Novell Documentation: Nsure Identity Manager Drivers

Planning for the Installation

Before you install and use the driver, you must plan a local or remote installation and define user accounts for GroupWise driver access.

Understanding a Local Installation

A local installation installs the driver on the same Windows NT/2000, Linux, or NetWare^® computer where you installed Identity Manager and eDirectory^TM. The GroupWise domain database can either be on the same computer or a different computer.

If . . .	Then . . .
The GroupWise driver is running on a NetWare server. . .	The GroupWise server (domain database) must also exist on NetWare.
The GroupWise driver is running a Linux server. . .	The GroupWise server (domain database) must be on the same server.

NOTE: NFS or any other type of mounted file system is not supported if the GroupWise driver connects to it. For example, the GroupWise driver running on LInux should not connect to a domain database on another server through a mounted file system; or a domain database on a Linux server should not be accessed by a GroupWise driver running on any other server, regardless of the operating system.

Understanding a Remote Installation

A remote installation installs the driver on a different computer than the one where Identity Manager and eDirectory are installed. You should use this configuration when Identity Manager and eDirectory are installed on a Solaris* platform. The driver is installed with the Remote Loader on a Linux, NetWare, or Windows NT/2000 system. The GroupWise domain database can be on any of the systems or on a separate system.

GroupWise can be installed on a separate system, on the system where the DirXML engine resides, or on the driver system (two-system installation); or all components can be installed on a single Linux, NetWare, or Windows NT/2000 system.

Configuring Driver Authentication

In order for the driver to authenticate to the GroupWise domain, the driver must first authenticate to its local operating system, and then authenticate to the system holding the GroupWise domain. (If the driver is on the same computer as the domain database or running on Linux, you do not need to configure authentication.)

As part of configuring authentication, you create the same username and password on each system, and assign the account administrative rights.

IMPORTANT: To establish a connection between systems, you must create user accounts with the same username and password for each system.

The following topics help you configure authentication:

Creating a User Account for the System Containing the Driver for Windows NT/2000/XP

As part of configuring authentication, you should create the same username and password on the system containing the driver, and assign the account administrative rights.

After you have created the user account for the driver system, refer to Creating a User Account for the System Containing the GroupWise Domain.

Defining an Account when the Driver Is on Windows NT

From the Start Menu, select Programs > Administrative Tools (Common), then click User Manager.
Select User > New User, then specify a new username.

The user name must be the same on both systems.
Specify a case-sensitive password.

The password must be the same on both systems.
Select Password Never Expires, then deselect all other boxes.
Select Groups, select Add Administrators to the "Member of", then click OK.

IMPORTANT: This user should be part of the administrator group.
Click OK.
Select the user you just created.
Select Policies > User Rights.
Select the Show Advanced User Rights check box.
Select Log on as a Service from the Rights drop-down list.
Click Add, then click Show Users.
Select the user you just created.
Click Add, then click OK.
Click OK.
Close the User Manager window.
Restart the system.

Defining an Account when the Driver Is on Windows 2000

From the Start Menu, click Settings > Control Panel > Administrative Tools, then click Computer Management.
In the Tree view, open Local Users and Groups.
Click Users, click Action, then click New User.
Specify a username, and a case-sensitive password.

The username and password must be the same on both systems.
Click Password Never Expires, click Create, then click Close.
Deselect all other boxes.
In the Tree view, select Groups.
Double-click Administrators.
Click Add.
Click Add to select the user you just created, then click OK.
Click OK.
Close the Computer Management window.
Select Local Security Policy from the Administrative Tools window.
Open Local Policies in the Tree view.
Select User Rights Assignment.
Double-click Log On As a Service.
Make sure your user is displayed and has the "effective rights" box checked.
Select Add, specify the user you just created, click Add, then click OK.
Click OK.
Close the Local Security Settings window.
Close the Administrative Tools window.
Restart your computer.

Defining an Account when the Driver Is on Windows XP

To define a user account when the driver is on Windows XP:

From the Start Menu, click Control Panel, Administrative Tools, then click Computer Management.
In the Tree view, open Local Users and Groups.
Click Users > Action, then click New User.
Specify a username, and a case-sensitive password.

The username and password must be the same on both systems.
Deselect all boxes except Password Never Expires, click Create, then click Close.
In the Tree view, select Groups.
Double-click Administrators.
Click Add.
Specify the user you just created, click Check Names to verify the name, then click OK.
Click OK.
Close the Computer Management window.
Open Local Security Policy from the Administrative Tools window.
Open Local Policies in the Tree view.
Select User Rights Assignment.
Double-click Log on As a Service.
Select Add User or Group, then specify the user you just created.
Click Check Names to verify the name, then Click OK.
Click OK.
Close the Local Security Settings window.
Close the Administrative Tools window.
Restart your computer.

Defining an Account when the Driver Is on Windows 2000 AD Domain Controller

From the Start Menu, click Settings > Control Panel > Administrative Tools, then click Active Directory Users and Computers.
In the Tree view, click Users, click Action, click New, then click User.
Specify the full name, then specify the user login name.

The user login name is used in the driver configuration. The user name must be the same on both systems.
Click Next.
Specify a case-sensitive password.

The password must be the same on both systems.
Select Password Never Expires.
Click Next, then click Finish.
In the Tree, select Builtin, click Administrators > Members, then click Add.
Select the full name of the user you entered in step 3, click Add, then click OK.
Click OK.
Close the Active Directory Users and Computers window.
In the Administrative Tools window, select Domain Controller Security Policy.
In Tree, expand the Security Settings, click Local Policies, then User Rights Assignment.
Select Log On As a Service and select Define These Policy Settings. Click Add twice, then click Browse.
Browse to and select the user you created in step 3. Click Add, click OK, then click OK again.
Click OK and close the Domain Controller Security Policy window.
In the Administrative Tools window, select Local Security Policy.
In Tree, expand Local Policies, then click User Rights Assignment.
Select Logon as a service, select Local Policy Settings for the user created in step 3, then click OK.
Close the Local Security Policy window.
Restart the system.

Creating a User Account for the System Containing the GroupWise Domain

As part of configuring authentication, you should create a username and password on the system containing the GroupWise domain and assign the account administrative rights.

IMPORTANT: To establish a connection between the driver and the GroupWise domain system, you should create user accounts with the same username and password for each system.

If the GroupWise domain exists on Linux, and the driver is on Windows NT/2000, the Linux account must be created in Samba. For all other platforms, use the following instructions.

If you have not created the user account for the driver system, refer to Creating a User Account for the System Containing the Driver for Windows NT/2000/XP. (If the driver runs on Linux or NetWare, you do not need to create this user account.)

Defining an Account when the GroupWise Domain Is on Windows NT

From the Start Menu, select Programs > Administrative Tools (Common) > User Manager.
Select User > New User > specify a name.

The user name must be the same on both systems.
Specify a case-sensitive password.

The password must be the same on both systems.
Select Password Never Expires and deselect all other boxes.
Select Groups > Add Administrators to the "Member of", then click OK twice.
Click OK to close the User Manager window.
Double-click the My Computer icon on the desktop.
Right-click the drive that contains the GroupWise Domain > Properties > Sharing.
Select New Share.
Specify a share name to be used by the drive.
Restart the system.
Select Permissions > Everyone > Remove menu.
Select Add.
Select the user you added above.
Click Add, then click OK.
Select Permissions: Full Control, then click OK three times.
Restart the system.

Defining an Account when the GroupWise Domain Is on Windows 2000

From the Start Menu, click Settings > Control Panel > Administrative Tools > Computer Management.
In the Tree view, open Local Users and Groups > Users > Action > New User.
Specify a username.

The username must be the same on both systems.
Specify a case-sensitive password.
Select Password Never Expires, and then deselect all other boxes.
Click Create, then click Close.
Close the Windows Manager window.
Double-click the My Computer icon on the desktop.
Right-click the drive that contains the GroupWise Domain > Properties > Sharing.
Select New Share.
Specify a share name to be used by the drive.
Restart the system.
Select Permissions > Everyone > Remove menu.
Select Add.
Select the user you added above.
Click Add, then click OK.
Select Permissions: Full Control, then click OK three times.
Restart the system.

Defining an Account when the GroupWise Domain Is on NetWare

If the driver is running on NetWare or Windows NT/2000 and the GroupWise domain is on a remote NetWare server, it's especially important to verify that this user has rights to the GroupWise directory tree. If access is not granted to this user, changes do not replicate to the rest of the GroupWise system.

In ConsoleOne, create a user in NetWare with the same username and password as the Windows user account.
Give the user Read, Write, Create, Erase, Modify, and File Scan access to the GroupWise primary domain directory and subdirectories.