Reduce Notes User License Cost with iDNA for DLAU

panagenda has recently released iDNA Applications v2.4.0 , which includes the exciting new “User Licensing Optimization Dashboard” feature. It helps our customers to reduce Notes user license cost by providing data about current Notes user activity and the ability to actively manage user authorization.

Managing user licenses is oftentimes a critical part of keeping licensing cost under control. While it sounds straightforward to determine how many users there are and how many licenses you need, it can be tricky, depending on how a vendor counts them.

How license requirements are determined is usually written down in a license agreement. Interpretation of these agreements can, again, be tricky depending on wording and individual circumstances. In 2023 HCL Software has introduced a new chapter in their effort of trying to streamline licensing calculations and make it easier for customers to understand their licensing requirements: the HCL Domino License Analysis Utility (DLAU).

Quoting directly from the DLAU tool’s web page, this new tool is meant to “assist HCL Domino Administrators in doing a health check based on deployment best practices and determining the Authorized User Count within an HCL Domino environment according to the CCB & CCX license model” and “to provide fast and accurate Authorized User counts for HCL Domino environments by aggregating information that a Domino Administrator would otherwise have to collect manually”.

Reception to the tool’s results were mixed. Many customers reported that DLAU recorded surprisingly high user numbers that they would have to pay licenses for. In fact, even inside panagenda’s internal environment, DLAU recorded numbers nearly four times the count of actual employees. While the incrementally higher number can result in “sticker shock”, it did not come as a complete surprise.

Like many organizations, panagenda has a lot of special IDs for administrative access, functional users and test users. From our customers we even hear of scenarios where person documents are used instead of mail-in documents for their own technical or historically significant reasons. Either way it leads to inflated user numbers that are now put squarely into the spotlight by DLAU.

What was surprising in our case though, was that DLAU also counted users that had left the company and were locked out of the system in multiple ways. That is where our investigation started. It became the foundation of the new “User Licensing Optimization” dashboard in iDNA Applications.

We cannot delve into all the details of what is being analyzed, evaluated, and calculated by DLAU’s engine. Very complex and interconnected concepts such as database access, directory membership, group structure, Deny Access group configuration (to name a few) each play a role here. HCL’s DLAU’s web page provides a wealth of detail on how each of these concepts can affect user counts and we encourage you to read up on the topic.

However, there is one factor that can be explained relatively easy and influenced to great effect: Authorized Users. According to the DLAU website, these are “… users who are authorized, or have the ability, to access your HCL Domino servers.”.

Again, several factors play into this categorization, but the ability to authenticate is at the core of an Authorized User. They either need a valid Notes certificate or their HTTP password set in their person document.

It turns out that this was the exact problem we had in our own environment at panagenda. The person documents of some former employees still had either valid certificates or HTTP passwords set. Now you can argue that DLAU should have not counted these users because their IDs were locked out. Either via the person document or Deny Access groups. Some weren’t even active for more than six months.

However, that point is moot as we aren’t able to change how DLAU calculates their numbers. If users were counted due to a bug (e.g. not being able to resolve recursive Deny Access groups), that will ultimately be fixed by HCL. Perhaps our Notes and Domino configurations are not in line with what HCL expects. Perhaps it’s even errors in our environments which result in higher user counts. Either way, there is something we can change, and iDNA Applications highlights where those changes can be made.

In the end it boils down to the simple act of removing a user’s basic ability to authenticate. You can achieve this by making sure there is no valid Notes certificate present, and no HTTP password is set. Both are contained in and controlled via fields in the person document. These fields can easily be edited or removed with various tools. Among them panagenda’s own Document Properties plugin.

By doing so, a customer can effectively control which users do not require an individual identity and the ability to authenticate. This, in turn, results in them not being counted by DLAU as users to that require a license and helps to reduce Notes user license cost.

This all sounds easy, but it’s very important to take great care when performing actions on users! This is where iDNA Applications can help. It not only tells you which actions to perform for which users to strip their Authorization, but it also gives you all the information about these users so that you can make an informed decision as whether or not their authorization should even be removed.

iDNA combines data collected and calculated by DLAU with iDNA’s own data warehouse:

iDNA Applications ability to combine the results from the HCL Domino License Analysis Utility with the wealth of data collected in the iDNA Applications data warehouse in the new User Licensing Optimization Dashboard gives customers the “one-two punch” capabilities to actively reduce Notes user license cost.