SSO with customer AD

HCL Domino Domino Forum
1

We host a web application on our internal servers. One of our customers has inquired about the possibility of having single signon to allow them to log in to our app automatically from their environment. Their environment is a completely separate domain and network from our environment.

I have a few questions/assumptions that I would like to toss out here. From my reading it looks like Domino can not be set up to pick up the credentials from a windows login in a foreign domain? http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin85.doc/H_SETTING_UP_SPNEGO_AUTHENTICATION_FOR_WEB_CLIENTS_STEPS.html

If not, is there a better way to set up a trust between the two environments? We would need to allow their users to either go right into our environment if they’ve logged in to their domain OR allow them to enter their username and password into our site and call back to their active directory server.

Any thoughts or direction would be GREATLY appreciated.

2

Subject: Correct

Correct - to use SPNEGO, Domino and the user machines must be in the same AD domain.

However, it sounds like you may be able to implement directory assistance (on Domino) to point to and use credentials from an Active Directory server. More information on directory assistance here:

http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/topic/com.ibm.help.domino.admin85.doc/H_ABOUT_DIRECTORY_ASSISTANCE.html?resultof="directory"%20"directori"%20"assistance"%20"assist"%20

It basically allows you to point to a foreign directory (either in the form of a remote LDAP server, or local-to-Domino .nsf address book) and use that directory for a variety of things, including credential recognition.