22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

7.5.1 Authentication<br />

7.5.2 Access control<br />

304 Lotus Security Handbook<br />

HTTP Server. These headers include information about the front-end server's<br />

configuration and user authentication status.<br />

As a security measure, the Domino HTTP task ignores these headers if the<br />

NOTES.INI setting is not enabled. This prevents an attacker from mimicking a<br />

plug-in.<br />

Understand that under this architecture, firewalls and port restrictions on Domino<br />

must be used to secure the channel between the front-end HTTP server and<br />

Domino; otherwise, the Domino server is at risk because the HTTP headers are<br />

easily spoofed. In other words, secure the HTTP server-to-Domino HTTP<br />

channel so only the HTTP server is permitted to connect to Domino's port<br />

80/443. The integrity of this SSO architecture is completely dependent on<br />

securing the channel between the front-end HTTP server performing<br />

authentication and the Domino server.<br />

When using HTTP header plug-in support on Domino, Domino relies on the<br />

front-end HTTP server for all user authentication.<br />

Domino access controls using HTTP headers for authentication is dependent on<br />

the user names provided by the plug-in on the foreign Web server. Domino<br />

database ACLs are still used to determine whether or not a user should be<br />

allowed to access a given resource. Because the user’s authenticated name in<br />

the header is typically not the user’s Notes hierarchical name, the database ACLs<br />

must contain entries that match the expected form of the user name in the<br />

header. A common approach to dealing with this issue is to allow Anonymous<br />

access to Domino databases, and rely on the front-end server’s authentication<br />

and access controls it has defined in its security registry for the Domino URLs.<br />

The major drawback to this approach is the inability to implement document-level<br />

access controls, such as reader or writer document access. Similarly, field-level<br />

controls, such as “hide when” formulas on a Domino form that use group<br />

membership or roles, cannot be used. Because Domino documents get<br />

generated IDs (doc IDs and UNIDs), it is impractical to try and control access<br />

using the URLs.<br />

Domino name mapping can be implemented to map the user name in the HTTP<br />

header to the Notes hierarchical name. Since usually the Notes hierarchical<br />

name is what is used in a Domino database ACL, Domino ACLs can be utilized<br />

providing the conditions required to support name mapping have been met. More<br />

information regarding how Domino can map a name in an external LDAP

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!