22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

7.4.1 Authentication<br />

7.4.2 Access control<br />

7.5 HTTP headers<br />

DSAPI provides enough flexibility to authenticate a Domino Web user using<br />

nearly any criteria. The criteria can be based on matching a name and password<br />

in a Domino or external LDAP directory, matching a name provided in a cookie,<br />

or some other mechanism. With great flexibility comes the burden of ensuring the<br />

mechanism used is secure. This burden falls on the DSAPI developer. Another<br />

potential issue and burden relates to performance. For example, if the DSAPI<br />

needs to connect to an exterior directory, the lookup time can drastically affect<br />

performance. The developer can opt to check the user cache, or ignore the<br />

cache and perform the external lookup with every access.<br />

The DSAPI functions do not directly control Domino access controls. However,<br />

they do allow direct setting of the user’s authorized name, which then is used for<br />

all access on that server for the HTTP request processed by the DSAPI filter.<br />

The developer can provide complete control regarding how the login name can<br />

be transformed or mapped to a different name by setting the “authname” to<br />

whatever value and format is desired. See Scenario 1 under the kFilterAuthUser<br />

Event described previously.<br />

Domino 6 supports HTTP headers for user ID and passwords that allow you to<br />

use a third party Web server as a front-end to a Domino server. This feature is<br />

often described as the “WebSphere Application Server plug-in” for Domino,<br />

which is a somewhat misleading name since it isn't the same as an<br />

authentication “plug-in” or Trust Association Interceptor (TAI) on WebSphere<br />

Application Server, nor does it involve a plug-in on Domino since it is just a<br />

notes.ini setting that tells Domino HTTP to accept the WebSphere Application<br />

Server-style user ID and passwords in the HTTP headers. The actual plug-in to<br />

support this SSO architecture is installed on the front-end HTTP server. Plug-ins<br />

for front-end HTTP servers that are compatible with Domino back-end servers<br />

are available for Microsoft IIS and the <strong>IBM</strong> HTTP Server, and plug-in support is<br />

planned for Apache and iPlanet in future Domino 6 releases.<br />

In order to support HTTP header SSO on a back-end Domino server, add the<br />

following line to NOTES.INI:<br />

HTTPEnableConnectorHeaders=1<br />

This setting enables the Domino HTTP task to process the special headers<br />

added to requests by the WebSphere Application Server plug-in for IIS or <strong>IBM</strong><br />

Chapter 7. Single sign-on 303

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!