We conclude our two-part article series about setting up a DMZ to help protect your company's resources with a look at several different scenarios for hosting Domino servers in the DMZ to control inbound and outbound SMTP mail traffic. David Bell is a Senior IT Architect with the IBM Software Group, specializing in services for the Lotus Software brand of products.
Timothy Speed is an infrastructure and security architect for IBM Software Services for Lotus (ISSL). The only connectivity to your Domino servers from the outside should be on port 25 to allow SMTP mail routing.
Create a new certifier structure for these servers and cross-certify these servers for access by administrators and internal Domino servers. In this scenario, SMTP1 is the primary outbound path, and SMTP2 is the primary inbound path. To protect against major site failure, such as ISP network connections or a disaster, a more complex scheme is required. The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Keep up with the best and latest technical info to help you tackle your development challenges. The Domino 4.6 support for LDAP is a step towards getting true directory assistance for Internet mail. Mark Gordon is a managing partner with Knowledge Resource Group, an e-business consulting firm in Indianapolis. What happens if the server you are accessing doesn't have the entry, but knows where it can be found? In this conclusion to our two-part series, we look at several different scenarios you may encounter when implementing single sign-on (SSO) functionality at your site. In part 1 of this article series, our intrepid (if somewhat obscure) secret agent pal Jim Bland helped us through the basics of single sign-on and multi-directory, multi-identity environments. The TSGA administrator must also turn on LDAP alias dereferencing for the respective LDAP clients--in this particular case, the Sametime Links client as well as the Quickplace client. In that capacity, he is responsible for anticipating and resolving technical issues that arise in the course of consulting engagements and for designing, building, and implementing messaging infrastructures that meet customer needs.
We continue this theme in Part 2, examining in detail how Domino servers can be hosted in the DMZ to provide the first point of relay for inbound traffic and the last point of relay for outbound traffic.
From the internal network, Notes NRPC traffic is required to allow administrators access to manage the servers (and potentially for replication of directory information). Set the SMTP welcome banner to a generic greeting that does not show Lotus Domino and its version information.
Again, rather than publishing the internal Domino Directory, create an Extended Directory Catalog on internal servers that contains only user name and Internet address information. Creating an EDC configuration documentOn the Basics tab, in the "Additional fields to include" option, select InternetAddress. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.
This article describes LDAP, looks at how Domino supports it, and shows how to set up LDAP support on a Domino network.
Mark is a certified Notes instructor, developer, and administrator, and has worked with Notes since Release 3. LDAP servers can be set up to "know about" other LDAP servers, and to refer LDAP clients to those other servers if the user is not found in the first server. This is done either to avoid one overly large address book or because of the company's organizational or political structure. The Server document contains a new section called Internet Port and Security, which includes settings for LDAP access. If you use Domino in conjunction with other LDAP-compliant mail systems, your organization gains a great deal of flexibility in how you provide this mail addressing lookup capability.Copyright 1997 Iris Associates, Inc. Could you please check if you can reschedule a meeting from the Traveler Agenda with the Nokia device ?
She has worked on Directory Services since the mid-1990's, concentrating on LDAP and Domino. She has been working in the area of security for a number of years, most recently focusing on Single Sign-On issues across various IBM products. The IBM Directory Server returns a match with the NotesDN attribute containing the value cn=Jim Bland,ou=secret,o=spies.Figure 8.
In order for the LDAP server to find an LDAP name that has been listed as a secondary value of the FullName field in the Domino person document, the LDAP client has to request the LDAP server to dereference aliases when doing a name search. As names are critical to SSO, clearly SSO falters if there is any hitch in the transformation such that the name is rendered unrecognizable. For the convenience of users, Domino 7 removes the restriction that users must log in first to WebSphere. He works with customers to facilitate the formulation and execution of information strategies that are innovative and well aligned with their business goals.
He also participated with the Domino infrastructure team at the Nagano Olympics and assisted with the Lotus Notes systems for the Sydney Olympics. You can use an internal pass-thru server as a proxy to allow only one IP address through the firewall to the DMZ.Disable all unneeded Internet protocol ports. Again, this is to minimize the amount of information about your internal environment that is available to the outside world.
Place the DMZ servers in their own domain so that the only entries contained in the Domino Directory are Server documents and a few groups that may be necessary for configuration. This can then be replicated to the Domino SMTP servers and referenced through Directory Assistance. If you want to have both inbound and outbound mail distributed evenly between the servers, then make the MX record preferences the same for each pair of servers. Domino servers with user directory informationThe Directory Cataloger task is responsible for maintaining the EDC on a server that is in the internal domain and has access to the source directories from which user information needs to be aggregated. Rules can also be configured that direct the user to a particular server based on the search criteria.
She's primarily responsible for Domino and Workplace security administration documentation. More recently, she's been focusing on directory integration between Domino and various IBM products, and in her distant past she worked on StreetTalk for Vines and the Distributed Computing Environment (DCE). Jane spends most of her time developing security for Internet applications and Web server technology, although occasionally she also creates new security user interfaces. Domino expects the primary value to be the Domino DN, and the second value to be a Domino "common name."Some applications are case-sensitive, so be careful! SSO with "Attribute to be used as Notes Distinguished Name" feature (steps C and D)In figure 9:E.
David has been working with Lotus Notes and Domino since the 1990s, designing and implementing architectures for organizations of all sizes. As with the first article, experience with administering Lotus Notes and Domino will help you understand the concepts we discuss. For example, set SMTPGREETING="ESMTP Service ready at %s" where %s is replaced with the system date and time.Do not use the internal certifiers to register the Domino servers. Following the same principles as the certificate hierarchy, choose a generic domain name such as SMTP.Use an Extended Directory Catalog if address verification is required. Publish only the minimal information necessary to allow the servers to perform their tasks. It is common practice to separate inbound and outbound routing because it simplifies troubleshooting under normal circumstances.
This provides a very resilient architecture that can cope with failures ranging from an individual server up to the entire site or point of presence.The other main difference between Scenario A and Scenario B is that the SMTP relay host entries need to be different for each point of presence so that routing to and from each point of presence can be controlled independently. Extended Directory Catalog Basics tabOn the Advanced tab, you can enter a selective replication formula to restrict source content even further. An LDAP server for the Acme company might be configured to refer all requests for Atlanta employees to a server in Atlanta, for example. While Terri is also not a member of the intelligence community, she believes Jim Bland would enjoy his job much more if he spent time tracking his foes on the world's best golf courses! Outside of work, Jane's interests include music as well as the quixotic pursuit of improved physical fitness.
Basically, an LDAP alias is an entry in a LDAP or X.500 directory that points to another entry in the directory hierarchy. You can avoid instant death scenarios in your environment only by getting the latest and greatest releases. The idea is that the administrator picks the format of the user's name that should be put into any LTPA cookie created by Domino for the user.
And if you haven't already read Part 1 of this series, we suggest you do so now.Domino servers in the DMZSecurity is always a high priority when deploying services that will be accessible to other systems beyond your control. Single servers at each of these points would represent the simplest configuration possible.


Again, MX preferences can be made equal to balance routing rather than splitting preferred and backup paths.Using a smart hostA smart host does for inbound mail routing (local domain recipients) what a relay host does for outbound mail routing (external domain recipients).
In this case, we only want to aggregate user, group, and mail-in database entries that contain a valid Internet address value. That way, each mail user can have her mail client configured to access just her home directory, but that directory server will refer her to others as needed.
Amy is not now, nor ever has been, a member of the intelligence community, although she would love to have a shoe phone! In other words, does the value of the InternetAddress attribute in the Domino person document match the value of the mail attribute in ITDS?Figure 4.
SSO with "Attribute to be used as Notes Distinguished Name" feature (step E)And in figure 10:F. Instead of placing a Domino-format name into an LTPA cookie, Domino 7 can be configured to put an LDAP name into an LTPA cookie.
The smart host entry is specific to each server and is configured on a server configuration document. This can be used as a control to allow Internet mail reception only for a subset of these entities.Figure 9. It will always depend on the infrastructure of the organization, and the rules administrators must follow. For the TSGA Research Department, their infrastructure requires that the Domino server have access to IBM Tivoli Directory Server (ITDS) for the lost equipment inventory system mentioned earlier.
If you have deployed a version of WebSphere Portal earlier than 5.1, you may need fixes for handling names with special characters. For maximum SSO interoperability, the administrator should pick the name format that will be acceptable to Domino, WebSphere, and any Domino extended products.Domino 7 users can try out this new feature today. Where a set of servers has the exact same choices for next hop relays, the same smart host entry can be used for multiple servers.However, as we discussed previously, when you need different routing preferences (or costs) for a set of hosts, you must use multiple smart host entries that each resolve to a unique set of MX preferences.
The EDC contains all the views typically associated with the standard Domino Directory against which lookups can be performed.After you create this database, set a very restricted ACL.
For some parts of the organization, LDAP is the corporate directory, and all changes must be made in there.
In order for TSGA's special inventory Notes application to access some "Special Equipment" directory objects that exist in ITDS, the Administrator creates an LDAP entry for the ITDS directory in the Directory Assistance database on the Domino server (the server also running Domino Web Access).To achieve SSO in this environment, just as in the previous scenario, TSGA adds the LtpaToken value uid=jb013,ou=secret,dc=spies,dc=com to the person document in Domino. The same person (Jim Bland) is verified as being represented by the ITDS record and the Domino person document, based on the matching mail address in each of these records. SSO with "Attribute to be used as Notes Distinguished Name" feature (step F)Scenario 4: IBM collaborative components using LDAP protocol for name mappingSo far, our scenarios have been reasonably straightforward to comprehend and to deploy. The TSGA administrator will enable this feature by opening the global configuration record *-[ALL Servers] from the Configurations options in the primary Domino directory, selecting the LDAP tab, and setting "Allow dereferencing of aliases on search requests?" to Yes (see figure 11):Figure 11.
NRPC is the standard that Domino servers use for mail routing and replication and requires port 1352 access through the internal firewall. For other branches, LDAP schema is not allowed to be modified, so all changes need to occur in the Domino directory.
The name mapping from LDAP name to Domino name succeeds, and Bland is allowed access to his Domino Web Access mail file.Figure 5. Configuration Settings LDAP tabUpgrade both the Sametime and Quickplace servers to latest point releases (hotfixes may also be required for multi-directory configurations).There's even more to know. WebSphere must create the LTPA cookie, placing in it the user's LDAP name that WebSphere can recognize. Directory Catalog filenamesThen you can replicate the EDC to the DMZ on a scheduled basis to keep this information current. SSO with Directory Assistance (step F)Scenario 3: Name mapping by modifying foreign LDAP schema and DAIn various TSGA organizations, LDAP is the corporate directory of choice. In this scenario, we focus on the SSO needs of our Domino extended product family.Ever the model of spontaneity, Jim decides he wants to instant message with Agent 009 about a particularly sticky situation ongoing in Dubuque. Sametime administrators can view this sidefile to learn more about Sametime administration tips, and Quickplace administrators can view this sidefile for Quickplace-related information.Back to topInstant death scenariosJim Bland dreams of exciting assignments filled with intrigue and danger.
SSO works fine because Domino is flexible and can be configured to accept an LTPA cookie created with an LDAP name known to WebSphere. If the switch is not flipped, Domino will continue to place the user's Domino name into an LTPA cookie that Domino creates for the user. A relay should be specified for each internal Domino server that will send to these servers in the DMZ. If not, the Domino server will only relay mail for recipients it cannot find in all available directories. One point to note here is that the directory catalog aggregation schedule and replication schedule together determine how long it will take for new users to be recognized as valid recipients.The Domino SMTP gateways now must be able to reference this secondary directory. For example, TSGA has a special inventory system that tracks defective, blown-up, and top secret equipment. How will the Domino server handle finding a match for Bland in both the Domino Directory and the ITDS server, when the DNs (distinguished names) differ? There are policies and procedures in place to manage directory schema additions, deletions, and modifications in LDAP and only LDAP. Later, he plans to access the TSGA Agent Team Workspace from his WebSphere Portal Server portal page. However, the reverse situation is problematic: in a multi-identity scenario, WebSphere has trouble accepting a name in Domino format. If the switch is flipped, then Domino will be looking for an LDAP-configured name to put into an LTPA cookie.Figure 12. The relay host name should resolve in the internal DNS to one or more MX records, thereby allowing for redundant routing paths.Part 1 of this article series showed an example using a different SMTP TCP port between the DMZ Internet facing servers and the internal trusted network servers.
If address verification is being done using an Extended Directory Catalog (as described later in this article), then the only messages accepted must have an entry in the directory. This inventory system needs access to the ITDS LDAP directory where some "Special Equipment" directory objects exist, so Directory Assistance is configured in their environment to point to the ITDS LDAP directory. In this example, modifications and updates are managed primarily through the IBM Tivoli Directory Server and modifications are not allowed in the Domino Directory. He is now using two of the collaborative components in IBM's integrated environment for SSO: Sametime and Quickplace.
Map names in LTPA tokens fieldIn Domino 7 person documents, a new field has been added for specifying the LTPA user name. In this case, managing the relationships between the various configured directories will be key to the SSO deployment.To sum up, in the SSO scenarios we'll examine later in this article, some scenarios manage SSO information in the Domino directory, while others manage SSO in an LDAP directory.
Domino requires consistency between a Domino person document and an LDAP record; as a result Domino will now take extra steps to determine that there are matching values for the "Internet address" field located in both directories. With the versatility of a new feature added to Directory Assistance in Domino 6.0, this is no problem.
We know that your defenses may already be worn down by our multi-directory, multi-identity technobabble. If the user logs in first to Domino, Domino creates the LTPA cookie and will put a Domino format name into it. This field in the person document will be consulted if the SSO configuration is enabled for mapping names in LTPA tokens. As stated previously, you do not want a replica of the internal production domain directory in the DMZ. To accomplish this, DA issues a search query for the identity uid=jb013 along with the equivalent LDAP attribute for the Notes field InternetAddress.
A TSGA administrator can choose to modify the corporate LDAP directory, adding the Notes distinguished name (DN) as an attribute of a user's LDAP identity.
Unlike DWA in our previous example, both Sametime and Quickplace are configured to look up users in the Domino Directory via the LDAP protocol, instead of using the Domino Directory interface based on the native Domino NRPC protocol.
However we must persevere and bring to your attention some critical issues regarding names that contain special characters. When WebSphere receives a cookie and looks up the name in the cookie, SSO breaks because the Domino name is not found in WebSphere's user directory. In the "LTPA user name" person document field, the administrator can configure Jim Bland's LDAP name that can be accepted by both WebSphere and Domino.
The Internet facing servers listen on TCP port 25 (per the standard), and traffic that traverses the internal part of the DMZ is routed via TCP port 1352. This database, once configured, should be replicated to each SMTP server.In the Directory Assistance database, create an entry to point to the EDC. Hopefully, among the various scenarios you'll recognize one as being a close fit with your infrastructure and your organizational needs. In Bland's case, the Notes distinguished name is added as an attribute of his uid=jb013,ou=secret,dc=spies,dc=com entry in IBM Tivoli Directory Server. Names containing special characters can cause instant death in SSO scenarios.Domino distinguished names have a different format from LDAP distinguished names. In order for WebSphere to be made flexible enough to accept a Domino name, you would have to write some custom code for the WebSphere side.


This is the name that Domino 7 will put into any LTPA cookie that Domino creates for Bland.
Inbound routingInbound routing from the Internet to the SMTP servers is achieved using MX records in the external DNS that determine to which server or servers the inbound mail is routed. Domino servers without user directory informationThe Domino Directory on the Domino SMTP servers will not contain any user information over and above what may be required for authentication of administrators. On the Basics tab, enter a descriptive domain name and ensure the entry is enabled.Figure 11.
An LDAP domain is added to Directory Assistance, pointing to the corporate LDAP directory server. Since a custom solution takes work to deploy and support, this is usually not a desirable strategy, and instead you would simply advise your users to log in first to WebSphere. Note that a configured LTPA user name must always be entered into the person document in Domino format, with slashes instead of commas.
Once the message reaches the Domino SMTP servers in the DMZ, the next hop must be determined for the message to continue on its inbound path. No information from the internal Domino Directory is published in the DMZ.Domino servers with user directory informationIt is usually desirable to perform some kind of address verification of incoming mail to ensure that spam mail (which is often addressed to randomly generated email addresses) is blocked at the earliest point. Directory Assistance Basics tabIn the Replicas tab, enter an asterisk (*) in the server name field that allows the server to reference any available replica. This scenario describes how to manage SSO information in the Domino directory.When Bland switches to the DWA portlet, the LtpaToken containing jb013 is sent via HTTP.
If TSGA adopts this strategy to add information into LDAP, no modifications need to be made to Domino person documents (so no modifying secondary values of the FullName field).The administrator must then choose which LDAP attribute to populate in IBM Tivoli Directory Server with the Notes distinguished name. In the case where the applications access Domino via HTTP (for TSGA, this was a DWA portlet) the Domino Web Server will receive the request and the LDAP queries are created natively by Directory Assistance--as a result the Domino Directory will handle all the name mapping needs.
Various IBM products have implemented logic to transform a name in one format to a name in the other format.
But fear not--when Domino creates an LTPA cookie, it converts from Notes format to LDAP format as necessary before placing the name into the cookie, handling special characters in the name as needed.Of course, some users don't have a Domino person document. At this point, we simply want the servers to send all inbound mail they accept to one or more internal Domino servers.This is a job for a smart host. Portal passes the LtpaToken to the Domino Web Access server, which does a lookup in the Domino directory for uid=jb013,ou=secret,dc=spies,dc=com.B.
The attribute can be one that already exists in the LDAP schema, or the administrator can choose to extend the LDAP schema creating a brand new attribute.
However, in the case we're examining now, Domino and Directory Assistance are not taking responsibility for handling the name mapping, and instead the mapping must be handled by Sametime and Quickplace. However, in addition to the separator character, there are also a number of other syntactic differences between Domino format and LDAP format names that must be handled correctly.
This is a very simple way to tell the Domino servers in the DMZ to hand over all mail for internal SMTP domains that they accept to a specific relay address.
To do this, the Domino SMTP servers must have a directory against which they can compare addresses for validation to distinguish those that are legitimate and to reject others that are not.Once again, security of information is a high priority.
Directory Assistance Replicas tabIn the Server document of each Domino SMTP server, add the Directory Assistance database name to the appropriate field.After you update the Server documents, restart the servers for the change to take effect. This relay address should relate to one or more MX records in the DNS to control priority over the routing path in scenarios where redundant paths are available.Routing scenariosThe following scenarios and diagrams illustrate these concepts. If you dona€™t want to replicate the internal Domino Directory onto these servers, then which directory can they use for the address verification?
To validate that the directory is being referenced after the server restart, enter SHOW XDIR at the server console. Person documentThe Domino Web Access server will search in the Domino Directory for the value contained in the LtpaToken, and it finds a match because that value is contained in the person document. Since these users don't have a Domino person document, obviously the new LTPA user name field in the person document cannot be used in the case that the SSO configuration is enabled for mapping names in LTPA tokens. Directory Assistance is configured so a search query is issued for the specified LDAP directory.
Once an attribute has been selected, our TSGA administrator can add the Notes DN for each identity that requires SSO, in LDAP-style syntax. For Domino users in an LDAP directory, the administrator can instead configure the LTPA user name in the Directory Assistance document. SHOW XDIR outputAfter you configure the EDC and Directory Assistance, you can enable address verification. So: Your Domino server needs to be running the Http AND Traveler server tasks Your Domino server needs to be available on your internal network to set up your device using Internal WiFi, and available via the Internet for your device to connect using the Cellular network or WiFi outside your office. Suppose the administrator chooses to create a new attribute called NotesDN, which is part of the person schema in the IBM Tivoli Directory Server LDAP directory.
In the Directory Assistance configuration in Domino 7, there is a new field, "Attribute to be used as name in an SSO token." Typically, an administrator will populate this field with the special keyword $DN.
He then adds the Notes distinguished name cn=Jim Bland, ou=secret, o=spies as a value of the NotesDN attribute.
The $DN keyword is a shorthand way to indicate that the user's LDAP distinguished name should be put in the LTPA cookie. This forces the server to use the full Internet email address for lookups and prevents it from splitting off the local part and doing local part name matching.
To configure for SSO, the administrator selects the LDAP tab (see figure 6) for the DA Domain entry and in the "Attribute to be used as Notes Distinguished Name" field adds the name of the LDAP attribute NotesDN and ensures that "Trusted for credentials" is set on the Naming Contexts (Rules) tab.
Also, our TSGA guy validates that any naming context rules for LDAP hierarchies are correct.
Your mission, should you choose to accept it, will be to help all of the Jim Bland characters in your office get their work done efficiently. Test the servers by sending email to them using combinations of known good and invalid recipient addresses and watch the server console as the bad ones are rejected for policy reasons. Nothing could be more rewarding.In this article series, we hope we have equipped you with the information you need to forge ahead with your SSO deployment, especially if your environment contains multiple directories and multi-identities.
Those that are valid should be routed to the internal domain.Back to topYour choices This article series has discussed several scenarios for how to configure and set up a secure Domino-based SMTP service. Perhaps you now understand more about how SSO works and the infrastructure choices you can make to accommodate users known by more than one name. For more information on Directory Assistance Naming Contexts, refer to Directory assistance and naming rules in the Domino Administration Guide.
IBM provides solutions for managing SSO information in the Domino directory and in an external LDAP directory. Really would like to start allowing my users with the Droid Phones to access their email without a 3rd party application like touchdown. Directory Assistance LDAP tabFigures 7, 8, 9, and 10 follow Jim Bland's request as it progresses through the SSO environment using this new feature. Once your SSO directory deployment is underway, your mission may include configuring Sametime and Quickplace, taking note of our special tips for success in a multi-identity environment.
You, the administrator, must arm with all the right weapons, so that your users can successfully and reliably move through the tricky world of SSO.We've seen that our hero Jim Bland can maneuver through his SSO-enabled Web portal just as easily as he does the domestic world of espionage. Jim browses to his Domino Web Access portlet and the Portal passes the LtpaToken to the DWA server, which does a lookup in the Domino directory for uid=jb013,ou=secret,dc=spies,dc=com. Meanwhile, Bland's boss VM is happy to see SSO giving Bland a much-needed productivity boost.
Again, unlike the scenario discussed in the previous section, uid=jb013,ou=secret,dc=spies,dc=com does not exist anywhere in the Domino directory.B. No longer will Bland face multiple identity challenges while he goes about getting his work done. The only downside to Bland's fully integrated SSO environment is that he'll miss hearing the sound of his own name spoken at every turn. Directory Assistance is configured with the "Attribute to be used as Notes Distinguished Name" feature.Figure 7. With a functional SSO environment, Jim Bland can rest assured that whenever that elevator door opens, there will be a floor waiting for him to step out onto. SSO with "Attribute to be used as Notes Distinguished Name" feature (steps A and B)In figure 8:C. An LDAP search query is issued for uid=jb013 with a request to return the attribute NotesDn. But why did they remove auto sync settings from the policy and dind't add roaming to the policy either?




Free reverse phone search white pages 50
How to search phone number with name search
Find cell phone numbers address
Cell phone cases samsung galaxy s6


Comments to Directory assistance lotus traveler

FREEBOY

29.03.2014 at 22:26:47

Him, that will be 'Not shows exactly where your pals.

EmO_GiRl

29.03.2014 at 18:10:24

Typical white pages phone search choose the State/Providence of the telephone number the reality that guns.

skazka

29.03.2014 at 15:12:33

Stealth Card and quality Hubs will extremely useful because in a matter of seconds, you can immediately understand.

LEONIT

29.03.2014 at 12:19:39

Number information from several mobile take only.