Engage.UG 2022 - Domino TOTP/2FA - Best Practices and Pitfalls

#engage
#engageug
Ad12
Domino TOTP/2FA - Best Practices and Pitfalls
Martin Leyrer
Milan Matejic
Engage 2022

Copyright © 2022 HCL Technologies Limited | www.hcltechsw.com 2
Martin Leyrer
Martin Leyrer is a Senior Lab Services Consultant in HCL's Digital
Solutions Lab Services organizations since autumn 2019.
Before joining HCL, worked for eight years in IBM's Software
Group Services Organization, gaining in-depth knowledge on the
whole HCL Collaboration software stack.
Looking beyond the core HCL software stack, other areas of
expertise for Martin are Linux command line tools, IT
Security/Hacking, making stuff blink and combining all of these
areas.

Copyright © 2022 HCL Technologies Limited | www.hcltechsw.com
Milan Matejic
About us

Table of Contents
Motivation

Table of Contents
Motivation
Wording

Table of Contents
Motivation
Wording
How Does it Work?

Table of Contents
Motivation
Wording
How Does it Work?
Prerequisites

Table of Contents
Motivation
Wording
How Does it Work?
Prerequisites
Setup

Table of Contents
Motivation
Wording
How Does it Work?
Prerequisites
Setup
Traveler

Table of Contents
Motivation User Workflow
Wording
How Does it Work?
Prerequisites
Setup
Traveler

Table of Contents
Wording Administration
How Does it Work?
Prerequisites
Setup
Traveler

Table of Contents
How Does it Work? Troubleshooting
Prerequisites
Setup
Traveler

Table of Contents
Prerequisites Q & A
Setup
Traveler

Table of Contents
Prerequisites Q & A
Setup References
Traveler

Motivation

Roadmap
Prerequisites Q & A
Setup References
Traveler

MFA – Multi-factor authentication
Wording

2FA – Two-factor authentication
Wording

TOTP – Time-based one-time password
Wording

TOTP algorithm
Wording

Authentication server / verifier
Wording

Authy Google Authenticator Microsoft Authenticator
23
TOTP Authenticator / Prover
Wording

Scratch codes
Wording

Roadmap
Prerequisites Q & A
Setup References
Traveler

RFC 6238
Prover
Verifier
Shared Secret
Moving Factor
Timestep
How Does it Work?
4. Web server forwards TOTP
config to TOTP application
3. ID-Vault sends user s
TOTP config to web server
1. User configures TOTP
application
2. Web server sends the
information to ID-Vault

How Does it Work? – Prover Setup
4. Web server forwards TOTP
config to TOTP application
3. ID-Vault sends user s
TOTP config to web server
1. User configures TOTP
application
information to ID-Vault

How Does it Work? - Authentication
4. Web server grants
access
3. ID-Vault authenticates
the user
1. User enters
credentials and TOTP
TOTP to ID-Vault

Roadmap
Prerequisites Q & A
Setup References
Traveler

Time Sync
Prerequisites

DNS
Prerequisites

Public TLS Certificate
Domino Certificate Manager
Prerequisites

ID-Vault
Prerequisites

Certifier ID File
Inside of Domino Data
Prerequisites

HCL Domino 12.0
Incl. v12.0 Templates
Prerequisites

Roadmap
Prerequisites Q & A
Setup References
Traveler

37
MFA Trust Certificate
Enable TOTP Login Form
TOTP Configuration
Restart
Setup

Create MFA Trust Certificate
mfamgmt create trustcert <Notes_DN_to_allow>
<certifier_ID_file> <certifier_password>

Create MFA Trust Certificate Command

Check if MFA Trust Certificate is Created

Check MFA Trust Certificate and ID-Vault Trust

Enable TOTP - Configuration Document

Enable TOTP - Web Site Document

LTPA Token Expiration

Configure TOTP Login Form

Configure TOTP Login Form (cont.)
domcfg.nsf database

Configure TOTP Login Form (cont.)

Configure TOTP Login Form - $$LoginUserFormMFA

Secure Mail Operations for TOTP
Allow access to ID-Files with TOTP
Optional

Secure Mail Operations for TOTP (cont.)

Additional Security for ID-Vault
Restrict server access to ID-Vault
Optional

Additional Security for ID-Vault – Policy

Additional Security for ID-Vault – ID-Vault Conf.

Restart
Domino Server
HTTP Task

Demo – User Enables MFA

Roadmap
Prerequisites Q & A
Setup References
Traveler

Traveler & TOTP
Fully Supported
Additional settings needed

Traveler & TOTP – Verse App
Apple iOS
Google Android

Traveler & TOTP – Third Party Apps
Not Supported

Traveler & TOTP – Disabling TOTP
Reinstall / Reconfigure

Traveler & TOTP – Self-Signed Certificates
Possible!

Traveler & TOTP – MFA Setup
Must be done elsewhere!

Traveler TOTP Configuration
Identical as for Domino

Traveler TOTP Configuration – Security Policy

Traveler TOTP Configuration – Token Expiration
Token Expiration

Demo New Traveler User

Demo Existing Traveler User

Roadmap
Prerequisites Q & A
Setup References
Traveler

User Workflow
Add additional TOTP devices

Add Additional TOTP Devices

User Workflow
Delete TOTP devices

Delete TOTP Devices

User Workflow
Request new scratch codes

Request New Scratch Codes

Roadmap
Prerequisites Q & A
Setup References
Traveler

Administration
Check user’s configuration
TOTP Checker

Administration – TOTP Checker

Administration – TOTP Checker Linux - “Interim” Fix
SPR # SPPPCDFF4W
Contact Support

Administration – Check User’s ID-Vault Document
Check user’s ID-Vault document

Administration – Check User’s ID-Vault Document

Administration – Reset TOTP Config
Reset user’s TOTP configuration

Administration – Reset TOTP Config

TOTP_STEPSIZE=seconds
TOTP_TIMESKEW_STEPS=TOTP_STEPSIZE factor
ENABLE_IDV_CROSSDOMAIN_AUTHENTICATION=1
Administration - Important notes.ini Settings

Roadmap
Prerequisites Q & A
Setup References
Traveler

Troubleshooting
Check configuration

Troubleshooting
Run “TOTP Configuration Check”

Troubleshooting

Troubleshooting
Collect Fiddler trace

Troubleshooting
Set debug in notes.ini

DEBUG_IDV_CONNECT=1
DEBUG_IDV_API=1
DEBUG_IDVAULT_SERVER_SELECTION=1
iNotes_WA_DebugSecMailNotesID=1
DEBUG_INETPWD_CHECK=1
WEBAUTH_VERBOSE_TRACE=1
Troubleshooting - Debug Parameters

DEBUG_TOTP=2
DEBUG_IDV_TOTP_TRANS=1
Troubleshooting - Debug Parameters (cont.)

Roadmap
Prerequisites Q & A
Setup References
Traveler

Q & A
Does TOTP work offline!?
YES!

Q & A
TOTP code same on every device!?
No!

Evolve, disrupt. Together…
Further questions?

TOTP algorithm definition
https://datatracker.ietf.org/doc/html/rfc6238
OTP, TOTP and HOTP
https://www.onelogin.com/learn/otp-totp-hotp
Domino TOTP
https://help.hcltechsw.com/domino/12.0.0/admin/conf_totp_overview.html
References

Traveler TOTP
https://help.hcltechsw.com/traveler/12.0.0/mobile_support_totp.html
Statista
https://www.statista.com/statistics/1305250/reasons-for-not-using-mfa-us-uk/
References

Engage.UG 2022 - Domino TOTP/2FA - Best Practices and Pitfalls

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Engage.UG 2022 - Domino TOTP/2FA - Best Practices and Pitfalls

Similar to Engage.UG 2022 - Domino TOTP/2FA - Best Practices and Pitfalls (20)

Recently uploaded

Recently uploaded (20)

Engage.UG 2022 - Domino TOTP/2FA - Best Practices and Pitfalls