Authentication Issue

Hi All Have kind of a crazy question and looking for ideas. Doing some work at a school within a university, previously alumni relations had been very decentralized and handled at the school level, in the next couple of months is will become centralized. We have alot of resources on Domino that we hope the alumni will not lose access to but I have yet to figure out a good solution. The central office will have a website and handle username and passwords, they offer federated authentication to the schools if they want to offer additional services. With the federated authentication within a session we can get a hold of the alumni username and alumni number, not passwords. This is no problem within IIS, works great, but it is giving me nightmares thinking about how this is going to work in Notes. So far this is all I can think of

  1. DSAPI - I think this would be the ideal solution for the alumni, but I am not sure it is an option for us considering the time and budget. I would need to find someone to write the filter and while alumni make up over 80% or the total users in the address book they probably only account for 5% of the activity, our admins will definately not be in favor.

  2. Have IIS initiate the session - I was thinking I could keep a database of passwords, usernames, and alumni numbers, get the trusted alumni number from the federated authentication system, have the IIS server log the user in with the credentials from the database, get the LTPAToken, and the set the cookie on the client. Maybe this should be filed under crazy ideas but I am stuck right now.

Thanks

Steve