Lotus Foundations Start Surfacing Domino on standard web ports Date: July 26, 2008 Author: Daniele Vistalli daniele@vistalli.it / daniele.vistalli@avnet.com

Better domino web access in LFS What's true today What we have today in LFS Domino 8.0.1 server in LFS Web is locked HTTP on port 60080, hard redirect to SSL HTTPS on 4443, not a standard port Web SSO can be enabled with Domino Administrator Portal 80/443 are locked for use by Apache only

What we have today in LFS

Domino 8.0.1 server in LFS

Web is locked

HTTP on port 60080, hard redirect to SSL

HTTPS on 4443, not a standard port

Web SSO can be enabled with Domino Administrator

Portal 80/443 are locked for use by Apache only

Better domino web access in LFS Possible issues ? (stuck in the tunnel) YES, I and Lotus Partners see troubles ahead No HTTP on port 80 means limited use for domino Web Content Managmenet business apps. The company website must run on port 80 HTTPS on 4443, proxy and firewall may block this. If I'm at a customer site I cannot get to my webmail since it runs on non-standard port Being forced to HTTPS makes bad user experience if I don't buy a “recognized” SSL certificate. Bad looking “untrusted certificate” for my website

YES, I and Lotus Partners see troubles ahead

No HTTP on port 80 means limited use for domino Web Content Managmenet business apps. The company website must run on port 80

HTTPS on 4443, proxy and firewall may block this. If I'm at a customer site I cannot get to my webmail since it runs on non-standard port

Being forced to HTTPS makes bad user experience if I don't buy a “recognized” SSL certificate. Bad looking “untrusted certificate” for my website

Better domino web access in LFS w hat to look for ? We should look forward to be able to do this: Have domino HTTP working (not just HTTPS) Have domino on port 80 alongside apache (details are coming) Have domino HTTPs on port 443 alongside apache. This can be done (I've done this on Linux, I assume it can be done on Foundations)

We should look forward to be able to do this:

Have domino HTTP working (not just HTTPS)

Have domino on port 80 alongside apache (details are coming)

Have domino HTTPs on port 443 alongside apache.

This can be done (I've done this on Linux, I assume it can be done on Foundations)

Better domino web access in LFS How to ? (the light at the end of the tunnel) The solution is to “reverse-proxy” into domino ports. Apache 2 can do that. In LF Core we already have Apache 2 and mod_proxy, we need mod_proxy_connect to support HTTPS reverse proxy (must be added to the stack) Apache 2 in LF core needs rules to decide when to reverse proxy to domino. Good candidates are *.nsf Domino standard directories residing in domino/data/domino (icons, cabs etc) Or maybe we can have a “domino” type of virtual host. Instead of a “team” we can map the virtual host to “domino” (this means any url gets to domino server instead of apache)

The solution is to “reverse-proxy” into domino ports.

Apache 2 can do that.

In LF Core we already have Apache 2 and mod_proxy, we need mod_proxy_connect to support HTTPS reverse proxy (must be added to the stack)

Apache 2 in LF core needs rules to decide when to reverse proxy to domino. Good candidates are

*.nsf

Domino standard directories residing in domino/data/domino (icons, cabs etc)

Or maybe we can have a “domino” type of virtual host. Instead of a “team” we can map the virtual host to “domino” (this means any url gets to domino server instead of apache)

Better domino web access in LFS What do you think ? Let's discuss These considerations were raised initally by me during the VADs enablement in italy (July 8,9 2008) On July 23 we did the first VARs enablement. Partners confirm that having domino on standard ports is critical if they have to package their applications (with web access) for deployment to LFS Non domino partners confirm that having webmail on a non-standard port is “bad” and may bring to problems. With the current LFS behaviour you can't even map this with fast/forward ports. Porta 80/443 is just locked, there's no way to avoid the issue I'm sure IBM as different ways to gather requirements. But if you think all this makes sense ... ping me back at daniele.vistalli@avnet.com or daniele@vistalli.it

These considerations were raised initally by me during the VADs enablement in italy (July 8,9 2008)

On July 23 we did the first VARs enablement.

Partners confirm that having domino on standard ports is critical if they have to package their applications (with web access) for deployment to LFS

Non domino partners confirm that having webmail on a non-standard port is “bad” and may bring to problems. With the current LFS behaviour you can't even map this with fast/forward ports. Porta 80/443 is just locked, there's no way to avoid the issue

I'm sure IBM as different ways to gather requirements. But if you think all this makes sense ... ping me back at daniele.vistalli@avnet.com or daniele@vistalli.it