Lotus Domino Security Source

The Domino Directory is an LDAP implementation shipped within any standard installation of Lotus Domino. It is activated by default but you can deactivate it for custom setups.

The Domino Directory security source inherits the generic LDAP security source behavior with a specific configuration.

This section describes the Domino Directory specific LDAP implementation:

This page discusses:

See Also
LDAP Overview
Configure an LDAP Security Source
OpenLDAP Security Source
Active Directory Security Source
Configure an LDAP Security Source

User Login

In the Domino Directory, the dominoPerson object class identifies persons. User login match is case insensitive. You can use several values for a valid user login:

Important: For Domino Directory, users can also log in using their full Lotus Notes DN. Write the DN in LDAP style, using comma separators. Specify enableDNlogin to true.

  • Attribute uid is the user short identifier.

  • Attribute mail is the user internet address.

  • Attribute cn is the common name.

Exalead CloudView tries to match the user login with these attributes in this order. There must be a unique match for the value on the Domino Directory server, otherwise, the login fails. The first step in the user login phase resolves the full user DN.

Authentication Using the Domino Directory

If you want to authenticate the Exalead CloudView user with the Domino Directory security source, set the internet password on the Domino Directory. On the Domino Directory, activate the option to copy the user password from notes.id into the internet password of the user.

If the Domino Directory security source is used for authentication, the password entered by the Exalead CloudView user is compared to the internet password for the user profile in Lotus Domino.

Display Name

The cn attribute of the Domino Directory builds the user display name.

Groups

In Domino Directory, the dominoGroup object class identifies groups. To compute the groups a user belongs to, the member attribute defines the group entries.

Security Tokens

For a given user, the Domino Directory generates security tokens based on the user DN and the group.

Security tokens can be generated from the user DN. The user DN (LDAP format) is CN=Jane Smith,CN=madvs001,DC=preprod. The following security tokens are generated.

  • notes:builtin:-Default-

  • notes:CN=Jane Smith/CN=madvs001/DC=preprod

  • notes:*/CN=madvs001/O=preprod

  • notes:*/O=preprod

  • notes:*

This automatic splitting on the user full DN is used for matching wildcard ACLs that could have been defined in the Lotus Notes databases that have been indexed. The separator , is replaced with / to match the security tokens that may have been set by the Lotus Notes connector.

Security tokens can be generated from groups to which the user belongs. The group DN (LDAP format) is CN=Users,CN=madvs001,DC=preprod. The following security tokens is generated.

  • notes:CN=Users/CN=madvs001/DC=preprod

Limitations

Below is the list of Lotus Notes security features that this security source does not support:

  • Handling of the security defined at the view level.

  • Handling of the security defined at the item level.

  • Handling of database ACL entries of type Unspecified. Only entries of type Person or Group are supported.

  • Sequential checking of the ACL entries in the following order - user, group, and wildcard - until a match is found thus granting the highest access level and allowing access privileges at the same level to be grouped. Exalead CloudView Search denies access to a database if there is an ACL entry match at any level with no read access.