My company security standars are asking me to delete all internet passwords for the NAB, but i need them inorder to gain access to the LDAP service and have the SSO login from IBM WebSphere. Can i have the internet password outside names.nsf or can i have multiple-file NAB inorder to store WASAdmin in other file different from names.nsf???Greetings
Subject: Internet password outside NAB
Can you set up a Directory Assistance (DA) database for your server that points to an LDAP server? The DA configuration doc that you create can specify that the LDAP server be used for authentication. Check out your Administrator documentation for more information on DA.
I’m not sure about the ramifications for Single Sign-On… I’ll leave that for someone who is better versed in SSO than I. =)
-josh
Subject: Internet password outside NAB
I agree that you should set up Directory Assistance on Domino to point to the LDAP directory that will contain all your users. If you do this, then users can be authenticated by the LDAP directory based on the password in the LDAP directory. However there are several things to consider:
What do the ACLs (Access Control List) on your Domino databases contain? Do they contain Domino identities, such as John Doe/Acme ? The point is that your users will be able to login after being authenticated via Directory Assistance by an LDAP directory, but this may do them no good if they cannot access resources in the Domino environment. If your ACLs contain Domino names (rather than LDAP name such as “uid=jdoe/cn=users/dc=myorg/dc=com”), then you can:
- change the ACLs to contain the user’s expected name from LDAP
or
- you can set up your environment to accommodate multiple user identities, i.e. map an LDAP name to a corresponding Domino name
If you’re using Domino WebAccess mail (especially if you’re using security features), you generally should not go the route of changing your ACLs, and instead you should deploy a multiple user identity configuration.
If you go the route of having multiple identities (each user has both an LDAP name and a Domino name), then there are a few choices. One choice is to modify your LDAP directory to contain a new attribute (e.g. “NotesDN” attribute) for each person that gives the name of the user as expected by Domino. If you do this, then Directory Assistance can be configured to retrieve the user’s Domino name. See the Domino release 6 documentation for more information.
The second choice for multiple identities is to modify the Domino directory to contain information about the user’s expected LDAP name. This is done by putting the LDAP name as a secondary value in the person record fullname field. You likely would need Domino release 6.0.2 or greater. Here are the release notes that give additional information:
WebSphere and Domino names handled by Domino HTTP server
Release Note Text:
A number of IBM products interoperate with both WebSphere and Domino, such as the Domino HTTP server which supports single signon (SSO) with WebSphere. In some configurations, the WebSphere directory containing user information may not be the Domino directory, but instead may be some arbitrary LDAP directory. A user may exist in 2 ‘worlds’ (WebSphere vs. Domino) with 2 different names.
For example, a user may be primarily known in the WebSphere world as “uid=jdoe/cn=users/dc=myorg/dc=com”; in the Domino world, this same user may be known by a Domino name, such as “John M Doe/MyCompany”. The Domino HTTP server can now support SSO to WebSphere and Domino in the environment where users have these multiple identities.
If a user logs in first to WebSphere, and later attempts to access Domino, the user’s name will be presented to Domino in the WebSphere form. To support SSO, Domino can map the user’s WebSphere name (e.g., uid=jdoe/cn=users/dc=myorg/dc=com), to the equivalent Domino user as listed in the Domino directory (e.g., John M Doe/MyCompany). For all Domino operations managed by the Domino HTTP server, name mapping is attempted so that there is a Domino name in use. For example, when a user creates a document in a Domino database, the user’s Domino name will be compared against the database ACL (Access Control List) to determine access, instead of using the WebSphere name.
In order for the mapping of a WebSphere name to a Domino name to succeed, the following rules apply:
-
The user’s person record in the Domino directory must have the WebSphere name as a secondary value in the fullname field. For example, the Domino user John M Doe/MyCompany has the WebSphere name uid=jdoe/cn=users/dc=myorg/dc=com listed secondarily in the person record fullname field.
-
If Domino is configured to use Directory Assistance, it’s possible that the search on a user name such as uid=jdoe/cn=users/dc=myorg/dc=com might yield multiple matches from various directories in the directory search path. Administrators should ensure that when multiple matches do occur, the Domino and LDAP directories on the directory search path should have consistent information for the user’s Internet email address. For example, suppose Domino finds these matches:
– an entry from a Domino directory for John M Doe/MyCompany (which has uid=jdoe/cn=users/dc=myorg/dc=com as a secondary value in the fullname field)
– an entry from an LDAP directory for uid=jdoe/cn=users/dc=myorg/dc=com
In order for uid=jdoe/cn=users/dc=myorg/dc=com to be mapped to the Domino name (John M Doe/MyCompany), the Internet email address in each of these records must match. If each record has the same Internet email address, such as “jdoe@mycompany.com”, then Domino recognizes these records as belonging to the same person and will therefore properly map to the Domino name of John M Doe/MyCompany.
- If the Domino server configuration includes the ini parameter “NoAmbiguousWebNames”, then mapping will not take place if more than one person record is found to apply to the name.
This applies to a situation where the name lookup finds both an LDAP entry with the WebSphere name in it and also finds one or more Domino names to potentially map to (for example as in #2 above). Because the distinguished names in these records are not the same (e.g. one is the Domino name and the other is the WebSphere name), the name mapping should not take place due to the server environment variable setting.
This does NOT apply to duplicate person records found. For example, suppose the search on the user name uid=jdoe/cn=users/dc=myorg/dc=com finds 2 identical person records found for John M Doe/MyCompany (which each has uid=jdoe/cn=users/dc=myorg/dc=com as a secondary value in the fullname field). In this case, the name mapping can take place to the Domino name.
Note: If there are issues mapping a WebSphere name to a Domino name, an administrator can output more information to the server log file (log.nsf). This requires adding an environment variable to the server configuration:
LOGLEVEL_NAME_MAPPING = 1
It is not recommended to enable this environment variable in the usual configuration because of the potential for a high volume of messages that may be logged. Instead, this variable should be turned on to collect information about a mapping problem, and then turned off as soon as possible.
hope this helps!