• The certificate for the hosted organization is created. If a modification to the certificate is ever required, you can locate the certificate as follows: From the IBM® Lotus® Domino™ Administrator, click the People & Groups tab. Click Certificates.
• The hosted organization certificate is cross-certified with the service provider's certificate. A Cross Certification document is created. To verify that cross certificates were created, from the Domino Administrator, click the Configuration tab. Click Server - Miscellaneous - Certificates. Click Notes Cross Certificates.
• The service provider's certificate is cross-certified with the hosted organization certificate. A Cross Certification document is created.
• A Global Domain document is created. The Global Domain document stores the primary Internet domain name by which the hosted organization is known and stores secondary Internet domain names by which the hosted organization can receive Internet mail.
• A data directory is created for the hosted organization. This directory is assigned the name that is specified in the Directory field on the Storage panel of the Register Hosted Organization interface. By default, for Win32 systems, the hosted organization's data directory is placed directly beneath Domino/data. On UNIX systems, the default is /local/notesdata. You can specify another location in the Physical Storage Location field on the Storage panel of the Register Hosted Organization interface.
• A mail subdirectory for the hosted organization is created beneath the hosted organization's data directory.
• A mail file is created for the hosted organization's administrator. This is an NSF and resides in the mail subdirectory for the hosted organization.
• An ACL file is created for each hosted organization to provide security for the hosted organization's directory. The ACL file prevents users in one hosted organization from traversing a directory that belongs to another hosted organization. If a hosted organization's ACL file is deleted, users in other hosted organizations may be able to review the content of the directories belonging to the hosted organization that is no longer protected by an ACL file. Do not confuse hosted organization ACL files with database ACLs, which control server, user, and group access to databases that reside on a Domino server. The actual databases may or may not be protected according to how individual database ACLs are set.
  
  The ACL file resides in the Domino data directory and is named hosted organization name.ACL.
• An extended ACL is applied to the Administration Requests database (ADMIN4.NSF) and the Domino Directory (NAMES.NSF) to restrict access to the data in those databases. The extended ACL is enabled on the Domino Directory when the first hosted organization is registered.
• The database ACL entry for "Anonymous" is changed from NoAccess to Reader access in NAMES.NSF when the first hosted organization is registered.
• Entries are made for the hosted organization administrator in the database ACLs and the extended ACLs to allow the hosted organization administrators to Browse, Read, Create, Delete, and Write documents for their hosted organization.
• Extended ACL entries are created for all users and groups in a hosted organization (*/HostedOrganizationName) providing Browse and Read access to that hosted organization only.
• An extended ACL entry is created for "Anonymous" for each hosted organization with all access disabled. Entries are also made in the Form and Field Access in extended ACLs with Read Deny checked for the following fields:

Schema: Domino, Form: Group, Attributes: InternetAddress, MailDomain, Members, and Type. Form:Person, Attributes: AltFullName, Certificate, FirstName, InternetAddress, LastName, Location, MailAddress, MailDomain, o, OfficeCity, OfficeCountry, OfficeState, OfficeStreetAddress, OU, ShortName, UserCertificate, PublicKey, and Type. Schema: LDAP, Form:DominoPerson, Attribute: cn.

If LDAP Anonymous access is allowed to a hosted organization, the above fields match the "default" ACL for LDAP set in the Domain Configuration document. This list can be modified. Plan and test carefully before you modify ACLs and extended ACLs in an xSP environment -- security is extremely important.

• An Internet Site document is created for each Internet service for which you provide an IP address or host name on the Internet panel of the Register Hosted Organization interface. The documents that are created contain default information for the protocol. You provide additional, detailed information for these documents during hosted organization registration. If you provide an address or host name for multiple protocols, you are prompted to create the Internet Site document for each Internet protocol. You must create the Internet Site document in order to use the corresponding Internet protocol. You are also prompted to create one Web Site document for each hosted organization. The Web Site document is the Internet Site document for the HTTP protocol. If a hosted organization has multiple Web sites, create one additional Web Site document for each additional Web site.
Note The Basics tab on the Server document contains the field "Loads Internet configurations from Server/Internet Sites documents," which is enabled by default and cannot be changed in a hosted environment. When this field is enabled, settings on the Internet Site document take precedence over settings on the Server document. This field is set when the servers are installed.

• If you are using clustered servers, you can use the Storage panel on the Register Hosted Organization interface to create additional storage for the hosted organization on one or more servers in the cluster.
Note The HostedOrganizationAdmin group is created by default (when you set up the hosted environment) and administrators are automatically added to that group. Administrator groups enable you to administer groups of people with administrator rights at one time instead of individually establishing rights and settings for each hosted organization administrator.

To decide where to store a hosted organization's data, evaluate whether you are saving private data or shared data. Store a hosted organization's private data in a directory belonging to the hosted organization. Store shared data in a common data directory accessible to all.

Registering hosted organizations with names requiring a server in UTF-8 locale

If you will be registering hosted organizations that have names containing characters from more than one character set, the registration server must be run in a UTF-8 locale. For example, if both Korean and Japanese hosted organization names must be supported, the server must be in a UTF-8 locale. If only the Japanese hosted organization names are supported, the server can be run in Japanese locale.

Opening databases on an xSP server

When the service provider administrator uses the File - Application - Open menu commands to open a database, the Open Application dialog box does not list all of the databases on the server, but all of the databases are available by typing the database name in the Filename field, and then clicking Open. For convenience, create bookmarks for the most frequently opened databases.

Directory assistance is not supported in a hosted environment

Directory assistance is not supported in a hosted environment. You cannot use Domino's directory assistance feature with Domino's xSP configuration. The Directory assistance database name field on the xSP Server document should be blank.

See also

The database access control list
Configuring a database ACL
Extended ACL
Creating a Global Web Settings document
Web Site rules and global Web settings
Using Internet and Web Site documents in a hosted environment

Glossary