3.1 Planning a Mobility System

LDAP Server Network Information

In order to communicate with your LDAP directory, the Mobility Service Installation program needs the IP address or DNS hostname of your LDAP server. It also needs the port number that the LDAP server listens on. The LDAP port number depends on whether the LDAP server requires a secure SSL connection. The default secure port number is 636. The default non-secure LDAP port number is 389.

If the LDAP server requires a secure connection, additional setup might be required. See Securing Communication with the LDAP Server in the GroupWise Mobility Service 2.1 Administration Guide.

LDAP Directory Credentials

In order to access the LDAP directory, the Mobility Service Installation program needs the user name and password of an administrator user in the LDAP directory who has sufficient rights to access the user and group information stored there. At least Read rights are required. You can use the admin LDAP user or an admin-equivalent user. For more information about the required rights for the user you choose, see TID 7006841, Rights Needed by the LDAP Administrator for the GroupWise Mobility Service in the Novell Support Knowledgebase.

Provide the user name, along with its context in your LDAP directory tree, in the following format:

cn=user_name,ou=organizational_unit,o=organization

LDAP User and Group Containers

During installation, the Mobility Service Installation program configures the Mobility Admin console to search for users and groups in specified containers where you, as the LDAP administrator user, have rights to read the user and group information. The Installation program lets you browse for the user and group containers. It then displays the containers in the following LDAP format:

ou=container_name,ou=organizational_unit,o=organization

Initially, you can add users and groups to your Mobility system from those containers.

After installation, when the Mobility Admin console generates lists of users and groups, it searches the containers you specify, as well as subcontainers. If you want the Mobility Admin console to be able to search multiple and organizationally separate containers for users and groups, you can configure this functionality in the Mobility Admin console. For setup information, see Searching Multiple LDAP Contexts for Users and Groups in the GroupWise Mobility Service 2.1 Administration Guide.

GroupWise Trusted Application

A GroupWise trusted application can log in to a GroupWise Post Office Agent (POA) in order to access GroupWise mailboxes without needing personal user passwords. The GroupWise Sync Agent requires such mailbox access in order to synchronize GroupWise data with mobile devices. In addition, the Device Sync Agent uses trusted application authentication through the GroupWise Sync Agent in order to access the GroupWise Address Book. This provides contact lookup beyond the contacts that are downloaded to users’ devices from personal address books.

Before you install the Mobility Service, you must set up the GroupWise Sync Agent as a GroupWise trusted application. You might name the trusted application MobilityService or GroupWiseSyncAgent.

A trusted application uses a key that consists of a long string of letters and numbers to provide authentication for the GroupWise POA. The key file is initially created in a location that is accessible to GroupWise. You must transfer the key file to a location that is accessible to the Mobility Service Installation program.

When you set up the GroupWise Sync Agent as a trusted application, you must fill in only these three fields in the New Trusted App Key dialog box in the GroupWise Admin console (or in the Create Trusted Application dialog box in ConsoleOne in older GroupWise systems):

For more information, see the documentation for your version of GroupWise:

Copy the key file to a convenient location on the Mobility server. The Installation program automatically transfers the trusted application key from the key file into the configuration of the GroupWise Sync Agent.

You need to create only one trusted application key for the GroupWise Sync Agent, regardless of the number of servers where you install the Mobility Service, and regardless of the number of domains and post offices in your GroupWise system.

GroupWise Post Office Agent SOAP URL

The GroupWise Sync Agent accesses your GroupWise system by communicating with a Post Office Agent (POA). The selected POA must be configured for SOAP. For more information, see the documentation for your version of GroupWise:

The Mobility Service Installation program and the GroupWise Sync Agent need the IP address or DNS hostname of the server where the POA is running. In addition, they need the POA SOAP port. The default POA SOAP port is 7191.

Typically, the same port number is used regardless of whether the POA is configured for a secure SSL SOAP connection. The Mobility Service Installation program and the GroupWise Sync Agent need to know whether the connection is secure because they use one of the following URLs to communicate with the POA:

GroupWise Address Book User

The Device Sync Agent needs to be able to access the GroupWise Address Book to obtain user information. The Device Sync Agent establishes this access through the GroupWise Sync Agent.

The Device Sync Agent needs Address Book access that is equivalent to a typical user. You control what users see in the GroupWise Address Book by controlling object visibility. You want the Device Sync Agent to access the GroupWise Address Book with the same visibility that a typical GroupWise user has when viewing the GroupWise Address Book. For more information, see the documentation for your version of GroupWise:

You need to select a user whose view of the GroupWise Address Book matches what you want the Device Sync Agent to be able to access. You do not need to provide the password for the GroupWise user because the Device Sync Agent accesses the GroupWise Address Book through the GroupWise Sync Agent, which has trusted application status.

As an example, you might have a group of mobile device users who need access to Address Book information about upper-level management in your company and another group of mobile device users who should not have this Address Book information. To meet such needs, you would set up two Mobility servers, one with Address Book visibility that includes upper-level management, and a second one where such Address Book visibility is not provided. You would achieve this by setting up each Mobility server with an Address Book user whose Address Book visibility provides the visibility appropriate for all users on that Mobility server.

Mobile Device Port

By default, the Device Sync Agent uses all available IP addresses on the Mobility server. You can bind the Device Sync Agent to a specific IP address after installation. For setup information, see Binding to a Specific IP Address in the GroupWise Mobility Service 2.1 Administration Guide.

Typically, the Device Sync Agent uses port 443 for secure SSL HTTP connections with mobile devices and port 80 for non-secure HTTP connections. If mobile devices connect directly to the Device Sync Agent, a secure HTTP connection is strongly recommended. If mobile devices connect to the Device Sync Agent through a security application such as NetIQ Access Manager or Novell ZENworks Mobile Management, the Device Sync Agent can appropriately be configured with a non-secure HTTP connection. For more information, see Section 3.6, Integrating with Mobile Device Management Applications.

Server Certificate

In order to use a secure SSL HTTP connection between the Device Sync Agent and mobile devices, a server certificate is required. If you do not already have a certificate signed by a certificate authority (CA) for the Mobility server, the Mobility Service Installation program can generate a self-signed certificate for you. However, you should obtain a commercially signed certificate as soon after installation as possible.

For more information about certificates, see Securing Communication between the Device Sync Agent and Mobile Devices in the GroupWise Mobility Service 2.1 Administration Guide.