In order to ensure correct routing between multiple connectors, you must define groups and configure the connectors to service specific groups. This requires that the user/group membership information is known in order for DME to correctly send the request to the appropriate connector.
The following is an example of a mixed configuration:
In this example, the Linux AD Connector is doing group graph and Authentication only. Specific users are routed to the Notes Session 32bit connector, and a specific group is routed to the Linux Exchange 2007 connector.
Since there is only one group graph LDAP, the groups that are relevant for Domino users would need to be created in the Active Directory as well.
As an example of configuring connectors for specific groups, consider an example where you need to support both Exchange and Domino users. You want to configure DME in such a way that members of the DME_Exchange group are served by the connector named DME Exchange, and members of the DME_Domino group are served by the connector named DME Domino.
In this scenario, you would have two directory servers: Active Directory and Domino Directory.
As explained in the section about the group graph (see The group graph), you need to build a group graph "tree" in which DME_Exchange and DME_Domino are members of the same company, so that users of both groups can synchronize with DME.
In this example, we furthermore want to force a specific connector to service only members of a specific group.
You can configure each connector to be responsible for one or the other group only. However, if you do this, you must understand the following:
DME caches the user/group relationship in order to send the request to the correct connector. In the above example, when an unknown user tries to connect to DME, the DME server is not able to verify if the user is member or DME_Exchange or DME_Domino, because the user has not yet been cached. Therefore you will get an error in the log, saying that "No route for user is available".
The DME server will then ask all connectors that are set to Automatic (broadcasting) to check which groups this user is member of.
As only one connector is set to broadcasting, this connector will be responsible to get the information that this user is member of either DME_Exchange or DME_Domino. Once the group membership has been established, DME will be able to route to the appropriate connector.
Therefore the recommendation is to use Broadcasting, and to add DME_Exchange and DME_Domino, respectively, as the LDAP group in which the connector should look for user information. This is done in the field Additional DME_User group in the connector setup panel Domain (see Domain). This way, the members of DME_Exchange would only be served by the connector where DME_Exchange is specified as additional DME_User group.
When you configure a connector to route to a specific list of users, you are not limited by the above mentioned LDAP issues. DME is using the information provided by the DME client, that is the user name, and can match that against the LDAP server defined for the connector.
This way, the DME Server knows that all requests for this user have to be passed to the specific connector. You still need a LDAP server to gather information such as the full user name and e-mail address for the user, as well as group membership to check if the user is member of DME_User and thus able to synchronize.