Several years ago, I was asked to configure our Domino servers for LDAP authentication for HTTP and IMAP with our third party LDAP server infrastructure. We had been using the Domino HTTP password for web, IMAP and Sametime authentication, but as an enterprise we were moving in the direction of standardizing on a one user id/one password model for identity management. In our Domino environment, the Domino shortname field also equals our global user id, which also maps to our domain email address: globaluserid@domain.name. Thus, the users could easily remember their global user id as it was part of their email address.
Because I had less than a month to implement the solution and could not purchase additional software for this purpose, my goal was to engineer a process that would be as streamlined as possible to implement and maintain. I also did not want to store the global user id passwords in the Domino directory in order to minimize the overhead on the Domino servers. I determined that to maintain up to the second password synchronization, a tremendous amount of unnecessary replication activity would be required on servers that were already quite busy.
I requested the addition of the following attributes to our enterprise LDAP schema:
DominoUserName cn=joe e user/ou=ou1/o=o
MailFile usermail1/juser.nsf
MailServer cn=mailservername/o=o
We included MailFile and MailServer name so that these fields could be passed to the Domino Web Redirect database used as the central login point for HTTP/HTTPS authentication.
On the Domino Server side, we created a Directory Assistance database for each Domino server serving HTTP and IMAP. The Directory Assistance database configuration included the following:
- Basics Tab:
Note – the “Use exclusively for Group Authorization or Credential Authentication” has been added in the 8.0.x version of the Directory Assistance template.
- Naming Context Rules Tab:
- LDAP Tab:
Attribute to be used as Notes Distinguished Name – matches the DominoUserName canonical name attribute stored in the LDAP directory. Each Server Configuration Document was also changed to use a Directory Assistance database. Note — When Directory Assistance is enabled for the first time, a Domino restart is required to have it go into effect.
My next task was to find a method to populate the data in the LDAP director. Initially, I built an LDIF file to feed data into our test LDAP server. But I needed a process that would update the entries on a timely basis if a user’s information changed so that web or IMAP authentication would not be affected. I thought I’d try out IBM Tivoli Directory Integrator. It was exactly the right tool for the job. I’ll include details of the Directory Integrator configuration in a separate post.


