Lotus Domino Administrator 7 Help - Lotus documentation

v Any appropriate LDAP attribute, as long as it uniquely identifies the user.
v A value of $DN to use the LDAP distinguished name. This is the most commonplace configuration,
indicating that the user’s LDAP DN is the name expected by WebSphere, rather than a name in
some arbitrary LDAP field.
v Leaving it blank to default to the Domino distinguished name, if known. Otherwise, the default
will be the LDAP distinguished name.
If Directory Assistance is configured such that a search on a particular user finds a match in both the
Domino Directory and in an LDAP directory, Domino requires consistency between a Domino Person
record and an LDAP record. Domino takes extra steps to determine that there are matching values for the
Internet email address located in both directories. To accomplish this, DA searches for the user’s LDAP
″mail″ attribute. This value must match the information found in the Domino Person record field
″internetaddress.″
Attribute in LDAP Directory Attribute in Domino Directory
mail: Jbond@secret.spies.com internetaddress: Jbond@secret.spies.com
In order for SSO to succeed, you must ensure that the value of the Domino attribute ’Internet address’
matches the value of the LDAP attribute ’mail.’
Other considerations:
v To support aliasing, in the Person document, add the LDAP name to both the LTPA_UserNm field and
as a secondary value in the User Name (i.e. document property Fullname) field.
For more information on alias dereferencing, see the chapter ″Setting Up Directory Assistance.″
v Notes client integration with Sametime (and therefore SSO with Sametime) is not supported if the
Sametime server is configured to use Internet Sites, as the Notes client protocol (NRPC) for obtaining
an SSO token does not work with the use of Internet Sites.
v Name mapping in the LTPA token is not supported when user information is stored in condensed
directory catalogs.
Anonymous Internet/intranet access
When you set up anonymous access, Internet/intranet clients can access servers without identifying
themselves. Domino does not record these clients’ database activity -- for example, in the log file and in
the User Activity dialog box.
With anonymous access, you never know who is accessing databases on the server. Therefore, you cannot
use the client’s identity -- that is, the client’s name and password -- to control access to databases and
design elements. Use anonymous access when you do not need to know who is accessing the database
and/or when you do not need to control access based on client identity.
You can use anonymous access with TCP/IP and/or SSL on any server that runs LDAP, HTTP, SMTP, or
IIOP. For each Internet protocol enabled on the server, you can specify the method of security. For
example, you can enable SSL for HTTP connections, but require name-and-password authentication for
LDAP connections that use TCP/IP.
In addition to using anonymous access, you can enable name-and-password authentication and SSL client
authentication. Then users can use any authentication method to connect to the server. For example, if the
user has an SSL client certificate, the user can access the server using SSL; whereas a user who does not
have an SSL client certificate can access the server anonymously.
Chapter 44. Setting Up Name-and-Password and Anonymous Access to Domino Servers 1077