Automatic Logon

HCL Domino Domino Forum
1

Hi.

I have a unique request to permit logon to a registration page from a website outside of my control. The user wants individuals to click the URL on their site and automatically be launched into my application without being prompted for a username and password. I had found the following that works sometimes:

http://www.mysite.com/names.nsf?login&username=aaa&password=bbbbbb&redirectto=database.nsf/Form111?OpenForm

Do I have any other options on the database or security side to eliminate the username and password in this URL?

Thanks, TH

2

Subject: Automatic Logon

Does the user log in on the “Other” site? If it is in the same internet domain you could use multi server session authentication.

If it’s in the same windows domain you could put IIS in front of your server and use integrated windows authentication (the users will be authenticated by their windows logon).

Ben

3

Subject: RE: Automatic Logon

Hi. The other site is not secure nor under my control. All I want is to enable a link from a button on their site that automatically logs them into the registration form on my database. I have tried the previously mentioned URL route and it is not working.

Any other ideas? Anonymous is something I have heard would work but can an anonymous user have write access?

TH

4

Subject: RE: Automatic Logon

Annoymous is a value you can set on the ACL so yes you can give write access to it. I think you idea of an integrated Userid/Password is better as any net wanderer could then find your database.I have a externaly accesed database that is accessed through an alternate site and the access code runs an agent one of my servers, creating a user in an access group and then uses that to access the database. When the external user logs off the user is deleted from the access group.

Sorry I can’t give you the code as it as produced by an external contract programmer.

HTH

5

Subject: Automatic Logon

Are all these users that click on the url or button login on using the same username and password?

If so

I would work with the other site to develop a scheme for encrypting the query string of the url that are passing. In the encrypted query string I would include

Some Unique Id of the User

Client IP Address

Time Stamp.

Then I would create an agent that allows anonymous access

The agent would decrypt the query string, parse out the elements

-Ensure the client IP in the query string matches the client IP in the agent request

  • Check the time stamp falls within a certain range.

If those are both good, I would then generate an LTPAToken and send it down to the client.

If each user gets a different username and password, I would see if the remote site could handle a webservice that would allow them to pass a username and password, and send back a valid LtpaToken that they could send down to client.