Directory Assistance - User with same password in AD LDAP and Domino Directory doesn't works

HCL Domino Domino Forum
1

Scenario

  • External LDAP (Active Directory)
  • Domino Directory (names.nsf)
  • User with the same password into external LDAP and HTTPPassword into the names.nsf
  • Directory Assistance Database configurated to validate user via LDAP

Problem

I try to validate a user who has the same password in LDAP and Domino Directory.
The search find the LDAP user with a password but also find this user in Domino DIrectory with the same password and it returns “Unambiguous name” and it fails.
If I change the password in domino directory and I try to validate with LDAP password it works

Any idea will be highly appreciated.

2

Subject: working as designed

It is by design that Domino works this way. If Domino is confused about which distinguished name belongs to the user, Domino cannot login the user. Therefore if there are multiple matches where the password can be validated, and if it is the case that these matches have different distinguished names, then Domino provides an error that the names are ambiguous.

Usually the best approach is to blank out the Domino Internet password, and only use the Active Directory record. See this wiki article for more information on the setup:
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Streamlining_passwords_and_achieving_SSO_for_users_on_Windows_platforms http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Streamlining_passwords_and_achieving_SSO_for_users_on_Windows_platforms

Jane Marcus

3

Subject: same problem, found two workarounds

Hi,

I’m facing the same problem, and I found two ways to solve it.

  1. Populate a field in your Active Directory person documents with the Notes Distinguished name of your people, and configure your LDAP document in Directory Assistance to get this field by enabling name mapping.

  2. You must install your Traveler server in a domain different from that where your users are registered. In this way you can configure an LDAP document in your Directory Assistance for your Active Directory and set “Yes” to “Trusted for Credentials” parameters, and create another document in your directory assistance for lotus notes lookup on the domain where your users are registered and set to “No” the “Trusted for Credentials” parameter.

Best Regards

Matteo