22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

11.9.2 Multi-server session-based authentication (SSO)<br />

474 Lotus Security Handbook<br />

Multi-server session-based authentication, also known as single sign-on (SSO),<br />

allows Web users to log in once to a Domino or WebSphere server, and then<br />

access any other Domino or WebSphere servers in the same DNS domain that<br />

are enabled for single sign-on (SSO) without having to log in again.<br />

The user’s Web browser must have cookies enabled since the LTPA<br />

authentication token that is generated by the server is sent to the browser in a<br />

cookie.<br />

A multi-server authentication environment is set up via the following basic steps:<br />

► Create a domain-wide configuration document – the Web SSO Configuration<br />

document – in the Domino Directory. (You can have multiple Web SSO<br />

Configuration documents in a Domino Domain or directory that apply to<br />

specific servers, or one that applies to the entire domain.)<br />

► Enable the “Multi-server” option for session-based authentication in the Web<br />

Site or in the Server document.<br />

For detailed information on configuring a multi-server LTPA-based single sign-on<br />

environment, see Chapter 14, “Scenario implementation details” on page 593,<br />

which includes a sample scenario showing such an environment.<br />

Checklist for enabling single sign-on<br />

Use the following checklist as a guideline when configuring your Domino<br />

environment to ensure that your SSO configuration is successful.<br />

General issues<br />

► URLs issued to servers configured for single sign-on must specify the fully<br />

qualified domain name (FQDN), not the host name or IP address. For<br />

browsers to be able to send cookies to a group of servers, the DNS domain<br />

must be included in the cookie, and the DNS domain in the cookie must<br />

match the server URL. This is why cookies cannot be used across TCP/IP<br />

domains. All servers participating in the SSO environment must be in the<br />

same DNS domain).<br />

► Clustered servers must have the FQDN in the host name field of the Web Site<br />

or Server document. This enables the Internet Cluster Manager (ICM) to<br />

redirect to cluster members using SSO. If the DNS server host name is not<br />

there, ICM will redirect URLs to clustered Web servers with only the TCP/IP<br />

host name, by default, and will not be able to send the cookie because the<br />

DNS domain is not included in the URL.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!