I read Paul Robichaux's description of how to immediately disable access to an Exchange mailbox which got me thinking.

A brief summary for those that didn't follow the link - if you have someone who's leaving very quickly - being escorted off site by security, one presumes - then to remove their access to their mail on an Exchange Server you'll need to do the following:

1. Disable the mailbox
2. Set the send quota for the user to 0
3. Move the mailbox to a new information store

If you don't do these steps and someone still has Outlook open, then they may still have access for up to two hours after you disable them.

(Note that two hours is probably a worst case timescale, but still worth remembering.)

So, what do we do to remove access for a Domino user?

1. Add the user to a Deny Access Group (which will prevent them accessing their mailbox and sending email)
2. On the user's home server (and cluster servers if used), check for connections and drop them
3. Remove access for webmail/applications as appropriate.

Total delay?  Probably about an hour, depending on the environment.

And note that we're talking about removing access, not restricting - the difference (in this context) is that we want to drop active connections too, rather than just change the access allowed for future connections.

So why the difference between the two products?

Well, Exchange Server is using tokens from a central directory, whereas Domino Server creates its access tokens using a local directory. (Yes, you could use a Configuration Only directory in Domino.  But I've never seen one on a live production mail server...)

This is why Exchange Server may preserve access to up to two hours - the security tokens from Active Directory have an expiry date which is designed to make sure that the Active Directory server isn't overwhelmed with requests for new tokens, but at the same time security isn't too lax.

Domino's method of distributing the Directory means that whilst it likely also uses tokens internally, they're easier to update as any query stays on the same machine.  Plus both the Notes client and Domino Server cache such information, which is why you need to drop (destroy) needing to drop the user's connection.

So even if you edit the deny access group on a central hub server rather than their home mail server, you're a replication and a drop user command away from it taking effect within minutes.

It's worth noting that Domino has, for a long time, allowed you to see who has a connected Notes client and drop them - and this is what allows Domino to be faster in removing access.

By contrast, the Exchange Server evidently has a token for access at the Information Store level, which can only be cleared by moving the mailbox to a new information store (database).  That's their closest equivalent of "drop user", which will clear the cached token.

But the advantage of the Exchange "centralise everything" design is that once access to their mailbox is gone, you're done - other services such as webmail, Windows Mobile devices etc should also stop their access because they're effectively just proxies for access to that one store of information.

Whereas Domino's distributed design means that you'll need to make sure that the change occurs where it's needed.  If you need to remove access on a webmail server, then that Deny Access Group change needs to be replicated before it'll happen.  And the same applies to sessions on application servers, and systems like Quickr/SameTime/Domino.Doc.  Users can access many different stores, some of which are just replicas of each other, so stopping all access in a large environment can require a little more work.

(For both Exchange and Domino, third party access products like BlackBerries have their own arrangements to disable accounts and devices, so I'm skipping those.)

To my mind, the advantage to Domino's distributed design is that in this case it's more intuitive. Unless you're thinking about tokens, it's easy to assume that denying access to a mailbox does just that, immediately.  The other advantage is that you have fewer single points of failure, so your systems are more resilient.  If someone accidentally deletes something in the Directory or a database somewhere, then if you act quickly you may find a replica elsewhere you can use rather than have to go back to your backups...

The more I think about this scenario of denying a user access immediately, the more interesting it becomes as it reveals the differences between Domino and Exchange.  But it also makes me wonder about other systems - how many other applications using Active Directory or other centralised LDAP systems are going to behave this way?

How easy is it for someone in a position of power to remove valuable data even after the business believes they have had their access disabled, due to this kind of caching?

How many businesses are aware of these issues, and have the procedures - or staff with the wherewithal - to deal with them?

And when Domino gets LDAP Directory Integration in Release 9 or Release 10, will we still be able to list and drop those users like normal Domino/Notes users?

So many questions...

And you'd have thought removing someone's access should be just a tick in a box, that took immediate effect!

BOOKMARK THIS CONTENT

	Bookmark at:

CREATE A NEW COMMENT

	Name:
	Email:
	Website:
	Content:	HTML is not allowed. Hyperlinks will automatically be converted.