Download as ODP, PPTX
Uploaded byLuis Benitez
ID304 - Lotus® Connections 3.0 TDI, SSO, and User Life Cycle Management: What you NEED to know!
The document outlines security options and user life cycle management for IBM's Lotus Connections 3.0. It covers single sign-on (SSO) configurations using various protocols such as LTPA, SPNEGO, and Siteminder, along with troubleshooting tips and the integration of Tivoli Directory Integrator for profile synchronization. Additionally, it discusses the importance of maintaining data integrity and simplifying user management processes within the application.
More Related Content
Similar to ID304 - Lotus® Connections 3.0 TDI, SSO, and User Life Cycle Management: What you NEED to know!
ID304 - Lotus® Connections 3.0 TDI, SSO, and User Life Cycle Management: What you NEED to know!
- 1. ID304 Lotus®Connections 3.0 TDI, SSO, and User Life Cycle Management: What you NEED to know! Jay Boyd | Lotus Connections Team Lead | IBM Luis Benitez | Social Software Product Manager | IBM
- 2.
- 3.
- 4. Agenda Options forSecuring Lotus Connections
- 5.
- 6. New User LifeCycle Options in 3.0
- 7.
- 8. Not ideal security...Photo credit: http://www.flickr.com/photos/fboyd/2494909325/
- 9. Securing Lotus ConnectionsLotus Connections has tons of security options Virus Scanning
- 10.
- 11.
- 12.
- 13.
- 14. and... Photo credit:http://www.flickr.com/photos/juanpol/2704542/
- 15. Agenda Options forSecuring Lotus Connections
- 16.
- 17. New User LifeCycle Options in 3.0
- 18.
- 19. Single Sign OnMy favorite
- 20.
- 21. Great for adoptionPhoto credit: http://commons.wikimedia.org/wiki/File:Single_sign_on_aproaches.png
- 22. What's supported SSO … with Domino apps (of course!)
- 23. … with WebSphereapps (any doubt?)
- 24. … with QuickrJ/D (go go Gadget docs)
- 25. … with Sametime(duh!)
- 26. … via TivoliAccess Manager 6.1.1
- 27. … via CA'sSiteminder 6.0
- 28. … via SPNEGOPortlets are an exception :(
- 29. Single Sign On:Connections 3.0 Options SSO allows a user to authenticate once and then use other systems that are within the same authentication configuration without providing userid/password authentication subsequent times.
- 30.
- 31.
- 32. TAM (Form BasedAuth, Transparent Junctions, LTPA)
- 33.
- 34.
- 35. Except with LTPA,authentication is forced, there is no anonymous access
- 36. Cookies are keywith most SSO options (these are not your mother's Cookies) Cookies Textual information consisting of Name/Value pairs
- 37. Usually used toprovide State in an otherwise Stateless protocol (HTTP)
- 38. Domain and Pathdetermine when Cookies are included with an HTTP Request SPNEGO uses Security tokens in the HTTP Header with every request
- 39. Single Sign On:LTPA Lightweight Third-Party Authentication IBM proprietary, supported by IBM products such as WebSphere and Domino
- 40. Represented as Cookiescalled LtpaToken (older format, not on by default in WAS7, Domino requires version1) or LtpaToken2, value is encrypted UserID
- 41.
- 42. Authentication Expiration TimeImportant to use both of these if integrating with Domino and Portal
- 43. Single Sign On:Keys to successful LTPA Configuration All participating Servers: Same Authentication Realm (correlates to Cookie domain)
- 44.
- 45. Identical LDAP configuration(WAS Federated Repository)
- 46. Share the sameLTPA keys
Editor's Notes
- #7 Lotus Connections supports the Internet Content Adaptation Protocol (ICAP) and its applications use this protocol to communicate with virus detection products. Ensure that the virus detection product used in your enterprise supports the ICAP 1.0 protocol. Lotus Connections is certified to work with Symantec AntiVirus Scan Engine 5.1 and McAfee web Security Appliance (3400) and (3300). Lotus® Connections provides security measures, such as an active content filter and content upload limits, that you can use to mitigate the risk of malicious attacks. Because these security measures can also limit the flexibility of the applications, you, as the system administrator, must evaluate the security of your network and determine whether or not you need to implement them. Any software that displays user authored content can be vulnerable to cross-site scripting (XSS) attacks. Attackers can introduce JavaScript™ into their content that can, among other things, steal a user's session. Session stealing in a single sign-on (SSO) environment poses particular challenges because any vulnerability to XSS attacks can render the entire single sign-on domain vulnerable.
- #10 SPNEGO = Simple and Protected Negotiation Portlets don't support SSO via TAM/Siteminder/SPNEGO – they require LTPA
- #21 Import the LTPA key and password from TAM and Import into WebSphere and set the SSO domain name Do not use TAM components as a caching proxy, configuration complexity is very high Lotus Connections only supports WebSeal Transparent Junction configuration Configure TAM for URL rewriting in XML and Javascript content TAM configuration setting 'use-same-session = yes' is required
- #37 A TDI assembly line is made up of components (connectors, flow controls, loops, branches) that collect data from your source repositories and reformat it into the Profiles database. Supports two-way synchronization on LDAP attributes. Assembly line hooks are available for scripting and customization TDI should be used to initially populate Profiles and then frequently used to keep it in sync Connections release 3 allows you to mark a person as “inactive” when they aren't found in LDAP
- #40 SyncAllMembersByExtId() takes several parameters indicating how a mismatch can be resolved (either by a matching email address, login id or left for later manual resolution).
- #43 Use Batch commands, external ids are consistent across all applications. Investigate once, create batch script to update across all apps Returning users can be re-linked with their old data ProfilesService.swapUserAccessByUserId("oldUserId","newUserId")