IBM 6.5.1 manual

RSA ClearT rust Ready Implement ation Guide for Port al Servers and Web-Based Applications Last Modified March 15, 2005 1. Partner Information Partner Name IBM Corporation Web Site www.ibm.com Product Name IBM Lotus Team Workplace Version & Platform 6.5.1, Windows 2003 Enterprise Product Description IBM Lotus Team Workplac e (QuickPlace) is a b[...]

3. Solution Summary Feature Details Use UserID for SSO Yes Use UserID for Personalization Yes Recognize Authentication Type No API-level Authorization Support (RuntimeAPI) No User Management (AdminAPI) No 4. Integration Overview To achieve single-sign-on with Lotus Team Work place, the RSA ClearTrust Agent for Domino is installed on the Domino serv[...]

5. Product Requirements Hardware requirements Component Name: Lotus Domino Memory 256Mb Hard Drive 1Gb (1.5Gb recommended) Software requirements Component Name: Lotus Domino Operating System Version (Patch-level) AIX 5.1, 5.2 OS/400 VSR1, VSR2, i5OS VSR3 Windows 2000 Server, Advanced Server Windows 2003 Server, Enterprise Solaris 8, 9 Red Hat Enter[...]

6. Product Configuration This section provides instructions for integrati ng the partners’ product with RSA ClearTrust. This document is not intended to suggest optimum installati ons or configurations. It is assumed that the reader has both working knowledge of the two products to perform the tasks outlined in this section and access to the docu[...]

Also, be sure to select the Web Browsers (HTTP services) option, since it is not selected by default. After this configuration process ends, start y our Domino server, and ensure that it starts up correctly. You should also use the admin.id f ile created above to enable you to administer the server from a Domino Administrator. Page: 5[...]

Installation & Configuration of th e RSA ClearTrust Agent for Domino Prior to beginning installation of the RSA ClearTrus t Agent, stop the Domino server. Then, start the agent setup program. Ensure that the agent detects the correct installation directory for Domino. Make sure that the SSL settings entered in this process match the settings in[...]

Disable ClearTrust DSAPI Filter Note: There is a known issue with authenticating via the QuickPlaceLoginForm while the agent is installed. While using RSA ClearTrust Agent v4.6 for Domino, authenticating a user via QuickPlaceLoginForm may cause the Domino server to exit. See Known Issues for more information. Because of this issue, disable t he RSA[...]

Enable Domino SSO Once the server restarts, start conf iguring the LTWP installation. • Create a Web SSO Configuration document, or add the LTWP server onto an existing one. When creating the SSO document, this guide used a Domino SSO Key. • Create a mapping form to map authentic ation to the QuickPlaceLoginForm. • Restart the server. 1. Use [...]

2. In the SSO Configuration document, make the following entries a. Select LtpaToken. b. Leave the Organization field empty. c. Select and add all of the servers from the directory to the Domino Server Names field (this uses the proper hierarchical name for each server). d. Enter the Internet domain that all of y our servers share (you should prece[...]

3. Open each Server document and make the fo llowing changes to the Internet Protocols - Domino Web Engine tab: a. Session authentication: Multiple Servers (SSO) b. Web SSO Configuration: LtpaToken. c. Then Click Save and Close. 4. Open domcfg.nsf. If domcfg.nsf does not exis t you will need to create it. See the Domino documentation for informatio[...]

5. Create a mapping form to map authentication to the QuickPlaceLoginForm. a. Applies To: All Web Sites/Entire Server b. Target Database: QuickPlace/resources.nsf c. Target Form: QuickPlaceLoginForm b. Then Click Save and Close. 6. Open the notes.ini file located in the Domi no install directory and add the following parameter QuickPlaceUseDSAPIDNs[...]

Point Team Workplace at Domino User Store Open up LTWP home page in a browser, and login as the LTWP administrator created during installation. Under Server Settings , select User Directory , then Change Directory . Select Domino Server as the type, and point it at your Domi no server. Then, select to disallow new users. Save your changes, and log [...]

Cleaning Up Now, re-insert the ClearTrust DSAPI filter in the server document. Then, restart the server one last time. Note: The RSA ClearTrust DSAPI f ilter should be the last filter in the list. Authentication will not behave correctly otherwise. Testing the Setup When Domino starts, you should be able to see startup notices for LTWP and RSA Clea[...]

From a new browser, browse to http://servername.domainname . You should see the Domino homepage. Then go to /homepage.nsf, which should show you the same page, after authentication via RSA ClearTrust. When you navigate from there to the QuickPlace home page (/QuickPlace), you can see that you are automatically recognized by the RSA ClearTrust agent[...]

As a last check, navigate to the web administration database (/webadmin.nsf). You will Notice that even though the web admin database is protected by Domino, and not by RSA ClearTrust, the Domino agent supplies the credentials to Domi no’s native authenticati on, and the user is recognized from his RSA ClearTrust SSO cookie. Page: 15[...]

7. Certification Checklist for Portal Servers and Web-Based Apps Date Tested: February 7, 2005 Product Tested Version RSA ClearTrust 5.5.2, 5.5.3 Team Workplace 6.5.1 Domino 6.5.1IF1, 6.5.2, 6.5.3 ClearTrust Agent for Domino 4.6 Test Case Result Product Characteristics for SSO Support Application/Portal is web-based, and supports access by a standa[...]

8. Known Issues Authentication Via QuickPlaceLoginFo rm May Cause Domino Server Exit While using RSA ClearTrust Agent v4.6 for Domino, authenticating a user via QuickPlaceLoginForm when the ClearTrust DSAPI filter is in place may cause the Domino server to exit. There is a fix available for this behavior fr om RSA technical support. To acquire this[...]