We have successfully configured web SSO using Access Manager and LDAP. There are no person docs or groups in the domino directory; database access is to be controlled through LDAP groups included in the acls. This works fine.
The problem is that the format of the name passed into Domino is “uid=firstname.lastname,o=company,c=xx”. Domino does not interpret this with the @name([cn];@username) formula command - it results in blank, meaning that we cannot extract a “nice” formatted version of the user name. This formula is used a lot in the application we are running, and there are also user config documents which are keyed by CN format of the name.
Amending the “Attribute to be used as Notes Distinguished Name” in the DA db can be used to return different attributes from LDAP, such as the mail field, which @name can interpret to, but the Groups in LDAP contain the uid format of the user name. A filter for authorizing against the group in LDAP using the name part of the mail name and wildcards does work, but this is not an appropriate solution because the name part of the mail name may differ from the uid name, it is an expensive LDAP search and there may be duplicate names in different mail domains.
Has anyone managed to resolve this without having to resort to creating a person doc in the domino directory to map LDAP name to Domino name for each user (which we are trying to avoid)?