SSO for webmail behind reverse proxy

HCL Domino Domino Forum
,
1

Domino/Notes Version: 14.5.1
Add-on Product (if appropriate, e.g. Verse / Traveler / Nomad / Domino REST API):
Its Version: Verse
Operating System: Linux
Client (Notes, Nomad Web, Nomad Mobile, Android/iOS, browser version): Browser

Problem/Query:

I currently use Domino webmail (Verse) with classic Name & Password authentication behind Nginx as a reverse-proxy. Nginx handles the HTTPS termination, and forwards traffic to the back-end Domino server over HTTP. This works fine.

However, I also use Keycloak as an SSO provider, and I would like to use that for authentication using OIDC. This where the rabbit hole started…

I read this presentation: https://hclsoftwareu.hcltechsw.com/images/Lc4sMQCcN5uxXmL13gSlsxClNTU3Mjc3NTc4MTc2/events/images/Webinar_Uploads/Domino_OIDC_SSO/Configuring_OIDC-based_SSO_for_web_users_and_troubleshooting_10_Apr_2025_v1.pdf.

It mentions Domino supports 2 OIDC methods for authentication: Web login and bearer token. Since this is just webmail, I think web login is what I need.

However, a little but further in that presentation, it says “bearer token” should be enabled in the Internet Site document, even when using the Web Login flow.

Here a problem shows up, this option is not available for the regular HTTP(TCP) authentication. Since Nginx does the HTTPS termination and forwards traffic to the HTTP port of Domino (not the HTTPS port).

I wonder if there are any people here who run a similar setup, and how they tackled this. I’d rather not have HTTPS on the Domino server itself (Domino has a history of making HTTPS more difficult than it has to be due to it’s KYR format for storing keys, instead of using PEM with 99.9% of the industry uses).

I’m open to using SAML as well if that makes it easier (and I can avoid setting up HTTPS on Domino).

But like I said, I would like some feedback from someone who has real-life experience with this…

2

Quick update on this:

I enabled HTTPS on the Domino server (using self-signed cert), and let nginx forward to this port instead of the HTTP port.

Then I added Keycloak in the idpcat.nsf database, enabled the bearer-token auth in the internet site document, and set “Domino OIDC provider hostname” in the internet site document to the correct OIDC entry in idpcat.nsf database.

It doesn’t do anything…. there is no redirect to keycloak, and it just keeps asking me for the regular Domino username and password. I have no clue what I need to do to make Domino redirect to Keycloak for authentication, and if it’s documented somewhere, well I am unable to find it.

I have configured tons of software to use Keycloak as OIDC provider, and I was able to set it up in less than hour. With Domino, I spent 5 hours already and I am absolutely nowhere. It’s like Domino doesn’t even try to play nice with other software.

3

Hi,

I just wanted to confirm if you have also reviewed the following articles, as they describe how to configure Web Login with OIDC for web users, including a sample Keycloak configuration for use as an OIDC provider with Domino.

Reference:
**Configuring Web login with OIDC for web users

**Sample KeyCloak configuration as an OIDC provider for Domino

If the issue persists after verifying the configuration against the documentation, we recommend enabling the OIDC debug parameters described in the following article (Scenario 1) to collect additional information about the issue.

*Collecting Data: Domino 14.5+ OIDC Authentication Troubleshooting

Once you have collected the logs, please open a support case with us and attach them so we can further review and investigate the issue.

Thank you!

4

Hi,

Thanks for the feedback. I followed those articles, but it seems I missed the debug notes.ini parameters so I will try those first.

5

Hi,

Debug parameters revealed an error code and I found no info online. I created a support ticket for this.