Front cover - IBM Redbooks

480 Lotus Security Handbook
Similar to the other mapping option, this option may often be supported via the
implementation of a Directory synchronization tool to handle the population of the
new LDAP attribute in LDAP.
This option is new to Domino 6, and thus is supported in Domino 6.x, but is not
supported in Domino 5.x or earlier.
11.10 Domino Password Checking
Password Checking is a client authentication feature that ensures that users are
forced to change their passwords at regular intervals and also include protection
for the user base. Consider the following example: If someone were to acquire a
Notes user ID file – and, of course, be able to know the password of this Notes ID
– they would normally be free to access the server using this copy of the Notes
ID. However, when Password Checking is enabled, the moment the victim
changes their password on their legitimate Notes ID file, it results in the server
also being aware of the change. Any attacker then trying to gain access with the
stolen copy of the Notes ID file will be refused access to the server.
When the administrator enables password checking, that person can specify a
Required Change Interval (which is measured in days) that forces users to
change the passwords on their Notes user ID files within that interval of time. The
Notes client will prompt a user to change their password as the expiration date of
the password draws closer. In addition to the change interval the administrator
can specify a Grace Period. This is a time (again, measured in days) that
indicates the interval of time (after the expiration of a password) the user has to
change their password. In both R5 and Version 6, after the Change Interval +
Grace Period elapses, the user will effectively be denied access to the server
until the administrator resets their account in the user's Person document. This is
a different behavior from that of pre-Notes R4.67 clients. The following
discussion focuses on R5 and Version 6 clients.
11.10.1 The Notes and Domino password checking system
The Notes and Domino password checking system can be split up into two main
components: the Notes client and the Domino server (we integrate iNotes a little
bit later). At this stage, it's important to point out that most of the work that goes
into enforcing a Domino Server lockout (resulting from the application of the
password checking feature) is actually carried out on the Notes client. Before we
can explain the full working process, it is necessary to take the time to provide an
initial explanation of the components involved.
With an enabled Notes user ID, users can be made aware of an upcoming
password expiration before they have even clicked on a database icon or