Domino question

HCL Domino Domino Forum
, , ,
1

Domino 14.x
with multi forest AD.

Need passwrod less notes cleint.

do I

notes password and http password should be AD password. ( only slected users) - others domino (id and http passwords only)

whcih is better in my case password sync, or SAML or SPENGO.

1) Password less notes client (eliminate Notes client password prompts).

2) Standardized authentication with AD.

3) Implement SSO for iNotes/Verse .

4) Enable MF A or traveler and verse.

2

Hi Raj-Sri,

Thank you for posting your question in the forum.

Out of the options you are considering—Password Sync, SAML, or SPNEGO—I strongly recommend going with SAML. If your goal is a passwordless experience in the Notes Client, SAML is the only architecture that satisfies every requirement of your multi-forest AD setup on Domino 14.x.

Here is how SAML addresses each of your requirements:

  1. Passwordless Notes Client: SAML enables Notes Federated Login (NFL). When a user launches Notes, Domino authenticates with your Identity Provider (e.g., Entra ID or ADFS). If the user is already logged into Windows, their kerberos/NTLM token is passed automatically, SAML approves it, and the Domino ID Vault unlocks the Notes ID file in memory without prompting the user for a password.

  2. Standardized Authentication with AD: SAML decouples Domino from Active Directory structure. Domino doesn’t need to know how many forests you have or where users sit—it simply trusts the SAML assertion payload from your central Identity Provider (IdP), which handles the multi-forest complexity.

  3. Targeted SSO for iNotes/Verse: In Domino 14.x, SAML behavior for Notes and Verse is controlled via Domino Security Policies. You can set Enable Notes Federated Login = Yes and apply that policy only to your target AD group. Everyone else will safely continue using standard Notes ID and HTTP passwords.

  4. MFA for Traveler and Verse: Because authentication is outsourced to your IdP, you can leverage your existing MFA, Conditional Access, and Passwordless tools (such as FIDO2 keys, Microsoft Authenticator, or Windows Hello). You get full MFA protection for Verse, iNotes, and Traveler without managing TOTP keys inside Domino.

For more information, you may check below link:

Enabling SAML authentication in Domino

Regards,

Sean