A Notes ID is the user's digital identity in HCL Notes: a file with certificates and keys used for login, encryption and signing.
A Notes ID is the user's digital identity in HCL Notes. It lives in a file, typically user.id, with certificates and encryption keys. The file is used to log in, to encrypt mail and documents, and to sign code and documents. Servers have a corresponding server.id.
What does a Notes ID contain?
- The user's name in hierarchical form, for example CN=Anna Hansen/O=Company.
- Certificates issued by the organisation's certifier, proving that the user belongs.
- Public and private key for encryption and signing.
- Password, which protects the file. It is not a password for the server, but for the file itself.
Why are ID files awkward?
In old Notes environments the ID file sat on the user's PC. Lose the PC, and you lost your identity and access to encrypted mail. Forget the password, and nobody could help. It is one of the things people remember as awkward about Notes. The solution is called ID Vault: a secure database on the Domino server that stores copies of all ID files. With ID Vault, the administrator can reset passwords, and the user can log in from a new PC without moving files.
Certificates expire
The certificates in a Notes ID typically expire after 10 years. When they do, the user cannot log in. The same applies to the server's ID and the organisation's certifier. Expired certificates are a classic reason a whole Notes environment suddenly stops on a Monday morning. Monitoring of expiry dates is therefore a fixed part of good operations.
Common questions
Can Notes use Active Directory login instead?
For web and Nomad Web you can log in with Entra ID through SAML. The classic client still requires an ID file, but it can be fetched from ID Vault with the AD password.
What happens to ID files in a migration?
Encrypted mail can only be read with the user's ID. Before a migration, encrypted mail must be decrypted, otherwise it becomes unreadable in Microsoft 365.
We do not have ID Vault. Is that bad?
It is a risk. Setting it up takes a day and saves many support cases. We set it up as part of Domino administration.