I am in the process of setting up an environment with Domino and Active Directory (Domino 6.5.4 on Windows 2003 server). I have enabled single sign-on by configuring IIS in front of Domino using the Websphere IIS plug-in. This works great. But I would now like to use Active Directory groups (in addition to Notes groups) in database ACL’s, and have configured a Directory Assistance database pointing to my AD/LDAP server. But this is not working.
I enabled verbose logging of LDAP calls in Domino (with WebAuth_Verbose_Trace in the notes.ini), and I can see that Domino makes an LDAP query to find groups with a member list which includes the current ID - but the ID used in the query is the Notes canonical name. Since our AD only stores the AD DN name in the group members list (which is not the same as our Notes names), this query always fails. The actual query built by Domino is something like this:
(&(objectclass=group)(member=John Smith/Accounting/Acme/US))
I am currently using the “Active Directory” search filter (on last tab of Directory Assistance config document). I could use a custom filter, but I don’t think that would help since the
“%*” placeholder will always be replaced by the Notes name, and not the AD name.
Has anyone successfully configured SSO on a windows server using IIS and Active Directory, and also successfully enabled Directory Assistance so that Domino ACL’s can utilize AD group names? Can you share your configuration details?
Subject: Directory Assistance and Active Directory groups
What naming convention is listing in the Notes db ACL? If the query is working but the naming convention does not match what is in the notes db ACL then you could probably just list the name that is being recognized in AD (dn or whatever) within the notes db ACL… try that…
Subject: Directory Assistance and Active Directory groups
I enabled verbose logging of LDAP calls in Domino (with WebAuth_Verbose_Trace in the notes.ini), and I can see that Domino makes an LDAP query to find groups with a member list which includes the current ID - but the ID used in the query is the Notes canonical name. Since our AD only stores the AD DN name in the group members list (which is not the same as our Notes names), this query always fails. The actual query built by Domino is something like this:(&(objectclass=group)(member=John Smith/Accounting/Acme/US))
I’m not an SSO expert, but there may be some information in the “Domino Directory FAQ” (google it) that is useful …
Slides 30-32 of ID107: Getting Started With Active Directory Integration, diagram out the corresponding non-SSO scenario. But as you point out, you have the Notes canonical name instead of the LDAP DN. Note that slide 33 points out a performance improvement if you move to 6.5.5 or higher.
The Single Sign On article IBM - United States deals with name mapping. Sounds like this will be helpful.
Additionally, “Integrating IBM Lotus Workplace and Lotus Domino” IBM - United States shows you how to automate the setup for scenario 1 described in the Single Sign On article. The Notes/Domino 8 users are entitled to the TDI tool mentioned.
Let us know your what other details you find.