective is to create a new URL for Verse. It is easier, under R12, for you to create a unique URL for your domain and get a Let's Encrypt SSL certificate for it for free.

Sidenote: I understand that you could leave it set up as it is above and turn TOTP off for the default website. You may do this because you don't want to field tons of help desk calls from users who can't change a URL, but this route would leave your whole server in a less secure mode.

Decide on the new URL, traveler.company.com.Set it up in your internal and outside DNS.

Create the new Internet Site document for the unique domain. It may look something like this:

Don't forget to edit your Traveler URL section of the server document to accommodate this change.

And now you can restart HTTP and Traveler, and you should get prompted for TOTP at your domain, but not with Verse once outside DNS changes go into effect. So I suggest you set it up and wait till the exterior works, then cutover internally.

You will need to create all the docs, so it looks like this:

And users may have to reinstall Verse to change the URL.

Once set up, you can turn on TOTP for Verse down the road if you wish. This also lets you move the Verse server easier in the future because it is no longer tied to your server, just the URL.

My Slides from my TOTP Collabsphere Session

noreply@blogger.com (Keith Brooks) — Wed, 26 Oct 2022 06:22:00 +0000

Since Slideshare went paywall, I am trying Speaker Deck now.

https://speakerdeck.com/kbmsg/totp-tips-tweaks-and-troubleshooting

Customizing the TOTP Login Form and MFA Pages

noreply@blogger.com (Keith Brooks) — Tue, 25 Oct 2022 19:15:00 +0000

Continuing the extension of my TOTP session from Collabpshere, I wanted to expand upon modifying the Login Form and MFA page for those who need it and want to know how to do it.

The truth is I covered this in my 2021 Collabsphere presentation but since learned a few things which I want to pass on to all of you.

In 2021, I created this flowchart explaining how to add your corporate logo to the background logo.

How to add your company logo to the TOTP Backgroud graphic.

Of course, you could use any graphic, just figure out the scaling side, but I found it easier to just add my logo to the existing MFASetup1.png file.

There is a style.css file (Under Resources-Style Sheets) where if you find this section, you can change the graphic to whatever you want by renaming the png file and, of course, adding your graphic to the Resources-Images section:

Today I found it was not letting me add a company logo to the .png with the 12.0.1 template. I had previously done it with the 12.0 template. So YMMV.

So how do we let people know it is the company's MFA login page?

I edited the form called $$LoginUserFormMFA in the domcfg5.ntf. If you don't do it in the ntf, you will lose your updates when the design task runs.

I replaced the HCL Domino text with the company name and added MFA Login Page.

While editing the text, I added the details below, which is helpful since the default page tells the user nothing.

MFA Instructions / Help

To set up and start using MFA take the following steps:

Step 1: Enter your Username and Password and press the 'Login' button.

Step 2: Follow the prompts to set up Multiple Factor Authentication, our preferred authenticator app is Duo.

Step 3: Once you have set up the MFA, return to the login page. Enter in your username, password, and MFA Token via your authenticator

Step 4: Click the Login button.

Naturally, you can add whatever text you wish and probably add a popup help window, among other things, but I am just a simple admin.

Don't forget to save your changes.

While still in this form, if you go to the list of objects below the window and look for the "Window Title" object, you can edit the text there, as I have, so it says "The CompanyName MFA Login Page." And don't forget to save your changes.

I like to minimize helpdesk calls, so I want people to realize it is a legitimate site. I know, hokey, but something is better than nothing.

The hard part, and I don't suggest you do this unless you really want to do it, is to edit the MFA Setup page.

You see, it is not a page, or a form, or a view. It is a small java file.

You would have to unarc/zip it or whatever you do to java files, edit it, recompile it, and put it back on your server.

And if you do a server update, it will wipe it out.

And you would have to do it all over again. You might be able to copy the file, but if HCL makes any changes, you are screwed, so I have decided not to mess with it.

The .ntf would also get overwritten on an update, so why do it there?

To me, it is easier to replicate and maintain a local copy of the .ntf than to do it for the java part, but again, YMMV.

My personal server page looks like this now:

If you previously had a custom login form and now want to add TOTP, I strongly suggest you copy your custom form into the $$LoginUserFormMFA and sort it out from there.

There are too many parts to TOTP and the domcfg database that will make it hard to do it in reverse,

I am sure my developer friends may make fun of me, but this was the easier(less time involved) of the 2 ways we tried to do it to bring it up and make it work. Again YMMV.

I did not touch on the use of the notes redirector, but that is how we are using it, and of course, if you need to edit the iNotes Redirector, I wrote a few posts about it many years ago, you can click on that section from the top of my blog or use this link: https://blog.vanessabrooks.com/p/inotes-redirector.html.

To TOTP, or NOT To TOTP, Traveler/Verse users, THAT is THE Question

noreply@blogger.com (Keith Brooks) — Fri, 21 Oct 2022 10:53:00 +0000

Whether 'tis nobler in the mind (of users) to suffer The slings and arrows of outrageous ~~fortune~~ security guidelines, Or to take arms against a sea of (illogical) troubles, And, by opposing, end their tyranny upon us?

Shakespeare will have to live with my edits.

Enjoy the video because it is THE definitive way to say the quote :-)

Now that Collabpshere has finished, it was a great event once again managed by Richard Moy with a supporting cast of dozens of people, I had a follow-up item from my session.

I will post the slides once I find a new home now that Slideshare has gone paywall.

The question continues to arise about using TOTP for Verse(Traveler) users.

If you attended my session, you heard me discuss the pro (not sure if there is anything beyond my insurance/compliance or security people require it) and the many cons.

If anyone has more PRO reasons, let me know, but for now, this is the slide I used.

Remember that current phones usually require a code, slide design, finger, face, or eye scan just to let you into your phone.

Then the Verse app has a login and password for itself.

Do you still need an MFA after 2 levels?

Also, if the whole purpose of the MFA is to secure the mail application, what purpose does it serve by being on your phone, if your phone is lost or stolen? Let's say the robber has the initial code(stop using your birthday or kid's birthday or anniversary). Then having the fa there is totally useless.

So, why do you want to enforce this?

Right, because your insurance company told you.

Oddly enough, they did not tell you to disable SSO(Single Sign On), which negates any aspect of MFA a computer might have to start with. Nor do they expect you to have an MDM solution, which is really what you need for this purpose.

Traveler/Verse has some aspects of MDM, like remote wipe, but does not verify your device has the appropriate number of digits in your passcode.

So, again, why do you need to do this?

Have you asked for the technical guidance document from your insurance company?

You should let me know if any of them ever produce one. And if they have one, does it make any sense?

TOTP is URL-based, not Server or Domain-based.

You can let Verse users use the usual traveler.company.com URL without TOTP while maintaining TOTP enabled for webmail.company.com see my slide below.

Yes, you can change the TOTP time-out setting (https://help.hcltechsw.com/traveler/12.0.0/auth_timeout_totp.html), which I did on my personal server, so I only log in with TOTP if my phone has been off for more than 18 hours. This happens every weekend, I shut it off an hour before sunset and turn it back on after sunset on Saturday.

The choice is yours, as the Admin, but you will have more help desk tickets every Monday morning and possibly every time a user flies, and they will think they are locked out.

So, in the immortal words of the Bard of Avon,

"Out of this nettle - danger - we pluck this flower - safety."

'Henry IV, Part 1' (1597) act 2, sc. 3, l. [11]

Engage Recap

noreply@blogger.com (Keith Brooks) — Thu, 26 May 2022 16:41:00 +0000

I can't even begin to tell you all the things we saw and learned, and that was before Engage even started,

Highlights include:

Forgot to add this: Restyle. It will update your old Domino applications appearance and give it a modern look in minutes! Totally cool!

Project Keep is back
R13.0 is a 2024 thing, with 12.02 being out by Q4-22 and 12.03(or maybe 13 if they change their mind) in 2023.
The designer client is getting redone(no idea what that means) for the 2023 time frame,
When I asked about the admin client, it was missing from Barry Rosen's slide. I got some interesting answers, so something is brewing, but no date is planned, so think R13. For that keeping score, Tim Clark is PM for Admin client.
12.02 I think they said they will have Busytime lookups for O365 invitees, maybe 12.03, either way, this is great and needed by everyone.
More DKIM and SPF, and DMARC parts are coming soon.
Verse 3.0 is out soon(June). Less iNotes more purposeful built things in it. Read the Read me file as Agnes said, Beta for Verse means something is included but not default turned on. So check it out and RTFM.
HCL VOLT MX GO was announced to help customers connect more parts of their world to Domino and vice versa. Jason Gary did a pitch about the name at Engage. If you remember the 90s/00s when we had Domino Go Server and similar things, you get what this is about.
Verse mobile is the Traveler client. Confusing? Yes, is it going to be changed? No.
In my session, half the room was already on R12, and I would think many of the customers that attended were as well.
Sametime 12 is available. It only runs in a container.
HCL is pushing out ALL the 3 tiers of languages on the GA dates, unlike IBM, which made everyone wat 30/60/90 days.
Certifications and HCL Training are coming back, Luis Guirigay's slides should be reviewed for more details. Engage will be posting the slide decks shortly.
Talk about having a by default ODS update built into the client when you install it.
The ability to swap who is sending the email is getting enhanced further.
Just a reminder, 12.01 had a names.nsf template update you want to use, especially if you are working on a TOTP plan.
Nomad will not require Safelinx any longer, thanks to the dev team that said "we can do this" and they did!
Chocolate is good, free chocolate is better, but free beer is the best.

I went into the event relatively neutral but left very upbeat and impressed by HCL and what they are saying and showing. While I may disagree with the dev first mentality, I am, after all, a long-time (29 years?!) messaging and an admin person.

If you do not go to these types of events, where everyone from Richard Jefts down to the sales and tech staff is accessible, you are missing out on having yourself heard.

My time with Richard, was really insightful. Then again, so were my discussions with Barry, Andrew, Scott, Michael, Luis, and many more people, even the great Gareth Cook of the iNotes Redirector fame.

Thank you to Theo and Hilde for once again putting on a great event and making everyone feel comfortable and happy to be part of the extended Yellowverse family.

Lastly, I want to thank Martin Vogel for presenting with me. It was his first time presenting at Engage and his first time presenting in English. He nailed it. I will be posting our tips over the next few weeks because Slideshare no longer works the way it used to, and some of the tips should be searchable and not hidden in a presentation.

Crazy 2021 Ending, The Streak Continues as an HCL Ambassador

noreply@blogger.com (Keith Brooks) — Thu, 16 Dec 2021 19:53:00 +0000

The last 2 years have been brutal in many ways, and honestly, after my efforts with #HCLAmbassadorTips in 2020, 2021 for me was relatively quiet.

But HCL has deemed me worthy of continuing as an HCL Ambassador, now going on 9 years in a row, including the prior years as an IBM Champion.

Maybe I did something right for my clients, or I did something wrong, and no one complained. Yeah, I did blow some stuff up by accident at a client, but not like what I did in my first real IT gig.

Maybe my sessions at the various events in 2021 were so awesome they had to make me an ambassador again. Then again, I doubt the 10-50 of you that showed up are on the voting committee. The rest of you that did not appear, that's ok, I was zoomed out already in 2020. Beers for all of us at Engage, I hope.

The long tail of those sessions, however, is massive.

And that is what HCL expects from its Ambassadors. To provide content, help, support others and find ways to assist the community and worldwide customer base.

Some of my slides posted this year have over 500 views. I wish I knew why so I could repeat it again in 2022.

Likewise, some blog posts about the topics I presented this past year are over 3,000 hits which for my blog, given how often I write these days, is pretty impressive.

So what will I do in 2022?

I have no idea. My post from last year did not promise much in 2021 because I really was worn out from the 366 tips I posted.

But, for those who want to understand this Ambassador thing better, I point you to my post last year around this time of the year for how you can join in the fun.

https://blog.vanessabrooks.com/2020/12/what-does-it-mean-to-be-hcl-ambassador.html

I told my oldest daughter that I may start a TikTok Tips thing.

She is still laughing hours later.

I had some other ideas but nothing concrete enough to commit to writing.

Until then, congratulations to all of the HCL Ambassadors wherever you are in the world, and I hope to see you in 2022 someplace, some time.

My Collabsphere Session on TOTP/MFA and HCL Domino R12

noreply@blogger.com (Keith Brooks) — Wed, 20 Oct 2021 18:00:00 +0000

Great to be speaking again at Collabsphere.

This was the first of my 2 sessions, feel free to download it and ask any questions about it.

Yes, It's Number One it's TOTP! from Keith Brooks

SnTT - TOTP Needs an ID file in the ID Vault to Work, What if some are Missing?

noreply@blogger.com (Keith Brooks) — Tue, 19 Oct 2021 12:59:00 +0000

Yes, of course, a properly managed Domino environment should have been using the ID Vault for several years now.

But we all have customers who, for one reason or another, just never did it, or worse, think they did but never check that it worked.

And then we hear from them out of the blue to help get TOTP installed and update their environment.

No big deal, right? Set up the ID Vault, and when people log in to their Notes client, their ID files get sent to the ID Vault. Newly registered people are also automatically added to the ID Vault.

But what do you do about people who solely use webmail/iNotes?

How do you get their IDs into the ID Vault?

This, I thought, would be an easy thing, but it turned out to be way more effort than first thought.

One option is to select the user in the Directory with the names.nsf open, right-click on their person document, and select upload ID to the ID Vault. A similar Action from the top menu bar option can be found in the Admin client when the Directory is not open.

Not so fast.

First, the option and action did not appear. Second, even if they did appear, we had 2 problems: where were these people's ID files and the better issue was who had the passwords?

When you upload ID files to the ID Vault, Domino asks for the password for the file being uploaded, and if it does not match, you are out of luck.

We could not resolve the 2nd problem. More on that in a minute.

The first problem, I reached out to HCL Support to find out what happened to the action/agents.

Turns out they were in the template but not in the database.

After reviewing it with HCL, we found the customer had edited the People view of the Directory and set it to not update with changes from future templates.

I changed that setting in Designer and the properties of the view, then ran a replace design on the Directory, restarted the server, and it now worked and showed the action/agent items.

Now, back to the ID problem.

How can one register new users optimally without wiping out all their details in their existing person document?

I figured I needed to look at registering people with a text file and how to do it without changing their existing internet password or wiping out their mail file.

11 years ago, I wrote this post, https://blog.vanessabrooks.com/2010/06/id-registration-via-text-file.html, waiting for the moment it would be helpful again.

Well, that day has come. However, to be fair, I have used it a few times over the years.

I also searched for how to create a user but not a mail file. I did not get an answer to this in my searches or when asking some people, so I decided I just had to work around the issue. If anyone knows, please let me know in the comments, and I will edit this post accordingly.

Using the spreadsheet I created in 2010, I started figuring out what the syntax should be to complete this.

After a few tests, ok, maybe a few more tests, I realized I needed to maintain the file names but change the file directory. That way, dummy mail files would be created, which could be deleted, saving their existing mail files. However, the person document would now show the wrong location for the person's mail. Hang on, we will fix that soon too.

These people needed ID files in the ID Vault but would never use them otherwise. The ID files require a password, but we do not want it to synch with their internet password because that would overwrite their existing one. Domino has a way to help us do this, too; the explanation is below.

What does this spreadsheet look like before you copy the text to a .txt file? I figured I only needed to use a few fields, and this is what I used just 6 fields:

LAST FIRST PASSWORD FILE DIRECTORY FILENAME EMAIL

Now the fun part is you need a semi-colon (;) after any entry you want to enter, so my text file for registration ended up looking like 250 of these(see the 11-year-old blog post for details on what goes in what order if you need more fields):

Brooks;Keith;;;PASSWORD;;;;mail2;kbrooks.nsf;;;;;;keith@b2bwhisperer.com;

But you need one more essential thing before starting the registration process for everyone.

If you click on options from the Registration window menu,

you will want to check the line that says "Allow Registration of previously registered people," and check the "Don't prompt for a duplicate person" option, and select the most important option, "Update the existing address book entry.

When you use these settings, Domino will not stop for every duplicate user and just change precisely what we tell it to change in the person document.

In the registration form, you should ensure your ID Vault policy is set up for everyone.

As discussed earlier, we don't want to overwrite any existing Internet passwords; thus, you need to click on Password Options and uncheck "Set Internet Password"; otherwise, you will write over their current Internet password. HINT: Back up your Names.nsf before doing this, so if you do screw it up, you can get it all back quickly.

In the Mail tab of registration, you set the mail template to use and leave the mail file name field with just the directory name. The .txt file handles this.

Set the expiration date you want to use for everyone you are creating on the ID Info tab.

Now you import your .txt file, and Domino will tell you if any of them have syntax issues.

Domino will then let you know if anyone had issues or how many were completed when you ran it.

Please test with 2-3 people first, making sure all fields and entries look right, and the mail file is created where you specified.

How do we change the mail file locations, which now were mail2 instead of mail for 250 people out of 500?

A few months back, I started adding scripts to Openntf.org under the snippets Admin Scripts area to help other admins and for just this purpose.

I took one of the scripts, adapted it for the Mail File location field, and then selected the users to run it on, and in seconds they were all back to normal.

I posted that new script as well in case anyone will need to do this at the openntf site here.

Afterward, we had a few issues:

Some people we were told were solely web users were not. This meant they lost their ID certificate and could not log in. Easy enough to fix by copying the new certificate into their person document and replacing the old one.
A few people in our spreadsheet had mistyped an email or mail file name and a few similar names and file names that got by us in editing. Easily fixed, we had a backup to verify what they should have in their fields.

And there you have it. I know it sounds like a lot, but really, it is not that big of a deal.

SnTT - Changing Some, But Not All, User's Mail Templates

noreply@blogger.com (Keith Brooks) — Thu, 07 Oct 2021 22:14:00 +0000

You know how to convert one person, you know how to convert a folder or a directory...But do you know how to convert just some people's templates in your company?

Well, here is my story, how I changed 250 out of 450 people's templates.

Feel free to do this another way, but this worked and worked well, once I figured out the syntax and other item details missing from the official documentation.

My hope is you, and future me will be able to benefit from this in the future.

This is the original R12 Detail:

Upgrade all mail databases listed in a text file	You can create a text file listing databases you want to upgrade and use it with the mail conversion utility to upgrade only those databases. For example, you can create the text file MAILLIST.TXT to list all the mail databases you want to upgrade and save it in the directory C:\TEMP. This example finds all databases listed in MAILLIST.TXT, determines whether the databases use a design template name that matches Mail, and replaces the designs of the matching databases with mail9.ntf), the Notes® 9.0.1 Social Edition mail template. load convert -f c:\temp\maillist.txt mail.ntf mail9.ntf

Upgrade all mail databases listed in a text file

You can create a text file listing databases you want to upgrade and use it with the mail conversion utility to upgrade only those databases. For example, you can create the text file MAILLIST.TXT to list all the mail databases you want to upgrade and save it in the directory C:\TEMP. This example finds all databases listed in MAILLIST.TXT, determines whether the databases use a design template name that matches Mail*, and replaces the designs of the matching databases with mail9.ntf), the Notes® 9.0.1 Social Edition mail template.

load convert -f c:\temp\maillist.txt mail*.ntf mail9.ntf

First things to note that is ambiguous or wrong in the above documentation:

1) NOTE:C:\temp is a directory on the server, not your admin client workstation.

2) Instead of mail*.ntf you need to put the name of the template, not the file name(as shown, I think that is a typo copied from a different option on the page and not edited correctly)

3) There are many options for the conversion tool so check the documentation page for specifics you may need.

Now for the fun, how do you do this!

No, wait, before we run the magic convert command, we need to create the .txt file and fill it out properly.

You probably need an export of your Directory people so you can sort out who you need and the right details.

Open your Admin client and go to the Files Tab and find your Mail folder.

Select ALL (Ctrl-A)

Open a spreadsheet and paste it all in there.

Now we really don't need all of the data, right now, but I needed it for my second act.

I need to create IDs for people in the ID Vault as some people are solely web users and TOTP only works if you have an ID in the ID Vault. More from me about TOTP at Collabsphere.

Back to your data, I suggest copying columns A and B for the moment into a new tab of your spreadsheet, so as not to mess with the data in case you need it again.

Now you can remove the people you don't need to fix so the list is just people you need to convert their templates.

Next, add a column in front of the filename column which was column B.

In the first cell of the new column put in the mail folder name, commonly would look like this: mail\

Copy that the length of your list.

Now in Column D at the first cell, use the =CONCATENATE(B1,C1)

and you will now have a visual entry similar to this:

mail\abbott.nsf

mail\costello.nsf

mail\groot.nsf

Copy the D1 cell the length of your list.

Now select all the concatenated cells and copy them.

Open notepad or a text editor and paste them in there.

Save the file and give it a simple name, like templates.txt and save it to your server.

Now you are ready for the magic!

NOTE: TEST with 2 names and see if they run, if not, you have a typo in the command or a syntax one in the .txt file, or an incorrect directory name problem. Domino is pretty good here to tell you why it failed.

You need to stop the router to prevent any inbound mail issues/corruption.

Server console Type: Tell Router Quit

Next, at the Server Console type (make sure you use the old template name NOT filename followed by the .ntf name for the one you require):

load convert -f -u e:\up\mailtest.txt stdr10mail mailX.ntf

-u will update the folders the user has created.

-f reads the names to update from the text file.

The server should start processing everyone.

Cool, right?

UPDATE: Upgrade all previous users' mail designs listed in maillist.txt to Notes mail design if there is no mail template specified. Use: load convert -u -f maillist.txt * mailX.ntf

We also ran a program document to run updall -R overnight (DBMT should fix this but if it only runs on weekends, then you need a program document or just run it at the server console) just in case some people had inbox issues like only seeing new mails, not all of their other emails in their inbox, they may have been replicating at the time.

That's it, a little trial and error on my part to help all of you out there and let you go home earlier than I did the last few days.

Hacking Administrators, my AdminCamp session

noreply@blogger.com (Keith Brooks) — Wed, 23 Jun 2021 08:22:00 +0000

This is the second of my sessions from AdminCamp.

This session had a theme of the Avengers, but was about helping administrators do repetitive tasks faster, easier, and in multiple ways.

Thank you to everyone that came to listen and to MArtin for the shortcuts at the end for people.

I think we may have an idea for a future session.

Hacking Administrators from Keith Brooks