SSO and AD passwords

HCL Domino Domino Forum
1

We’re currently using SSO on AD domain XP clients with Notes clients, so every time AD GPO forces user to changed AD password it’s automatically changing note ID password, going further we have notes policy to change Internet password on notes ID password changed, to questions:1. at any time user forget AD password and call helpdesk for reset, helpdesk will do so but this is braking process and local notes ID password remains the same which obviously is unknown for user since he/she call helpdesk for reset in the first place, this means helpdesk have to recover notes ID password and reset it to same they reset AD password to, then place on and user local PC… then check in AD to force user to changed password on next logon which will make all 3 password in synch again… painful process. Is there any better way of doing this? Will AD Sync make this process easier? Can you use AD as LDAP server and do not use DD security, what is downsize of it?

  1. Additionally is there any way to synch Internet password (DWA) with AD passwords for DWA users who do not use notes clients at all?

  2. Finally, is there any way to change automatically password on ID file imported to mail file via DWA client any time Internet password changed?

TIA

2

Subject: SSO and AD passwords

hi, if the problem is grant the sso for web application, you can resolve with insert in your infrastructure, one machine with WAS 6.1 configured to accept the sso thrue the TAI SPNEGO authentication meccanism, and redirect to domino server with a token ltpa to grant the sso with windows domain. And don’t preocupe to syncornize nothing you must have the same uid in domino ldap and in AD.

3

Subject: RE: SSO and AD passwords

I’n not familiar with WAS6.1 so question here you mean WAS HTTP Server? I can do sso across domino severs so this is not as much of the issue, also I can synch domino http password with AD using Tivoli Dir Integrator, so what would I be gaining by implementing WAS 6.1 ? if I do so will it allow changing password via web if AD pasword expired?