We are using single sign-on between Windows & Notes. This works without a problem. However, when the users open applications on the web client (Currently using I.E.) they have to sign on again. This is causing dissatisfaction amongst the users. Has anyone resolved a similar problem? I would appreciate any assistance.
Subject: Single sign-on
Single-sign on window/notes is not designed to work with Internet Explorer.
You could consider:
Using cookies on your home page so they only need to login once. This requires a custom login page.
Using client certificates to log in via IE
Subject: Single sign-on
The admin help file describes what is required to use windows authentication on the web.
Subject: Single sign-on
If your servers are running on Windows, you may want to consider using IIS with Domino.
See the topic in Domino 7 Admin Help
'Setting up Domino to work with Microsoft IIS servers ’ and also the linked topic ‘Details of Microsoft IIS security options’.
Subject: Single sign-on
This is not SSO as described by Admin Help. You are able to login to Notes with the Win password because you installed a Notes Client component whose name is skipping now …
Single Sign On can be achieved between multiple Domino - WebSphere servers (the LTPA session cookie), with some config. settings and little patience. However, this ensure ‘browser login once - access multiple web servers without further authentication’
What you describe is this: be able to login to Windows - then automatically authenticate to one/serveral web applications. This is a typical scenario for identity manager solutions. Try Tivoli Indentity Manager or SiteMinder.
Subject: RE: Single sign-on
Thanks for confirming that I’m not going mad. Couldn’t find what Peter was refering to anywhere!!
Subject: RE: Single sign-on
OK - so my wording was off, but as Mark said, you can setup Domino to run with IIS and IIS can log clients in automatically if they are running in the same/trusted domain, and that is what I was referring to.
This funtions much like SSO in that you can go from domino server to server (provided they are all configured correctly) but has the added benefit of not requiring a user to log on to any of the servers.
Here’s some of the info in help:
Integrated Windows Authentication (called Windows NT Challenge/Response on NT)
Integrated Windows authentication is a Microsoft-specific protocol supported by Internet Explorer (IE). When a Web user makes a request to the site, IE automatically sends to IIS the user’s current Windows logon account name. IIS verifies the name against the Windows registry on the IIS server. When a user makes a Domino request, the IIS plug-in passes to Domino the user’s Windows name and Domino processes the pre-authenticated name as described above for Basic authentication.
Windows account names use the form domain\username or machinename\username – for example, SALES\JSmith. If Domino is using Person documents in the Domino Directory to authenticate the Windows users, the documents must contain the exact Windows account names as aliases. For example, if Joe Smith has a Notes ID in the “CorpSales” domain and a Windows user account in the “SALES” Windows domain, the User name field in Joe Smith’s Person document needs to contain:
Joe Smith/CorpSales
SALES\JSmith
This allows Domino to authenticate the Windows user SALES\JSmith as the Domino user Joe Smith/CorpSales.
In summary, integrated Windows authentication uses the following guidelines:
If this is the only authentication method enabled, only IE users can access the Web site.
Anonymous access is not possible since IE automatically sends the user’s Windows account name on every request.
The Web user must be a registered NT user.
If you want to match the Windows user to a Domino Person document, You need to add the user’s NT Windows account name as an alias to the Person documents.
Domino does not use the Internet password.
The user is automatically assigned to the -WebPreAuthenticated- group.