Front cover - IBM Redbooks

302 Lotus Security Handbook
A DSAPI filter is built as a shared library under UNIX and a DLL under Win32.
DSAPI is supported on all Domino server platforms. Since the filter is written in
C, you can use the Notes C API to access Domino data, or other C interfaces to
access other systems. The details of compiling and linking a shared library differ
from platform to platform. Note that the Lotus C API toolkit for Domino 6 is not
backwards compatible, meaning programs developed with the 6.x toolkit will not
run on pre-6 releases of Domino. If you have an R5 or mixed R5 and Domino 6
environment, you should use the R5.x toolkit.
A DSAPI filter is a server extension, so the filter has the privileges of the server
ID when accessing Domino databases through the C API.
Since filter notification functions may be called simultaneously from different
server threads, all filter code must be thread-safe. When a Domino server thread
receives an HTTP request, it allocates a new instance of the FilterContext
structure. As the thread processes the request, it passes that instance to all filter
functions it calls. FilterContext contains a pointer, privateContext, that you can
use to store your own data structure. All thread-specific data that the filter needs
to maintain from event to event should be stored in your privateContext structure.
You should use the AllocMem callback function to allocate dynamic memory in
your filter. All memory allocated by AllocMem is automatically freed when the
server thread finishes processing the request. This simplifies your filter cleanup
and ensures that the memory is freed even if the thread terminates abnormally.
Install the filter by specifying the name of the filter in the Server record, in the
field DSAPI filter file name in the Internet Protocols → HTTP table. You can
specify just the name of the filter file if it is located in the Domino program or data
directories; otherwise you must specify the fully-qualified path name. Make sure
that all filter files are secured by adequate file permissions and physical security,
to prevent unauthorized persons from tampering with the filter.
A sample DSAPI filter that uses either the Windows password or the UNIX
system passwords for Domino Web server authentication is provided in
DSAPI and LTPA
The Domino 6 C API toolkit provides two functions for dealing with LTPA tokens:
► SECTokenValidate - Validate a Single Sign-On LTPA Token
► SECTokenGenerate - Generate a Single Sign-On LTPA Token
These two functions correspond to LTPA token decoding and encoding
previously described in the section on LTPA.