We are rolling out a new Domino web application which will be accessed by roughly 1500 users, each with their own login details. These users already exist within Active Directory. The login and password used to access the Domino web application should synchronise with the users network login and password as set in Active Directory. The users do not have IDs in Domino, merely entries in the Domino Directory, which are then put into groups which are then used in the NSF ACLs. None of the users have Notes clients - they are all accessing from IExplorer.
We have used ADSync to connect the Active Directory (AD) and Domino Directory. We are using the DisplayName AD attribute mapping to the ShortName field in the Domino Directory as this is in the format “Firstname Surname” which is what we want.
We were able to register an existing AD user in Domino using ADSync. However even though this user had access to the web application, login indicated she had an invalid username or password (I tried all possible to no avail).
I need to know how the user needs to login (do they have to use their full distinguished name or can we shorten it?) and also how the passwords synchronise. I’ve read from some threads that another tool may be neccessary to enable this!
Any help you can provide with regard to these problems would be greatly appreciated.
Many thanks
Ross Elliott
Subject: Active Directory & Domino Passwords (web)
In this particular situation, I would not bother with ADSync for users - it’s just an extra layer that you don’t need. It’s really a tool for synching the directories assuming you have Notes users with Notes ID’s and Notes passwords who are also in an Active Directory.
Your environment sounds like mine, only you are rolling it out now within an exisiting AD environment. I’m in the process of converting.
I would set up the applications, security, etc., assuming that you are just going to authenticate to Active Directory and bring that person’s name and authentication back to Domino. At that point Domino will look for their name in the Domino groups in its directory (not AD’s), so ADSync may be helpful in synchronizing the groups between the systems, but not the users.
Subject: RE: Active Directory & Domino Passwords (web)
Thanks for your help. However, how do we bring the person’s name and authentication to Domino from AD. This is the core problem as I see it. Users are changing their passwords every 3 months but this is obviously staggered so there are changes every day. It is therefore crucial that the correct passwords are brought across from AD to Domino.
We had a look at Directory Assistance but couldn’t get this to work.
Thanks again for any help.
Ross
Subject: Active Directory & Domino Passwords (web)
The issue is following and I don’t have an answer for you.
The ADsync tool doesn’t do a good job at synching passwords. The issue is really the password field being filled out correctly.
The full name field or short name field can be used - but that is dependent upon a setting in the server document of the domino server - under the security tab.