22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

11.9.4 Domino name mapping<br />

When an existing Domino environment is integrated with other Web technologies<br />

via a single sign-on solution, or a Domino environment leverages an external<br />

LDAP directory for authentication, Domino name mapping capabilties will often<br />

be required to allow the continued use of the fully qualified Notes/Domino names<br />

within Domino database ACLs.<br />

Some examples of when name mapping may be needed are:<br />

► Domino and Portal<br />

When a Domino server is utilized as part of a WebSphere Portal<br />

implementation, the Portal will authenticate the user against the LDAP<br />

directory, and the LTPA token will be created with an LDAP hierarchical<br />

name, such as “uid=tworek,ou=users,o=redbooks,c=us”.<br />

Now when the user accesses a mail portlet, which must access Domino data<br />

on behalf of the user, Domino is passed and reads the same LTPA token<br />

(assuming Portal and Domino are enabled with a common LTPA SSO<br />

domain). However, the ACL on the user’s mail database will contain the notes<br />

fully qualified name, “William Tworek/Cambridge/<strong>IBM</strong>”. Since the LTPA token<br />

contains the LDAP name, Domino will not see this as the same user, and will<br />

not allow access to the mail file.<br />

► Domino and an external LDAP<br />

When Domino Directory Assistance is enabled to trust a third-party LDAP<br />

directory for authentication, users will be authenticated against the LDAP<br />

directory, and an LDAP hierarchical name will be returned to Domino. If<br />

Domino databases then contain original Notes hierarchal names, users will<br />

not be allowed access to their databases since Domino will not understand<br />

that the LDAP name is the same.<br />

Fortunately, Domino supports several options for working around this issue, one<br />

of which is new for Domino 6:<br />

1. Utilizing the LDAP name in database ACLs.<br />

2. Including the LDAP DN as an “alternate” name in Domino person documents.<br />

This is supported in Domino 5.x and Domino 6.02+.<br />

3. Including the Domino Fully Distinguished name in LDAP directory.<br />

This is supported in Domino 6.x via new Directory Assistance capabilities.<br />

Utilizing the LDAP name in database ACLs<br />

This approach is not really a name mapping solution, but rather is a modification<br />

of the ACLs in Domino so that it trusts the LDAP names. In this approach, all<br />

Chapter 11. Domino/Notes 6 security features 477

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!