HCL Verse Mobile and TOTP/2FA with Active Directory

HCL Domino Domino Forum
, , ,
1

I have Domino server 12.0.2FP3 under Linux dedicated only to access Mobile with HCL Traveler.
The TCP 443/80 is behid reverse proxy Citrix NetScaler.
All work very well with Domino NAB.
TOTP feature is not activated now.

For security and internal reason of this company this is the request:

  1. Trust login with Active Directory 2016 (so we can use email and password of AD for login)
  2. 2FA / TOTP Enabled

Is possibile to do with Directory Assistance (but I think that this should be work only for login, and not for TOTP), or the only way is setup Domino DirSync + password sync ?

2

Hi Daniele,

MFA/TOTP unfortunately does not work when authentication is through AD: it works only with Domino authentication. I opened a case some time ago and HCL told me this.

3

I mean AD through Directory Assistance.

4

Found this Enhancement Request. Might want to vote and comment on it.

Support TOTP for AD as LDAP
https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-2272

5

Hello Daniele,

I wanted to bring to your attention the option of implementing SAML Authentication for Traveler devices. In this approach, the authentication process is handled by the Identity Provider (IdP), such as ADFS, Keycloak, or a similar service.
This allows for flexibility in configuring what users need to enter for login (e.g., username/password, second factor, etc.).

For more details, please refer to the documentation here:
(https://help.hcltechsw.com/traveler/12.0.2/saml_verse_overview.html).

Feel free to explore this and check if it aligns with your requirements.

Best regards,

Milan

P.S. If you have any questions or need further assistance, don't hesitate to reach out.

6

Thank you guys!

@Milan Matejic I had not considered SAML Authentication with Traveler with ADFS () at all!

Good idea.

I remember there was a PDF document done by HCL for SAML+ADFS--but I can't find it.
Do you have any suggestions that I try it in my test environment?

I have found only this note:

http://www.planetnotes.com/2022/05/configuring-saml-authentication-on.html

Thanks you and best regards

7

Hello Daniele,

take a look at the following article:

https://milanmatejic.wordpress.com/2023/10/12/domino-authentication-via-saml-all-flavours/

And also consult our documentation on this topic:

https://help.hcltechsw.com/domino/14.0.0/admin/secu_using_security_assertion_markup_language_saml_to_configure_federated_identity_authentication_t.html

Let me know how it goes! :-)

Best regards,

Milan