If you do set up servers to use a condensed Directory Catalog, you may also want to set up directory assistance for the individual Domino Directories aggregated into the directory catalog, so that:

• A server can use directory assistance to look up information not aggregated in the condensed Directory Catalog.
• A server can trust a particular aggregated directory, but not all aggregated directories, for client authentication.

Using directory assistance to look up information not aggregated into a condensed Directory Catalog

While you always aggregate fields containing mail addressing information into a condensed Directory Catalog to support the common task of looking up users' mail addresses, typically you would not aggregate fields containing information such as the following, because this would make the directory catalog too large:

• X.509 certificates used for client authentication
• Information LDAP clients only occasionally search for
• IBM® Lotus® Notes® users' public keys used to send encrypted mail

If you set up directory assistance for a Domino Directory but do not aggregate the directory into a condensed Directory Catalog, a server can use directory assistance to search the Domino Directory after searching the directory catalog.

Note If a Domino Directory is aggregated into a condensed Directory Catalog, but particular entry from the directory is not aggregated, for example a selection formula excludes the entry, servers cannot use directory assistance to look up the missing entry directly in the Domino Directory.

Using directory assistance trust for client authentication one or some directories aggregated into a condensed Directory Catalog

To indicate that a server should trust for client authentication all directories aggregated into a condensed Directory Catalog, select the option "Trust the server based condensed directory catalog for authentication with internet protocols" on the Basics tab of the server's Server document in the IBM® Lotus® Domino™ Directory. In this case, directory assistance is not required to indicate trust.

However to tell a server to trust for client authentication only one or some directories aggregated in a condensed Directory Catalog, create a Directory Assistance document in a directory assistance database for each of the aggregated Domino Directories to be trusted. In the Directory Assistance document for each such directory, do the following:

• On the Basics tab, next to "Make this domain available to," select "Notes clients and Internet Authentication/Authorization."
• On the "Naming Contexts (Rules)" tab enable at least one rule that corresponds to the names to be authenticated, and select "Trusted for Credentials" for the rule.
• On the "Replicas" tab include the replica of the Domino Directory that the Dircat task uses to aggregate the directory into the condensed Directory Catalog. Note that you do not include the replica of the directory catalog.

Glossary