Our “new” company wide requirements is that all applications/systems needs to be SSO regardless if those are web (Domino and/or IIS) or windows base…. so based on research which is best way to go here is simple plan:1. Central point of authentication will be Active Directory
-
We are re-writing and changing security model of web base (IIS) application from MSSQL to AD Integrated model, Domino web apps will use SSO
-
Our firewall/vpn solution is already using LDAP auth. Connecting to AD – so not an issue here
-
On Domino site we use SSO on workstations and internet synch policy to change domino internet password when Notes ID password is changed. Users are required to change their AD password every 60 days, changing AD password when logging to domain will changed Notes ID and because Internet password synch policy on Notes side will also changed DWA password
Couple of issues I’m struggling with:
a) There is possibility that A user can changed DWA password over http and then all is out of synch, Question: can you force ID password changed when DWA password changes? I doubt but won’t hurt to ask
I could disable ability to changed DWA password via http but as far as I know it’s server wide config which mean all or nothing – won’t work in our case since we have some users that use DWA only (no notes client)
b) Above leads to another issue if A user does not use notes client he/she will never changed her ID password and because of that policy synching ID password with DWA password will not work, process is broken. Question: can you synch in any way DWA password with AD? If so will this work one or two ways?
We are considering using Tivoli Directory Integrator, will this help? Perhaps Tivoli Directory Server is the solution for us?
Tim