AD, SSO and Ltpa token

HCL Domino Domino Forum
1

My apologies if this has been answered, but I didn’t see a direct answer anywhere. Here’s what I need to do. Someone please tell me if this is possible, if they have done it (preferable over theory), and/or a 3rd party product that could do it:

Our web portal environment (non-Notes/IBM) has built-in Windows Authentication. When you go into our portal, it knows who you are based on your Windows login. I want to integrate some Domino and SameTime functionality, but we do not want to force users to log into that environment. Is there any way to integrate the login process to our multi-server SSO environment (which already exists) such that a user gains the Ltpa token behind the scenes without logging in manually?

Thank you!

2

Subject: AD, SSO and Ltpa token

These instructions have been run in a test environment so they should be accurate.

Please review these steps with your environment.

  1. Convert names from Domino directory to LDAP format

You will need to convert all people and group names from Domino Directory to Domino LDAP DN format and then again from Domino LDAP DN to Active Directory DN format. In my guide below, I will be converting the person “Andy Yiu/Austin/IBM” to “uid=andy_yiu@us.ibm.com,ou=people,dc=austin,dc=IBM,dc=com” and the group “Sametime Support” to “uid=Sametime Group,ou=groups,dc=austin,dc=IBM,dc=com”

  1. Making sure that the Internal ID is set correctly.

  • Launch the Notes Client by going to Start->Program Files->Lotus Applications->Lotus Notes

  • Go to File->Database->Open.

  • Change the server to the Sametime server

  • Under filename, type in “stconfig.nsf” and click open.

  • Open the LDAPServer document

  • Locate the following field "The attribute of the person entry that defines the internal ID of a Sametime user: ". Ensure this field is left as blank. If this field has another value, delete the value, save the document and restart the Domino server.

  1. Conversion from Domino Directory to Domino LDAP DN

  • Create a file on your local workstation or the Sametime server titled ‘DominoToLDAP.csv’.

  • Open the file using a text editor such as notepad

**** The Name Conversion Utility is CASE & SPACE SENSITIVE. Make sure everything is typed out correctly ****

  • On the first line, put type in “LDAP” and save. Make sure this is typed in ALL CAPS. The Name Conversion Utility is case sensitive.

  • Save the file and exit the text editor.

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • Click on the “New” Button

  • In the Description field, fill in “Domino directory to Domino LDAP DN”

  • Under “Where do you want to run the task?” , select your Sametime server, NOT All Servers.

  • Click on browse and select the file “DominoToLDAP.csv”.

  • Click “OK”

  • On the Domino console, type in “tell staddin quit” and hit enter. This will quit the Sametime server.

  • On the Domino console, type in “dbcache flush” and hit enter. This will flush the database cache.

  • Open a Command prompt and switch directories to the Domino program directory (ex. lotus\domino).

  • Type in “stblconversion” and hit enter. This will execute the buddylist conversion process. Wait until the command prompt returns. DO NOT close the command window while the conversion is running.

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • You should now see the “Domino directory to Domino LDAP DN” task marked as finished

  • Launch the Notes Client by going to Start->Program Files->Lotus Applications->Lotus Notes

  • Go to File->Database->Open.

  • Change the server to the Sametime server

  • Under filename, type in “vpuserinfo.nsf” and click open.

  • Click on “storage” and make sure that the names are in the format of CN=Andy Yiu,OU=Austin,O=IBM.

You will need to convert all people and group names from Domino Directory to Domino LDAP DN format and then again from Domino LDAP DN to Active Directory DN format. In my guide below, I will be converting the person “Andy Yiu/Austin/IBM” to “uid=andy_yiu@us.ibm.com,ou=people,dc=austin,dc=IBM,dc=com” and the group “Sametime Support” to “uid=Sametime Group,ou=groups,dc=austin,dc=IBM,dc=com”

  1. Making sure that the Internal ID is set correctly.

  • Launch the Notes Client by going to Start->Program Files->Lotus Applications->Lotus Notes

  • Go to File->Database->Open.

  • Change the server to the Sametime server

  • Under filename, type in “stconfig.nsf” and click open.

  • Open the LDAPServer document

  • Locate the following field "The attribute of the person entry that defines the internal ID of a Sametime user: ". Ensure this field is left as blank. If this field has another value, delete the value, save the document and restart the Domino server.

  1. Conversion from Domino Directory to Domino LDAP DN

  • Create a file on your local workstation or the Sametime server titled ‘DominoToLDAP.csv’.

  • Open the file using a text editor such as notepad

**** The Name Conversion Utility is CASE & SPACE SENSITIVE. Make sure everything is typed out correctly ****

  • On the first line, put type in “LDAP” and save. Make sure this is typed in ALL CAPS. The Name Conversion Utility is case sensitive.

  • Save the file and exit the text editor.

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • Click on the “New” Button

  • In the Description field, fill in “Domino directory to Domino LDAP DN”

  • Under “Where do you want to run the task?” , select your Sametime server, NOT All Servers.

  • Click on browse and select the file “DominoToLDAP.csv”.

  • Click “OK”

  • On the Domino console, type in “tell staddin quit” and hit enter. This will quit the Sametime server.

  • On the Domino console, type in “dbcache flush” and hit enter. This will flush the database cache.

  • Open a Command prompt and switch directories to the Domino program directory (ex. lotus\domino).

  • Type in “stblconversion” and hit enter. This will execute the buddylist conversion process. Wait until the command prompt returns. DO NOT close the command window while the conversion is running.

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • You should now see the “Domino directory to Domino LDAP DN” task marked as finished

  • Launch the Notes Client by going to Start->Program Files->Lotus Applications->Lotus Notes

  • Go to File->Database->Open.

  • Change the server to the Sametime server

  • Under filename, type in “vpuserinfo.nsf” and click open.

  • Click on “storage” and make sure that the names are in the format of CN=Andy Yiu,OU=Austin,O=IBM.

  1. Conversion from Domino LDAP DN to Active Directory DN

  • Create a file on your local workstation or the Sametime server titled ‘ConvertNames.csv’.

  • Open the file using a text editor such as notepad

**** The Name Conversion Utility is CASE & SPACE SENSITIVE. Make sure everything is typed out correctly ****

  • On the first line, put type in “ID”

  • On the next line, start specifying the names which need to be converted. The conversion lines need to be specified in the format of

       Format:

    “[DominoLDAPDN]”,“[ADLDAPDN]”,“[DisplayName]”

    Below are some examples of how the names should be specified for users and groups. Remember these entries are case sensitive and space sensitive

       People:

    “CN=Andy Yiu,OU=Austin,O=IBM","uid=andy_yiu@us.ibm.com,ou=people,dc=austin,dc=IBM,dc=com”,“Andy Yiu”

    “CN=Sametime Admin,OU=Austin,O=IBM","uid=sadmin@srv.austin.ibm.com,ou=people,dc=austin,dc=IBM,dc=com”,“Sametime Admin”

    “CN=tweety bird,OU=Austin,O=IBM","uid=tweety@srv.austin.ibm.com,ou=people, dc=austin,dc=IBM,dc=com”,“Tweety”

       Groups:

    “CN=Sametime Group”,“uid=SGroup,ou=groups, dc=austin,dc=IBM,dc=com”,“Sametime Group”

    “CN=Birds”,“uid=Birds,ou=groups, dc=austin,dc=IBM,dc=com”,“Birds”

  • Save the file and exit the text editor.

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • Click on the “New” Button

  • In the Description field, fill in “Convert Names”

  • Under “Where do you want to run the task?” , select your Sametime server, NOT All Servers.

  • Click on browse and select the file “ConvertNames.csv”.

  • Click “OK”

  • On the Domino console, type in “tell staddin quit” and hit enter. This will quit the Sametime server.

  • On the Domino console, type in “dbcache flush” and hit enter. This will flush the database cache.

  • Open a Command prompt and switch directories to the Domino program directory (ex. lotus\domino).

  • Type in “stblconversion” and hit enter. This will execute the buddylist conversion process. Wait until the command prompt returns. DO NOT close the command window while the conversion is running

  • Open a Web Browser and navigate to stcenter.nsf on the Sametime server ( ex. http://srv.austin.ibm.com/stcenter.nsf)

  • Click on the “Administer the Server” link on the top left.

  • Enter in the Administrator’s credentials and click “Log In”

  • Using the menu on the left side, navigate to LDAP Directory->Name Change Tasks

  • You should now see the “Convert Names” task marked as finished

  • Launch the Notes Client by going to Start->Program Files->Lotus Applications->Lotus Notes

  • Go to File->Database->Open.

  • Change the server to the Sametime server

  • Under filename, type in “vpuserinfo.nsf” and click open.

  • Click on “storage” and make sure that the names are in the format of “uid=andy_yiu@us.ibm.com,ou=people,dc=austin,dc=IBM,dc=com”

This completes the name conversion process. When you log into the Sametime connect client, you should now see your buddylist.

  1. Configure the Sametime Configuration Database

  • Launch the Notes Client

  • Navigate to File->Database->Open.

  • Change the server to the Sametime server

  • Open the Sametime Configuration (stconfig.nsf) database

  • In the stconfig.nsf database, open the LDAPServer document

  • Fill in the Sametime LDAPServer document. Please see Technote 1240710 (http://www.ibm.com/support/docview.wss?rs=899&uid=swg21240710) for guidance in configuring the document.

  • Add the NotesDN field to the “Search filter for resolving person names” and “Search filter to use when resolving a user name to a distinguished name”

  • Note: Make sure that the field “The attribute of the person entry that defines the internal ID of a Sametime user:” is left blank.

  1. Configure the Directory Assistance Database

  • Launch the Notes Client

  • Navigate to File->Database->Open.

  • Change the server to the Sametime server

  • Open the Directory Assistance (da.nsf) database

  • Open the LDAP Directory Assistance document

  • Switch to the Basics tab.

  • Populate the field for “Attribute to be used as name in an SSO token (map to LTPA_UsrNm):” with “$DN”

  • Switch to the LDAP tab

  • Change “Attribute to be used as Notes Distinguished Name” to “NotesDN” or the Notes attribute containing the Notes DN.

  • Change “Type of search filter to use” to Custom.

  • Fill in the field “Authentication filter” with “(&(cn=%)(NotesDN=%))”

  • Save and close the document.

  • Close out of the Directory Assistance database.

  1. Configuration of the Names.nsf

  • Launch the Notes Client

  • Navigate to File->Database->Open.

  • Change the server to the Sametime server

  • Open the Names and Address book (names.nsf) database

  • Navigate to People.

  • Locate the Person document of a test user.

  • Put the document into Edit mode by pressing CTRL-E

  • Switch to the Basics tab.

  • Click on “Enter Password” and then click OK. This will clear the Internet Password.

  • Switch to the Administration tab.

  • Under LTPA user name, type in the user’s LDAP DN. Please note that this is both case and space sensitive!

  • Save and close

  • In the Domino Directory view, navigate to Configuration->Web->Web Configurations

  • Open the Web Configurations->Web SSO Configuration for LTPAToken document

  • Make sure that the DNS domain is set to the DNS domain. For example, if a server has the hostname of server.domain.com, the administrator should fill in .domain.com.

  • Change "Map names in LTPA tokens from “Disabled” to “Enabled”

  • Confirm that both the mail and sametime servers are in the participating servers list.

  • Save and close.

  • Close the Notes client.

  1. Configure the Sametime.ini

  • Open the sametime.ini which is located in the Domino program directory.

  • Add the following to the bottom of the sametime.ini. Make sure there is a blank line at the end of the file.

    [Directory]

    ST_DB_LDAP_ALLOW_SEARCH_ON_DN=1

  • Save and close the sametime.ini

  • Restart the Sametime server.

3

Subject: AD, SSO and Ltpa token

check out www.dotnsf.com - I have not used their products, but have read good things here and on the partner forums about the guys behind it.

4

Subject: RE: AD, SSO and Ltpa token

Maybe I’m being too simplistic, but what if I built a server that used the IIS web server stack instead of the Domino web server…then in the IIS console turned on the option for integrated windows authentication. How would that impact the production of the Ltpa token?