HCL Domino does not support using email addresses in groups

While switching the Authentication provider to Microsoft Entra using OIDC. The user identities returned from Entra are in email address format. It seems that email addresses added to group memberships are not being used for authorization to applications. It this is because the view $ServerAccess in the NAB removes any members that contain ‘@’.

Currently, Domino, in its traditional design, does not directly support using email addresses as members of groups for access control purposes. It relies on canonical Domino names (e.g., CN=John Doe/O=Organization) or short names. Domino's group membership and access control mechanisms were designed long before email addresses became the ubiquitous identifier they are today. The internal structures and views like $ServerAccess are optimized for Domino names, which have a hierarchical structure.

The idea is to use the email address format in such purpose.