Subject: Domino 7, IIS web stack, SSO
I’ve just been testing this for a project recently. A couple things I have discovered:
Domino relies on the Logon_User http header to be passed from IIS to the WAS plugin and then on to Domino. That is done if the user is authenticated via NTAuth. NTAuth ONLY works if the page/folder/site site does not allow anonymous authentication. If that suits your needs (typical of an intranet), then session or SSO authentication works just fine since the Domino session cookie does get passed back to the browser in this case.
If you are going to use .NET forms based authentication, the logon form itself has to be made anonymous and therefore Logon_User is not passed in the HTTP header and Domino does not see a user as being logged in. It’s a real catch 22.
IIS7, which I believe is included with Vista, uses a new security model (something about pipelining) which allows access to be handled uniformly whether it is a .NET resource (.aspx) or non .net resource (ie. jpg/gif, .js file, etc.). One of the specific changes they’ve made is that the Logon_User http header is set when the user is authenticated regardless of the authentication mechanism. So theoretically, everything should work much better under IIS7. You can search on IIS7 and Logon_User at the microsoft site to find out more information on this.
However… I was unable to get Domino 7.02 to load on the production version of Vista. 
The WAS plugin does allow you to put Domino on a separate machine from the IIS machine (The WAS plugin doesn’t seem to act too much differently than a reverse proxy.) So you might be able to have IIS7 on one machine and Domino on another machine. There could still be unknown compatibility issues with the WAS plugin and IIS7. I have not attempted this yet because two machines are beyond my site requirements and we’re not ready to support Vista yet.
There will be some performance penalty with the plugin talking to Domino over the network, but for many companies, the internet bandwidth and bandwidth demand far do not exceed LAN bandwidth. The nice thing about them being on separate machines is you can do some packet monitoring with something like wireshark to see what’s being passed back and forth.
Finally, I have had difficulty getting restricted Domino WebServices to function in session/sso mode. Seems authentication only works in Basic/Digest mode. I could be wrong but I have not seen anything documented that has allowed me to get them to function in session mode.
Overall, I have used this dual configuration in the past and find the combination very flexible. We are currently attempting to integrate Ektron CMS with existing Domino databases to give us a multi-lingual content management system along with specific database driven content. CMS’s get hairly when you try to implement mixed content that is both structured and unstructured yet Domino excels at this. Most likely we are going to resort to using a server side (runat=“server”) iFrame whose source is set and made visible via ASPX code when a menu item related to Domino content is selected. This will allows us to design the site templates in ASPX and serve up Domino content in the iFrame so that the look and feel of the site does not have to be synchronized across the multiple Domino databases.
Ideally, it would be great if there was an API/WebService/URL to get Domino generated XHTML. The XHTML could then be parsed, extracting out the HTML tags and merging the Domino HEAD content with the HEAD content of the “combined” page where the Domino content is going to be inserted and the body content placed into an appropriate spot on the “combined” page. It would make implementing Ajax type applications easier as well. Alas, we do not have true XHTML coming from Domino. Yes, yes I know I can generate the HTML specifically but that doesn’t help me with all the richtext.
Sorry for rambling… but I thought as long as I was on the topic, I’d get it all out.
