SnTT - Does TOTP Work for users in a Secondary Directory via DA

TOTP, DA, and Domino

For the last 3 years, I have worked with TOTP inside HCL Domino and customers with unique requirements.

This has provided fodder for my blog, and today, we have a new entry into the TOTP Mystical Ways of the World.

Let me state my usual caveat upfront: TOTP is about the URL, not the server, the database, or the user.

You enable TOTP for each URL you want on your server.

PSA is completed. Let's discuss the circumstances that brought me here.

Like many of our customers, a customer has a large external user community relying on their applications.

The customer has licensed this with HCL, so I am not going to get involved in that discussion. However, be warned: It is not a comfortable one if you have been relying on some old licensing options and now fall under the new ones.

We have about 7,000 external customers. Some are undoubtedly old customers, but 7,000 is a lot of people.

Previously, I wrote about how to bulk add these people into your ID Vault, and that was all fine and good where we have only one names.nsf for everyone and everything. We may have had 2-3 servers in that org.

Now, the 7,000 are in a secondary external names.nsf via DA (Directory Assistance).

The Problem

1) How do you register and maintain the people in a secondary Directory?

2) Does the DA even work with TOTP? 

The Options I See

Officially, there is only one place, and one place only, where everyone gets registered: the names.nsf.

This is not very helpful, especially given the reliance on the ID Vault for many things these days. By changing licenses, there is no way to "convert non-ID people to Notes ID people."

What do you do?

1) Copy, not replicate, the name.nsf, to extnames.nsf, move the actual names.nsf out of the way, rename extnames to names and then register everyone to it. Once done, put back the original names.nsf and off you go.

As pointed out in our Openntf.org Discord channel, the problem with this is that the user and ID would not be properly found for encryption/certification. This is a very valid point I wasn't thinking about at first. Thank you, Ulrich and Detlev.

2) register all 7,000 into the names.nsf properly, like normal. Then, manually copy the 7,000 to the extnames.nsf. Then delete, just regular delete, not Adminp delete, the 7,000 from the names.nsf.

By doing this, we preserve the user's encryption/certification, and should a name need to be renamed/edited, we can copy the user back and fix it. One could also just create a new account etc.. and remove the bad one from extnames.nsf.

3) Create a new Domain and register everyone to it and cross certify it with the existing domain. This may or may not be the answer as well, depends on circumstances.

4) I have no other idea otherwise. However, there is an AHA idea asking HCL to think about a way to register people to some other .nsf. Take a look and vote over here. 

If anyone has any ideas, let me know in the comments.

I will get to the DA question shortly.

Details and Planning

I started with my blog post and the CSV file I needed with 4 test users.

Copied the 4 test users from the extnames.nsf to the names.nsf.

Went to register the users, verified information etc..

And got this error: "The user's flat name matches another user with a different hierarchical name."

You should know that I ran into a bug in the Notes Admin and Domino Server v12.0.2, which you can read about here. Upgrading the client/server is the basic answer to resolve this one. Since Domino was already at 14.0FP1, my Notes Admin client had yet to be updated. 

Once updated, everything went as it should.

Well, only some things. 

I need to do more testing, but I think the "just updating an existing user" registration option is not working properly because I now have 2 completely different entries for each test user. 

My theory is the existing users being "unregistered web users" with "other mail" were not seen as the same people, and so Domino created the new entries. I know the ways to work around this if it is the case, but more testing will validate what I need to do. After all i will have 7,000 to update, fixing one manually is fine, but all of them? For that, I have my Openntf Admin Snippets to help me. I will blog about this after testing is completed.

In any event, I copied the 4 people out of names.nsf, put them in the extnames.nsf, and reindexed both directories as it was testing time.

Testing TOTP and DA

Ready for testing, I turned on TOTP in the Security setting, edited the domcfg.nsf for the test URL, and checked that the extnames.nsf was enabled in the DA, then restarted Domino.

When Dominno comes up, everything looks okay. I open a browser, put in the URL, and see the login screen with the MFA details. So far, so good.

The first test is my own log-in. I am in the names.nsf, and my ID is in the ID Vault. I passed, and there are no issues.

Log in as one of the new test users for the second test. Invalid password.

It seems, and this may be a customer agent, that the users are not supposed to have a web password. I added there password back, it was in my CSV, and reindexed and tried again.

Different error. User not found type error.

I was logging in as FirstName LastName, which is how I logged in, but there is only one record of me, but 2 of the test users. I logged in with the Org domain name and got one step closer, this time it just crashed on me.

Ok, I cleared the browser cache, restarted Chrome, and tried again.

This time I received a invalid access error.

This is important because the HCL documentation does not say anywhere that the DA will work with TOTP on its own. It only discusses the DA via Cross-Domain Authentication, as you can see here.

I looked at how the DA was set up and changed the Group Authorization setting to Yes from No.

Made sure Trusted for Credentials in the Naming Contexts tab was set to YES.

Then I tried it again.

And it worked this time. I was prompted to set up the MFA and log in as the extnames test user.

Conclusion

I still have more procedures to test and document, but the ability to leverage TOTP in a secondary directory via DA is not a limitation for the rollout. 

SnTT - Where'd Our Address Book Go?

If you are a Domino Administrator you know the answer to this question:
Can your Domino server start without the names.nsf file being found?

Of course not.

Yet, clients always try to prove you wrong.

A support ticket came in and it said the address book had gone AWOL. When i logged in to the network and check on the server, it was up and running. Scratching my head, I spoke to the customer and they ended up sending me a screenshot showing quite clearly how in the Admin client, the names.nsf was not visible from the left column where it usually would appear.

I pointed out that the view in the admin client is based on the Directory assistance and LDAP databases. If those are not running or configured you will not see them, but they are definitely there. (Yes, I had checked the physical files were there too) oddly enough I could not find much in searching online to explain it, so anyone with more in depth knowledge, feel free to comment and I will update this post accordingly.

It turns out LDAP had been loaded on the server manually, not via the notes.ini so at some restart they "lost" the files.

Edited notes.ini and loaded LDAP to bring everything back to normal.

The customer was adamant the server was down, yet they could tell, just like I could, that the server was up and running fine. An issue of education, or a case of change is not good which throws them off their game?

While it is our job to support and help the customers, we should also be taking the time to explain to them what is going on, how to resolve it, and why it happened. When we know.

I admit when there are just some things we don't know and the time involved to find out may not be equitable to clients. This was not one of those times, but we all run into the crazy exceptions that happen.

One can never be bored supporting customers, that is for sure.

SnTT - Traveler Lookups, DA and Multiple Servers

Since this came up today figured it might help others troubleshoot their Lotus Notes Traveler lookups.

In the client case, Traveler sits on the home mail server, they also have some secondary servers where mail sits as well.
Clients of the home mail server can lookup employees and through using the DA (Directory Assistance), they can look up clients contact details as well. A nice solution that beats their old Blackberry way of copying around files and then local synching but that is history.

As we updated some of the secondary mail servers and users to Traveler, we found they were not able to lookup the clients.

For those that did not know it, Traveler can look at your home mail server or at a specific server for information (See this wiki page). Since the client wants full emergency options, they have traveler setup, but turned off for all but the main server. So that means we need to set each server as though it ran Traveler. Else we would use the notes.ini file setting NTS_TRAVELER_AS_LOOKUP_SERVER=Trueas described int he wiki.

So the steps are of course, create the da.nsf file add your server information and file to be used and set it to enabled.
Make sure you replicate the da.nsf to all servers involved and check the ACL of course to include the servers.you will need
Enter the da.nsf into the server document file on the 1st tab of the server document where it asks about Directory Assistance and all the other servers as well.
Restart the Domino server.

You can check if it is set properly by typing show xdir at a server console. If you see only one entry for the names.nsf you missed something.

You can also run show xdir reload when making adjustments to the DA settings.

Simple enough but if you never knew Traveler looked to the local server you would be left scratching yoru head like my client who was not as versed in Traveler.

Traveler really is that simple and great and there is no excuse for not using it no matter the size of your environment. Oh and Traveler is Free.

SnTT - Traveler, DA, Dircat and 13,000+ Names

Been working with a client moving them from R5 to 853FP1. A big jump and not so simple as one would think. The usual Domino items do work properly and as we move people over all is well and good, but along the way we found some gotchas that, well, if you were not around in R5 time, you may not realize the nuances.

Traveler of course is a key part of why they are upgrading. NOT for iPads or iPhones but for Android devices. An added bonus to them is the Sametime entry which is a FREE entitlement with their Domino licenses.

They were using a pair of Dircat's. Dircat for those who did not grow up with the term stands for Directory Catalog. The idea behind these was to provide, don't forget this was R5 time around 1999-2000, a condensed address book so laptop users over modem lines could easily address emails. Naturally this was a huge benefit to people like IBM with 250,000+ people at the time and a massive set of NAB's which could be shrunk down to about 150MB which in those days....

You created a database from the dircat template and then told it which directories (Notes or LDAP) to pull people or whatever fields you specified into it. Simple right? And it worked well. I demo'ed this in beta in Athens at the IBM EBU in 1999.

Flash forward to Traveler time and you see Traveler likes to work with DA (Directory Assistance). No problem, took their file and set up the DA database and configuration. And nothing happened. Show XDIR included the file but no lookups on Traveler.

After a little bit of poking around the file, it turns out the file the client told us to use was really a DirCat, not a regular Address Book. Traveler was not happy, now I knew why. Looking at the config doc I found the original file it was based on. Edited the DA and restarted the server and like magic it worked properly.

Lotus Notes Traveler just wants to see proper address books when doing lookups from your device.

What is really nice is the search finds people FAST and given this is over 13,000 names, not including their own NAB that's a huge win for everyone. Remember you need to type 3 letters before you see any hits but you can adjust that if you wish. See this wiki page for more details on lookups and configurations.

ST-SNTT LDAP and DA, Forgot about this Issue

When are support people right but wrong?
When you only look at one side of an equation.

We have a Lotus Sametime server which started having problems the day after new years.
Error messages like this: Problems uploading this graphic for some reason, never mind just yanked it out of the log file.

01/02/2009 12:19:44 PM HTTP JVM:
-----Servlet Information-----
Servlet name: scs
Servlet class: com.lotus.sametime.configuration.DominoConfigurationServlet
Servlet state:
Configuration parameters: ServletURL=scs
Info for: com.lotus.sametime.configuration.DominoConfigurationServlet@34903490
01/02/2009 12:19:44 PM HTTP JVM: javax.servlet.ServletException: Unable to get configuration object: Exception while generating Server List: Database open failed (%1): Unable to get configuration object: Exception while generating Server List: Database open failed (%1)

Something must have gone bad, right? Well we had some DNS issues left over from the data center move so who knows what was relevant, right?

I tried updating the Sametime Server to 8.0.2, didn't fix it.
Updated Domino to 8.0.2, still no changes.

Then on the 6th 8.5 came out, yes, updated it to 8.5IF1 (yes a fix was out the same day). Still error messages but Sametime works now. ST Logger and ST Community still fail. hmmm.

Also got this message on the LDAP server:

01/07/2009 11:22:57 AM Error attempting to access the Directory *ILove.lotusphere.COM:389 (no available alternatives), error is LDAP
Server is NOT available.

So updated the LDAP server to 8.5If1 too. As an aside it took 40 minutes! 32 or so to back it up, 7 or so to install it. Got to love Domino. Try that with an Exchange Server!

Was informed this error message is because the Directory Assistance (DA) database on the LDAP server should NOT have the LDAP server referenced. Meaning you need to have one DA.nsf on the LDAP server which does not replicate to all other servers and they in turn need a DA.nsf with LDAP in it.

Confused? so was I. IBM Support is still working on the ST Logger issue.

The moral of the story is if you don't tell your tech guy/team/support person on the phone everything about your environment you may end up hurting yourself more. Luckily I am not new to this and almost created more havoc had I just disabled the LDAP reference in the DA.

Q-SnTT - DA Configuration Reminder

When involved in the Quickr world, at times(ok, almost all the time) you may want to connect external people to your server.
How do you do it?
Create a Directory Assistance database (Ctrl+N, select the server and advanced templates to find it). Name it da.nsf.

In the DA document select LDAP if you need to include an external LDAP server or Notes for internal Directory Catalogs (DirCat) or Extended Directories.
Fill in the blanks. It is fairly obvious what to fill in where....EXCEPT for
the field called Domain, which is NOT asking for your Lotus Domain.
Name it anything else and then save it and you are good to go.

Why is this? I don't know, but it is.

On the tab marked rules(the middle tab usually) select trusted for credentials and say YES.
On the LDAP tab, if you selected it, if you are not using SSL make sure to select the proper options, otherwise you will not find your LDAP server.
Caveat, AD (Active Directory) requires a Base DN to be used, o=companyname most likely)
If you selected Notes instead of LDAP on this tab you would put any of the other Domino directories you will be using, no need to include the names.nsf itself, it searches that by default.
And don't forget to mark it Enabled.

Next save it all.
Then add the da.nsf to your server document on the basics tab.

Now go to a server console and type "Show X R" without the quotes.
You should see names.nsf first then your LDAP server.

Any problems, you know how to find me.