How to Enable, or Disable, TOTP for HCL Traveler and Verse

 After a discussion with fellow HCL Ambassador David Hablewitz, I realized I did not fully explain the HCL Traveler/Verse (will just refer to it as Verse) and TOTP  issue in my blog post the other day, 

I intended to explain the pros and cons of using TOTP and Verse, but I neglected to explain how to enable or disable TOTP and what you do if you have one server or separate servers.

The how-to is what this post is about.

It is pretty easy to do in a proper environment where Verse sits on its own server.

You probably see something similar to this in your Internet Sites for the Verse server (ignore the 404 error page I was testing):

If you double-click on the head item on the Web Site, you will see where you turn TOTP on or off. I am presuming you have set TOTP up already. The option is there because of the names.ntf template changes in R12 and R12.0.1.

If you don't want TOTP, change the selected option to "Yes" instead of "Yes with TOTP."

Simple, right? 

What if you are a smaller organization that relies on one Domino server to do anything and everything? What if you don't want Verse to have TOTP, but access to applications, or mail, should have TOTP?

My suggestion from a security perspective is to create a new URL for Verse. It is easier, under R12, for you to create a unique URL for your domain and get a Let's Encrypt SSL certificate for it for free.

Sidenote: I understand that you could leave it set up as it is above and turn TOTP off for the default website. You may do this because you don't want to field tons of help desk calls from users who can't change a URL, but this route would leave your whole server in a less secure mode.

Decide on the new URL, traveler.company.com.Set it up in your internal and outside DNS.

Create the new Internet Site document for the unique domain. It may look something like this:

Don't forget to edit your Traveler URL section of the server document to accommodate this change.

And now you can restart HTTP and Traveler, and you should get prompted for TOTP at your domain, but not with Verse once outside DNS changes go into effect. So I suggest you set it up and wait till the exterior works, then cutover internally.

You will need to create all the docs, so it looks like this:

And users may have to reinstall Verse to change the URL.

Once set up, you can turn on TOTP for Verse down the road if you wish. This also lets you move the Verse server easier in the future because it is no longer tied to your server, just the URL.

SnTT - Why is my Domino Web Server Unavailable?

Bet you wonder about that too sometimes?

In the course of working on my MWLUG slides on my demo server on my netbook had this problem. Keep in mind, none of us would EVER do this in production, right?

Odd, it worked yesterday. Hmm.

After some trial and error I found that there is a little fact about Skype which I must have overlooked when configuring it or maybe one of the updates wrote over my settings.

Either way, if you go to Tools-Options-Advanced-Connection in Skype you will see this:


Make sure this option is NOT checked and you will be good to go. Otherwise Skype takes over your HTTP port and well, disables your web server feeds from Domino.

Why is this important? Because some time you will be working on a server in a rack someplace without any connection to the outside and just "load" Skype to get some help or whatever because you want it or need it.

But you are smarter than that, aren't you?

SNTT - iNotes Mail Redirection in 8.5

Edited 9/2/2010: Login page edits can be found at this post.

Edited 12/21/2009: If you need more information for internet site documents and configuration see this post.

It's a NEW template and so full of help and documentation one doesn't even need to post about it.

RIGHT!

To be fair this is one of those things you love to use and set up once go away and then something breaks it and you have to do it all....over....again.....from.....memory.

Not totally true anymore. Webmail redirect has come a long way so to speak since the old Sandbox. Needless to say, if your environment looks like one of our clients, well, then this is for you.

Here is a link to the Domino Administrator help file which is online at IBM where it provides THE ONLY documentation for this utility(outside of the database itself, read on for more on this). Appropriately called "Using iNotes Redirect to access mail in Lotus iNotes".

If you read it, there seems to be nothing to it really.
1. Create an application using the "IBM Lotus iNotes Redirector"(IWAREDIR.NTF) template.
2. In the IBM® Lotus® Notes® client, open the application that you created.
3. Click Setup and follow the prompts(I didn't get any prompts) to set up iNotes Redirect.
I'll add a step 4, at the server console, tell HTTP Restart.

Hold on, not so fast, what about all these settings and options you say?
Let's do it one step at a time.
I will presume you know how to create a database by now.

1) You will see one button on the page, Click on Setup.
2) Now you will see 4 buttons like this:

3) Select server settings
4) Here the help offered is helpful, so use it if you need it. Select the Redirection type, I use dynamic and not a forced path in this case.
5) Choose SSL or not and debug or not.
6) Click on the UI setup button.
7) Enter the time to redirect in seconds. Why you ask...
8) What text do you want displayed while being redirected? So you can do a Public service announcement or have some fun with it like I do and tell them to relax and the server will be with you in a few seconds, please deposit 25 cents to continue.
9) You can also add a custom logo or color and enable the personal, login and cookie options as you so desire.
10) Click on ultralite/mobile settings and enable the ultralite button, it should already be populated with ipod(had no idea I could use it as a client)and iphone.
11) Now go to the application setup button and make the ACL changes as described.

And it.....didn't work for my client.

So what's wrong?

I get the Lotus Notes Traveler code home page. I love Traveler, but this shouldn't be coming up after I login.

OK, let's check the WEB settings in the Names.nsf.

Go to Configuration-Web-Internet Sites

I found a website for traveler on that server. Not unusual to have Traveler on the same server as one's mail, but Traveler appears to have taken over the default URL.

Open up the site, go to the Configuration tab and edit it.
The Home URL was populated with traveler/index.html.

Sorry, that will break iNotes redirection.

Copy this, or whatever you find there, over to the comments tab, as backup.

Now replace that with inotesredirector.nsf?open (please use whatever name you made the NSF when you created the database, BUT don't forget the ?open).

Try to log back in, it should work now. If not, run the tell http restart at the server console and try again. If that doesn't work, get a hold of me so we can fix it together.

As an extra benefit, don't forget you can redirect when people leave their email as well.

Using this notes.ini setting, iNotes_WA_LogoutRedirect=http://lotustech.blogspot.com you can send the person anyplace you want, I sent you to my blog if you cut and paste this.

As the help file says on this topic:

Use the NOTES.INI variable, iNotes_WA_LogoutRedirect, to specify a URL to redirect users to a Web page after logging out from server. The setting provides normal cache clearing with the IBM® Lotus® iNotes™ control, and clearing of browser credentials. This variable allows sites which have additional actions that need to happen on a logout (such as logging out of a reverse proxy server) to specify a URL to do this additional activity. Or you can use this variable to return people to an initial login page. The format for this settings is iNotes_WA_LogoutRedirect=URL. For example:

Worst Practices Submission for LS10

I know Bill and Paul are not doing this session at Lotusphere this year but here's an oldie but a goody and it still happens today, er I mean recently(last week).

When moving your data center you should always:

1) Let everyone know with enough time in advance when you will be moving so things like the VOIP phones and Email/Webmail will be down and not surprise everyone.
2) At the cut over date, remind everyone in and NOT in the office you are about to down the servers.
3) Shut down ALL servers appropriately.
4) Tag and label each box, cable, jack, port, router, monitor, keyboard, hub...just....in....case!

Yes, there are a million and one other things to add to the list.

Now let's look at what really happened:

1) We were told the move would be on a Thursday/Friday. No time specified.
2) Thursday came everything was fine, figured they decided Friday was better.
Went to lunch, came back, nothing was up any more.
3) We hope they shut everything down properly, AIX box was the last man standing, luckily they hadn't removed it's console monitor or keyboard, although the whole network was already in pieces so we could shut it down gracefully.
4) Primary Web Server AWOL, although perfectly accessible internally, not accessible externally. Took a few days for them to ask me to look into it, I pinged it and yes it was down, but up on the inside. Pinged it inside, wrong IP address. Checked the box.....they plugged the LAN cable in the wrong Ethernet port on the server. Swapped and amazingly all was well again. Amazingly Sametime suddenly worked again too.

So the next time you move servers or data centers just remember the time you put in upfront saves hours or days in the end.