I am doing some background research on various different web architectures utilizing Domino. I’ve seen:
firewall → Domino Web Server in DMZ → firewall → Domino Application Server
type configurations before and was wondering if anyone had other examples, perhaps utillizing passthru servers etc. I have read (and am re-reading) Securing an IBM Lotus Domino Web Server from IBM’s site as well as Domno Web Server Authentication Options by Zwolski, but I am looking more for an set of architectural design options.
Subject: Domino Web Architecture - Design Examples
It depends on what youre wanting to use domino for, internet hosted apps, intranet only, or extranet (inside and outside) both accessing the same server and sharing applications…or would you like to be a domino host/ISP for external ?
The security set-ups for these are all VERY different.
What is your end goal, and security access and audiences?
If Intranet only, simple inside the firewall config…
If extranet, put in the DMZ
If Internet hosting - outside the DMZ but also inside the firewall.
Subject: RE: Domino Web Architecture - Design Examples
The goal is to allow external users, no anonymous access, to access an application that resides on an internal server. Essentially this project is based on the web-ifying of an application already in use for our internal customers. There’s more to it than that, but that’s the jist of it. I can build a setup like I previously diagrammed, though it is pretty much stand alone (in a sense). Another way that has been considered involves a Domino web server making calls to a Domino database via a pass thru server (as well as a firewall probably). The idea is the internal stuff needs to be pretty secure. Does that make any sense? It’s been a long day, I’m not sure if it does…
Subject: RE: Domino Web Architecture - Design Examples
Well if you use imail and already have that set up this can be really easy for you…
Make a replica of the one application onto the imail server.
Set the replica to require SSL connection.
default access in ACL - set to no access.
Provide the URL to customers…it will be an https://blah blah.
Simply replicate your internal DB with that one on schedule.
Also remember to authenticate the people coming in from the outside will need to have entries in your address book, usernames, passwords…
If you have imail already set up and working, this is the quickets easiest route to your goal…
I hope that makes sense…Ive been in so many companies who asked the same question, already on imail and they just didnt realize how EASY it was to do this. It is about a 5 minute job if you have imail already.
If you don;t then why not go ahead and implement that while you are at it…and I’d defer you to all the info architecture setups for imail, then. They will be far fro specific than “application” security architectures for Domino.