Novell eDirectory

GroupWise is administered through eDirectory, the directory service provided by Novell. All components, such as domains, post offices, libraries, and agents, as well as all users' GroupWise accounts, are configured through objects in eDirectory. You need to make sure that you have eDirectory installed in your environment. eDirectory can be installed on NetWare, Linux, or Windows.

GroupWise supports all versions of NDS and eDirectory; however, Novell eDirectory 8.5 and later provide some very specific LDAP-related capabilities for GroupWise that are not available if you are using earlier versions of eDirectory or NDS:

• Users can authenticate to GroupWise through an LDAP directory that does not have the LDAP mail attribute (e-mail address) filled in.
• When using LDAP authentication, if a user is denied access to GroupWise, a message indicates the nature of the problem: account disabled, grace logins expired, directory services intruder lockout in effect, and so on.
• The GroupWise client can retrieve S/MIME public keys from LDAP directories when users receive encrypted messages.

If you want GroupWise to have these specific LDAP-related capabilities, you must update to eDirectory 8.5 or above.

GroupWise 6.5 for Linux includes the Novell eDirectory CD to assist those who do not already have eDirectory installed and want to install it on Linux. Follow the instructions in the Novell eDirectory Installation Guide to install eDirectory and ConsoleOne before proceeding to install your basic GroupWise system.

ConsoleOne

GroupWise administration is performed through ConsoleOne, version 1.3.4 or later. When you install GroupWise, the GroupWise Administrator snap-in files are copied into an existing ConsoleOne installation. The GroupWise Administrator snap-in files extend the functionality of ConsoleOne to let you administer GroupWise. ConsoleOne considerations differ by platform:

• NetWare and Windows: For a GroupWise system on NetWare or Windows, you need to decide which ConsoleOne location you want use to administer GroupWise. This can be a ConsoleOne location on a network server, or it can be on a local workstation. If you plan to use ConsoleOne on a local workstation, you need to perform the GroupWise installation from that workstation. For your convenience, ConsoleOne, version 1.3.4, is included on the GroupWise 6.5 Administrator CD. The Installation Advisor lets you install ConsoleOne if necessary. You can also use the Installation Advisor at a later time to install ConsoleOne and the GroupWise Administrator snap-in files to additional locations.

  NOTE:  For a GroupWise system on NetWare, you cannot run ConsoleOne to administer GroupWise at the NetWare server console. The GroupWise Administrator snap-ins to ConsoleOne do not run in that environment.

• Linux: For a GroupWise system on Linux, ConsoleOne must already be installed before you set up your GroupWise system. GroupWise 6.5 for Linux includes eDirectory 8.7.3 for Solaris, Linux, and AIX, from which you can install ConsoleOne. ConsoleOne is installed to /usr/ConsoleOne. Make sure that ConsoleOne is installed on the Linux server where you plan to create your basic GroupWise system.

GroupWise Software Distribution Directory

During installation, you are prompted to create a GroupWise software distribution directory on a network server and then copy selected GroupWise software components to the directory.

You should consider the following when deciding where to create the software distribution directory:

• User Access to the Directory
• Disk Space Required for the Software

GroupWise Languages

The GroupWise 6.5 CDs contain multiple languages, so you need to decide which languages you want to install. Your choice affects the following programs:

• GroupWise Administrator snap-ins for ConsoleOne
• GroupWise agents
• GroupWise client (Windows, Cross-Platform, or WebAccess)

For example, if you install English-US and German, you can run GroupWise Administrator and the agents in either language. By default, GroupWise Administrator runs in the language in which you are running ConsoleOne. Your users then have the choice of using either the English-US client or the German client.

For more information, see "Multilingual GroupWise Systems" in the GroupWise 6.5 Administration Guide.

System and Domain Names

The domain requires a unique name. The name is used as the Domain object's name in eDirectory. It is also used for addressing and routing purposes within GroupWise, and can appear in the GroupWise Address Book. The domain name can reflect a location, company name or branch name, or some other element that makes sense for your organization. For example, you might want the domain name to be the location (such as Provo) while the post office name is one of the company's departments (such as Research). Name your domain carefully. After it is created, the name cannot be changed.

You must also provide a name for your GroupWise system. The system name is used when connecting to other GroupWise systems; for this reason, it must be different than any other GroupWise system with which you might want to connect. The system name can be your company name (for example, Novell), GroupWise, or anything else that fits the naming scheme you want to use. The system name is displayed only in ConsoleOne. You cannot change the name after your system is created.

System and domain names can consist of one or more words. Use underscores (_) rather than spaces as separators between words to facilitate addressing across the Internet. Do not use any of the characters listed below in system and domain names:

Domain Directory

The domain requires a directory structure in which to store database files and temporary files that are created during message routing. As you choose a location for the domain directory, consider the following:

• Security: GroupWise users never need access to the domain directory, so you should create it in a location that you can easily secure.

• Server Platform and Version: The domain directory can be located on the following platforms:

  • NetWare 3.12, 4.2, 5.x, or 6.x
  • SUSE^® Standard Server 8 or Enterprise Server 8
  • Red Hat Enterprise Linux 3 ES or AS
  • Windows NT Server or Windows 2000 Server

• MTA Access: The MTA requires access to the domain directory. Therefore, you might want to consider the server type (NetWare, Linux, or Windows) and location of the MTA before deciding on a domain directory. For information about the MTA, see Planning Your GroupWise Agents. For examples of possible domain directory locations and MTA configurations, see Sample GroupWise Configurations.

• Disk Space Requirements: The domain directory requires approximately 10 MB of free disk space. This requirement could increase to around 30 MB as your GroupWise system grows.

• Directory Name: You should specify an empty directory for the domain. If you want, the directory can reflect the domain name you chose. Use the following platform-specific conventions:

  • On NetWare, use a maximum of 8 characters in the directory name.
  • On Linux, use only lowercase characters in the directory name.

Choose the name and path carefully. After the directory is created, it is difficult to rename. If the directory you specify does not exist, it is created during installation.

Domain Context

You can create the Domain object in any context in your eDirectory tree. The only requirement is that it be in the same tree as the other objects associated with the domain (Post Office object, User objects, and so forth).

The following sections provide examples of where you might place your Domain object. Because it is helpful to discuss the Domain object's context in relationship to the Post Office object's context, the examples also include context information for the Post Office object.

• Objects in the Same Container as Users' Organizational Units
• Objects Mirror eDirectory Organization
• Objects Mirror Network Server Organization
• Objects in a Dedicated Container

Objects in the Same Container as Users' Organizational Units

In the following example, the Domain object (Provo) and Post Office object (Research) reside in the same container (Provo) as the organizational units (Accounting, Manufacturing, R&D, and Sales) that contain the users. This allows you to associate the domain with a single organization and associate one post office with all users within the organization.

Objects Mirror eDirectory Organization

The following example is similar to the previous example, except that a separate post office is created for each organizational unit that contains users. The Domain object (Provo) resides in the organization (Provo) and the Post Office objects reside in the same organizational units (Accounting, Manufacturing, R&D, and Sales) as the users.

As in the previous example, this organizational structure allows you to quickly associate users with their post offices. In addition, if you have thousands of users split between the different organizational units, this method allows you to create multiple post offices with a smaller number of users on each post office.

Objects Mirror Network Server Organization

Because the domain and post office have directory structures on network servers, you could also choose to place the Domain and Post Office objects in the same context as the servers where the directories will reside, as shown in the following example.

Objects in a Dedicated Container

If, rather than mirroring your eDirectory or server organization, you would prefer to keep all your GroupWise objects together, you could create a container, such as GroupWise, and place all GroupWise objects in that container, as shown below. Administratively, this type of organizational structure makes it easier to restrict a GroupWise administrator's object and property rights to GroupWise objects only. For information about GroupWise administrator rights, see "GroupWise Administrator Rights" in "Security" in the GroupWise 6.5 Administration Guide.

BASIC GROUPWISE SYSTEM WORKSHEET
Under Item 9: Domain Context, specify the context where you want to create the Domain object. If the context does not already exist in your eDirectory tree, create the context now.

The GroupWise View in ConsoleOne

ConsoleOne includes a GroupWise View, shown below.

The GroupWise View filters out all non-GroupWise objects and shows how GroupWise objects relate to each other. For example, in the left pane, notice the Post Office object (Research) is subordinate to the Domain object (Provo). You can select an object in the left pane and display its associated objects (User, Resource, and so forth) in the right pane.

The GroupWise View is particularly useful if your GroupWise objects are placed in different contexts in the eDirectory tree. Rather than searching for GroupWise objects throughout the tree, you can administer the objects from the GroupWise View.

Some GroupWise administrative functions can only be done while in the GroupWise View. This includes such tasks as defining users from other GroupWise systems so that they appear in your system's Address Book.

Domain Language

The domain language determines how times, dates, and numbers are displayed in the GroupWise clients and affects the sorting order for items in the GroupWise Address Book.

For more information, see "Multilingual GroupWise Systems" in the GroupWise 6.5 Administration Guide.

Domain Time Zone

When a message is sent from a user in one time zone to a user in another time zone, GroupWise adjusts the message's time so that it is correct for the recipient's time zone. For example, if a user in New York (GMT -05:00, Eastern Time) schedules a user in Los Angeles (GMT -08:00, Pacific Time) for a conference call at 4:00 p.m. Eastern Time, the appointment is scheduled in the Los Angeles user's calendar at 1:00 p.m. Pacific Time.

Post Office Name

The post office, like the domain, requires a unique name. The name is used as the Post Office object's name in eDirectory. It is also used for addressing and routing purposes within GroupWise, and can appear in the GroupWise Address Book. The post office name can reflect any element that makes sense for your organization. For example, you might want the domain name to be the location (such as Provo) while the post office name is one of the company's departments (such as Research). Name your post office carefully. After it is created, the name cannot be changed.

Post office names must be one word. The same characters that are invalid in system and domain names are also invalid in post office names (see System and Domain Names).

Post Office Directory

The post office requires a directory structure in which to store database files and temporary files that are created during message routing. As you choose a location for the post office directory, consider the following:

• Security: The GroupWise Windows and Cross-Platform clients access the post office through a client/server (TCP/IP) connection to the GroupWise Post Office Agent (POA). The GroupWise WebAccess client uses an HTTP connection. Therefore, GroupWise users never need access to the post office directory, so you should create the directory in a location that you can easily secure.

• Server Platform and Version: The post office directory can be located on the following platforms:

  • NetWare 3.12, 4.2, 5.x, or 6.x

    However, the GroupWise agents cannot run on NetWare 3.12. They require NetWare 4.2 or higher.

  • SUSE Standard Server 8 or Enterprise Server 8
  • Red Hat Enterprise Linux 3 ES or AS
  • Windows NT Server or Windows 2000 Server

• POA Access: The POA requires access to the post office directory. Therefore, you might want to consider the server type (NetWare, Linux, or Windows) and location of the POA before deciding on a post office directory. For information about the POA, see Planning Your GroupWise Agents. For examples of possible post office directory locations and POA configurations, see Sample GroupWise Configurations.

• Disk Space Requirements: The post office directory holds users' messages and attachments, so you should plan a minimum of 2 MB per user. 10 MB or more per user is recommended. Although actual messages are relatively small, message attachments (documents, spreadsheets, graphic files, and so forth) can greatly increase the amount of disk space used.

  Using ConsoleOne, you can restrict the amount of disk space users are allowed for their mailboxes. When you know the number of users and the amount of disk space allocated to each user, you can more accurately determine the amount of disk space required.

  You can reduce the amount of disk space required for the post office by forcing users to run the GroupWise Windows and Cross-Platform clients in Caching mode rather than Online mode. In Online mode, messages are stored in the post office. In Caching mode, messages are stored on users' local drives.

  In addition to users' messages and attachments, the post office directory also contains a document library. You should take into account the disk space you want to provide for storing documents.

• Directory Names: You should specify an empty directory for the post office. If you want, the directory can reflect the post office name you chose. Use the following platform-specific conventions:

  • On NetWare, use a maximum of 8 characters in the directory name.
  • On Linux, use only lowercase characters in the directory name.

Choose the name and path carefully. After the directory is created, it is difficult to rename. If the directory you specify does not exist, it is created during installation.

Post Office Context

Like the Domain object, you can create the Post Office object in any context in your eDirectory tree. The only requirement is that it be in the same tree as the Domain object and other objects associated with the domain (User objects and so forth). For configuration examples, see Domain Context.

Post Office Language

The post office language determines how times, dates, and numbers are displayed in the GroupWise clients and affects the sorting order for items in the GroupWise Address Book.

The post office assumes the same language as its domain unless you specify otherwise. For example, if you set the domain and post office language to English-US, all time, date, and numbers are formatted according to English-US standards, and the Address Book items are sorted according to English-US sort order rules. This is true even if some users on the post office are running non-English GroupWise clients such as German or Japanese. Their client interface and Help files are in German or Japanese, but the time, date, and number formats and sort order are according to English-US standards.

For more information, see "Multilingual GroupWise Systems" in the GroupWise 6.5 Administration Guide.

Post Office Time Zone

When a message is sent from a user in one time zone to a user in another time zone, GroupWise adjusts the message's time so that it is correct for the recipient's time zone. For example, if a user in New York (GMT -05:00, Eastern Time) schedules a user in Los Angeles (GMT -08:00, Pacific Time) for a conference call at 4:00 p.m. Eastern Time, the appointment is scheduled in the Los Angeles user's calendar at 1:00 p.m. Pacific Time.

The post office assumes the same time zone as its domain unless you specify otherwise.

Post Office Users

You need to assign a GroupWise account to each eDirectory user who should have a mailbox in the post office. You can do this while creating your system, or you can do it afterwards. However, we recommend that you at least add yourself so you can test the system.

If you are adding non-eDirectory users as GroupWise external entities, you must wait to add them to the post office until after you have finished the installation. Instructions for adding GroupWise external entities are provided in Assigning GroupWise Accounts to Users.

Agent Platform

The MTA and POA are available as NetWare NLM^TM programs, Linux executables, and Windows executables.

In general, GroupWise is most efficient if you match the agent platform with the network operating system where the post office and domain are located. For example, if a domain and post office are located on a NetWare server, then you would install the NetWare agents for them. However, this is not required. For configuration examples, see Sample GroupWise Configurations.

Agent Location

The MTA requires direct access to the domain directory. The POA requires direct access to the post office directory.

In general, we recommend that you install an agent on the same server as its directory. For example, you would install the MTA on the same server as the domain directory and the POA on the same server as the post office directory. This ensures that the agent always has access to its directory.

However, if necessary, you can install the agent on a different server from its directory. This requires the agent to have a direct link (mapped drive, UNC path, or file system mount) to its directory in order to function. The following diagram illustrates the direct links:

For the purpose of simplifying the setup of your basic system, you are required to install both the MTA and the POA to the same server. If, at a later time, you decide that you want to run one of the agents on a different server, see Installing GroupWise Agents.

Consider these platform-specific guidelines:

• NetWare: When installing the NetWare agents, we recommend you use the sys:\system directory on the NetWare server. This simplifies the use of startup files and ensures that the agent NLM programs are in the server's search path. If you use a different directory, you must add that directory to the server's search path.

• Linux: The Linux agents are automatically installed to the bin and lib subdirectories under /opt/novell/groupwise/agents. On Linux, do not move the agent software to a different location.

• Windows: The default installation directory is c:\grpwise. However, you can install the agents to any directory you want.

MTA Link to the Post Office

To route user and administration messages to the post office, the MTA requires direct access or a direct link to the post office directory, or a TCP/IP connection with the post office's POA. The following diagram illustrates the alternatives:

In general, we recommend that you use a TCP/IP connection between the MTA and the POA.

Windows Application vs. Windows Service (Windows Agents Only)

You can run the Windows MTA and POA as normal applications or as services. When you run the agents as Windows services, they must run under a specific user account. The user account you use depends on where the domain and post office directories are located:

• When the domain and post office directories are located on the same server where you are installing the agents, the agents can run under the local system account. You can also display the agent console when the agent software, directories, and databases are local.
• When the domain and post office directories are located on a remote server, you must specify a user with rights to access the domain and post office directories. If the agents need to log in to a Windows server, provide a Windows username and password. If the agents need to log in to a NetWare server, provide an existing eDirectory username and password, or create a new account for the agents, as described in Creating a NetWare Account for Agent Access (Optional).

As with all Windows services, you can start the agents manually or have them start automatically each time the Windows server restarts.

Web Console

The MTA and POA provide server consoles to let you monitor and configure the agents while at the agents' servers. On NetWare, the MTA and POA consoles are always displayed. On Linux, they are displayed only if you start the agents with the --show switch on the command line. On Windows, they are displayed if you run the agents as applications but are not displayed if you run the agents as services.

When the MTA and POA consoles are not available, you can monitor and configure the agents through a Web browser. This feature, referred to as the agent Web console, lets you access the agents' statistics and diagnostic information from any location where you are connected to the Internet and have access to a Web browser, either at a workstation or on a wireless device.

By default, the MTA Web console is enabled on port 7180 and the POA Web console is enabled on port 7181. In your browser, you access the agent Web consoles using the following URLs:

http://MTA_network_address:port
http://POA_network_address:port

where MTA_network_address and POA_network_address are the agents' IP addresses or host names and port is the agent's assigned HTTP port number.

Agent Language

If you have users with various language preferences, you can install the GroupWise agents in multiple languages. The language determines the agents' interface language only. It does not affect messages processed by the agents.

By default, the agents start in the language selected for the domain. If that language has not been installed, the agents start in the language used by the operating system. If that language has not been installed, the agents start in English.

For more information, see "Multilingual GroupWise Systems" in the GroupWise 6.5 Administration Guide.

NetWare 6.x Server

The following diagram shows a basic GroupWise system set up on a single NetWare 6.x server.

Linux Server

The following diagram shows all GroupWise components on a Linux server.

Windows 2000 Server

The following diagram shows all GroupWise components on a Windows 2000 server.

NetWare Server and Windows NT Server

The following diagram shows the domain, post office, and software distribution directory on a NetWare 5.1 server. The MTA and POA, located on a Windows NT server, use a UNC path to access the domain directory and post office directory on the NetWare 5.1 server.

The following diagram shows the domain and MTA on a NetWare 6 server. The post office, software distribution directory, and POA are on a Windows NT server. The MTA communicates with the POA through TCP/IP.

NOTE:  The above configuration has the MTA on one server and the POA on another. Because the basic GroupWise system setup requires you to install the MTA and POA on the same server, you would have to do additional setup to create a similar configuration.