Re: Using Notes for User Authentication

Hi!


> for an actual project I'm looking for some Information
> about the possibility to use the notes ldap functions
> for a networkwide user-authentication.
>
> Server: SuSE 8.2 with Domino Application Server
>
> Clients: in the moment only Linux Clients
> (SuSE 8.0 - 8.2 / Debian and Redhat 8), in the future
> maybe windows clients
>
> The solution should:
>
> 1.) Authenticate users trustly

Use LDAP with SSL support. Domino does it!

> 2.) Start login scripts (for instance to mount the home-
> diretorys from a fileserver)

Domino does not have a scheme for automount tables. It is
your tune to create one.

> 3.) Give secure access to some domino-based webapplications
> (browserbased)

Use https. It is preconfigured. You only have to provide or
create the secret key.

> => If its possible to use the domino-ldap-db to authenticate
> users, how can I implement this in the clients-environment
> to use this as the primary authetication point - to avoite
> redundant user administration

Add the necessary scheme to your users. Domino encripts UNIX-
passwords using cript. I am not shure about it beeing possible
to use MD5 instead.

> => Is it needed to adapt / change the domino server to
> provide this service ?

No. The delivered schemes are enough.

> => Is it possible to use ssl/tls for a secure connection to
> the autehntication server

First: how did you administer your domino server until now?
You should have had been stumbled over LDAP configuration
searching to enable and configure your Domino-LDAP server.
There are some configuration entries for "LDAP over SSL".

Have a close look at your domino admin tool. All necessities
are inside there. Just click them with your mouse!

Second: create a SSL key. Read the help from Domino admin tool
if you are going to use it to create the keys. You might as
well use OpenSSL to create keys, then import them into
domino (better: enter the filename at the SSL config page)!

Third: in the LDAP administration database configure what
you need for your person entries.

Fourth: you may be better of using a good LDAP browser
to edit some of the entries. In your Domino Name and
Address Book some of them will never show up.

> => Is it possible that I andministrate users at one point
> (domino ldap db) and the user can use every enabled machine
> in the network without any local modifications (nt like ...) ?

Yes.

> Ok, these are many questions - if you have some links or
> documantion-tipps for me it where great ...if you had a
> related project in the past and let me participate on your
> experience it where brilliant ... ;)

If you want to support SAMBA via Domino LDAP, have a look at

        http://www.opennsf.org/

there is an ongoing project to provide the schema extentions
for Domino's LDAP server.

-- 
Thomas