SECURING
The following notes.ini settings pertain to the ID vault.
ENABLE_AUTORECOVERY_FROMBADPASSWORD
Syntax
ENABLE_AUTORECOVERY_FROMBADPASSWORD=1
Default
None
Description
Replace the ID file in the ID vault with the local ID on the Notes client when synchronization remains stopped for longer than seven days due to mismatched passwords between the local and vault ID files. For more information, see Enabling automatic restart of ID file synchronization.
Applies to
Vault servers
IDVAULT_COUNT1
IDVAULT_COUNT1=number
Number of Notes sessions since the Notes client last synced with the ID vault. This is a session counter that increments when the Notes client starts and zeroes out when the client syncs. This setting is used with IDVAULT_STAMP1.
Administrators don't control this setting.
Notes clients
IDVAULT_RESYNC_INTERVAL
IDVAULT_RESYNC_INTERVAL=<minutes>
480 (8 Hours)
This setting controls how soon after the last successful sync with the ID vault Notes clients attempt to sync again. The IDVAULT_STAMP1 setting records the time of the last successful sync.
The lower the IDVAULT_RESYNC_INTERVAL value the sooner changes are synced. This setting also controls the balance between resources used on the server. The higher the value the less balance between resources.
For example, a company wants to sync changes to IDs in the vault to clients within five hours rather than eight hours. The ID vault server can handle the increased load. The company uses the following setting:
IDVAULT_RESYNC_INTERVAL=300
Note:
IDVAULT_STAMP1
IDVAULT_STAMP1=Date/Time
Last time a Notes client synchronized with the ID vault.
If it has been more than 24 hours since the last sync and IDVAULT_COUNT1 is greater than 4, then the client synchronizes immediately.
Otherwise, the IDVAULT_RESYNC_INTERVAL value added to this value determines when the client next attempts to sync with the vault to check for changes.
IDV_ENABLE_VAULT_SCAN
IDV_ENABLE_VAULT_SCAN=value
IDV_ENABLE_VAULT_SCAN=1
Controls whether the Query Vault (qvault) command can be run. For more information on this command, see Monitoring ID synchronization.
Vault servers, Domino Administrator clients
IDV_POLL_INTERVAL
IDV_POLL_INTERVAL=<milliseconds>
5000 ms (5 seconds)
The maximum time allowed for an ID download from the ID vault to the Notes client. An ID download is attempted when a user provides an incorrect password or a new password after a password change. Specify a value in milliseconds.
For example, at a small company an ID vault server is also used as an application server and server response can be slow. An administrator uses the following setting to increase the interval to 10 seconds to give the vault server time to respond:
IDV_POLL_INTERVAL=10000
If access to the vault server is slow, you can use this setting to solve two problems:
IDV_RESETPASSWORD_DIGEST
IDV_RESETPASSWORD_DIGEST=2
Updates the password digest field in a Person document after resetting a password in the ID vault.
IDV_RESETPASSWORD_DIGEST=0 (No action)
When you reset a password on a Notes ID in the vault and the Check password on Notes id file option is enabled in a user policy, use this setting on the Domino server with the ID vault to create an administration process request to update the password digest in the user's Person document to match the new password. Only ID files with this password digest can access the server after the administration process request is processed. For more information, see Resetting the password on an ID in a vault.
IDVaultLastFlushTime
IDVaultLastFlushTime=<date/time>
When the value of the IDVaultLastServer variable was last changed.
IDVaultLastServer
IDVaultLastServer=<vault server>
The name of the vault server last successfully used. This server is tried for ID vault transactions to avoid the cost of asking the home server for a referral list.
The variable is deleted every two weeks to ensure load balancing occurs among the vault replicas after a change in replicas or a replica failure / recovery.
IDVault_Max_Auth_Failure_Cache_Size
IDVault_Max_Auth_Failure_Cache_Size=<size>
500
The number of bad password entries in the bad password cache that trigger a log error when an ID vault is used. When a user enters a bad password, a bad password entry is made in a cache. The cache is cleared daily. If the limit is reached, an error is logged suggesting that too many people have entered bad passwords and the administrator should check the log for an attack.
For example, a company's ID vault holds a very large number of ID files and people often legitimately forget their passwords, so the company uses the following setting to increase the value to 1000:
IDVault_Max_Auth_Failure_Cache_Size = 1000
IDVault_Max_Auth_Failures
IDVault_Max_Auth_Failures=<number>
10
The maximum number of consecutive download attempts that are allowed in a day before attempts are denied. Consecutive failed attempts are kept in the bad password cache.
SECURE_DISABLE_AUDITOR
SECURE_DISABLE_AUDITOR=1
SECURE_DISABLE_AUDITOR=0
When set to 1, disables the vault administrator Auditor role. The Auditor role is enabled by default and allows a vault administrator to extract an ID file from the vault without knowing its password. For more information, Extracting an ID file from a vault.
Note: To set this variable, you must edit the notes.ini file directly on the server.
Parent topic: Notes ID vault