Front cover - IBM Redbooks

460 Lotus Security Handbook
server, the server can connect to the remote foreign LDAP directory server to
look up the user name and password to do the authentication.
Attention: A server can always use a Domino directory in the directory
assistance database for client authentication if the directory is assigned the
same domain as the server's domain, regardless how the Directory
Assistance document is configured.
You use an Internet Site document or the Ports → Internet Ports tab of the
Server document to control the types of client authentication an Internet protocol
server allows.
Names accepted for name-and-password authentication
If a server uses name-and-password security to authenticate Internet clients, you
select the types of names that the server can accept from clients. On the
Security → Internet Access tab of the Server document in the primary Domino
Directory, select “More name variations with lower security” or “Fewer name
variations with higher security” (the default). The selection applies to name and
password authentication using any directory, including the primary Domino
Directory.
Though a server can accept a name other than a distinguished name from a
client to search for a user's entry in a directory, it is always the user's
distinguished name in the directory entry that the server compares to trusted
rules in the Directory Assistance document to determine whether to authenticate
the client. For example, suppose a user is registered in a directory with the
distinguished name cn=alice browning,o=Acme, but the user configures the
name alice browning on the client. During authentication, the server searches for
an entry that contains the name alice browning. When it finds the entry, it can
only authenticate the client if “cn=alice browning,o=acme” matches a trusted
naming rule for the directory.
A user's distinguished name is also used as the basis for access control in
Domino, so you should use users' distinguished names in database ACLs, in
groups used in database ACLs, in access lists in Server documents, and in Web
server File Protection documents.
Encountering duplicate names during client authentication
If a server finds more than one directory entry containing the name presented by
the client that corresponds to a valid distinguished name for authentication,
within one directory or across directories, the server authenticates the client
using the entry with the valid password or X.509 certificate. If more than one
such entry has a valid password or X.509 certificate and the same distinguished