I am exploring WebAuth in Domino. I have Users in a secondary Directory Assistance directory with one letter and three digits. Users can log in, but then not access parts of an app, because that name collided with @SoundEx of a group. It turns out, that some random user cannot access an application.
After running through some debugging, it turned out that those 1Letter3Digits Names also exist in the ($Users) View in the main names.nsf, because it's the Soundex value of a group.
Funny enough is, that the user IS LOGGED IN, apparently using the credentials of the second directory, but cannot access the app, because the groups are not in it's ACL.
It happens on one Server in a Cluster, that also runs Traveler, another cluster member with the same ($Users) is fine with the user name and provides access to the app.
As a workaround, I removed SoundEx in the ($Users) view, that helps. But I would like to understand the underlying archictecture and come back to a standard Public N&A.
Would anybody be so kind to point me in a direction I don't see yet?
Thank you.
Hello Andreas,
Please refer the below document on "What is the Soundex coding system and How does Soundex work in Notes and Domino?"
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080322
Let me know if this helps.
Regards
Shrikant J
Thank you very much, Shrikant, a very interesting topic on using Soundex for Mailing. I might add, the documentation has a little bug in it:
Example 1: "BC123" would return a Soundex code of "B2000" as would the string, "PK6L6". If a string starts with a number, that number would be the first character in the returned code and all other characters would be zeros.
the return on bc123 would be B200 and for PK6L6 it's P200 just to stay in the concept 1 Letter 3 digits.
Unfortunately, it does not bring me to the side effect of catching a wrong name for the ACL (though I am sure, ACL uses the same algorithms as finding Mail addresses) only on one Server.
I of course compared the server documents, both are configured the same.
And: Allowing Fewer names to log in does not change the interesting case.
Hello Andreas,
Thanks for your feedback on the article and we will have correction accordingly.
Now coming to the actual problem. I would request to have the below debug turned on the server to understand what is going wrong.
Directory Assistance and Web Authentication traces.
Webauth_verbose_trace=1
Debug_nameLookup=1
Debug_directory_assistance=1
LogLevel_Name_Mapping=3
Steps to enable traces:
1. Add the above debug in the notes.ini of the server before last two lines.
2. Restart the Domino server.
3. Test the issue to capture the data in console.log
*To disable the debug after testing the issue remove the above ini parameter and then take Domino server restart.
With the console.log collected on the server, you may review it to know if it shows some errors. You can also submit a support case with describing the issue to track it. If it is required some code review by the development team about this issue we need a support case.
Note: These traces may impact performance of the server hence, please plan your testing issue accordingly to capture the logs.
Thank you.
Shrikant J