even though thsi code is picking up the ltpatoken cookie, its still only recognising me as anon, teh security.xml seems fine when i login and change the URL but the security.asp doesnt seem to be recieving the details.
usign domino 654 and iis on win 2000

29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Retrieved global static cache memory for config [LtpaToken].
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Decoding Websphere style Single Sign-On token (LTPA).
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Decrypt Websphere style Single Sign-On token (LTPA). Token length inval
id <54>.
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> ERROR: when decoding token [Single Sign-On token is invalid].
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> *** Retrieving Extra Token Info (SECTokenValidateAndGetTokenInfo) ***
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> ConfigName specified [LtpaToken].
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Retrieved global static cache memory for config [LtpaToken].
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Decoding Websphere style Single Sign-On token (LTPA).
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> Decrypt Websphere style Single Sign-On token (LTPA). Token length inval
id <54>.
29/11/2005 16:20:41.15 [0B04:000D-0A3C] SSO API> ERROR: when decoding token [Single Sign-On token is invalid].

I never really updated this as I have made changes because no one really showed any interest. This is maybe be an encoding issue with the cookie value. Are you using asp or asp.net? I will pull the latest version I am using if you let me know.
Steve

Thanks for the reply, wasnt expecting it to be honest!!
would really like the latest version if there is one, Its a really neat trick and i'm surprised there has been no interest!!
thanks for your work, and i look forward to seeing a new version. meanwhile i am suspecting that the ltpaToken is getting chopped somewhere so i am investigating that. using standard .asp at the moment on a win2k server, but will more than likely be using in an asp.net environment eventually.
thanks again.
Mark

Steve,
added a line of code to the asp ( domToken=Replace(domtoken, " ", "+") ) to reconvert the spaces back to '+' for domino, and it suddenly started working!!! It seems Domino 6 was only reading the cookie up to the first space.
anyway, would love to see your new code, what have you changed ?

Mark,
Where in the security.asp should I insert, domToken=Replace(domtoken, " ", "+")?
I guess line 50?!
Is it possible to replace the source in the Code Bin?
Greetings,
Ferdinand

Hi there,
this is great.
Unfortunatly when i provide a valid username and password i get a 500 error code.
I use domino 5.0.1 & IIS 5.0
Can someone help.
Thanks

Sorry made a typo. I use domin 6.0.x
Thanks

Hello Jeff
I think your issue is probably what Mark pointed out, I added the line of code to the source. So download the zip file or update the URLDecode function at the bottom of the includes\security.asp file.
S
Function URLDecode(inString)
'URL decode Function
'2001 Antonin Foller, PSTRUH Software, http://www.pstruh.cz
Dim Pos, pPos, What
What = inString
'replace + To Space
'What = Replace(What, "+", " ")
'Do Not use it For data length over 100k
Pos = InStr(1, What, "%")
Do While Pos>0
What = Left(What, Pos-1) + _
Chr(Clng("&H" & Mid(What, Pos+1, 2))) + _
Mid(What, Pos+3)
Pos = InStr(Pos+1, What, "%")
Loop
' Mark G Brew 11/30/2005
' Convert spaces back to +
what = Replace(what, " ", "+")
URLDecode = What
End Function

Can this code works on IIS ? with single sign-on to Domino DWA7 mail ?

This code sample is meant to work with ASP I have a vb.net class that I am using in production in a number of places but I have not had time to put into a demo that you can have if that is what you are looking for. If you notes environment is using session based auth it should work.
Steve

Even w/o a demo, I'd love to get a copy of your vb.net code. Would get me that much closer to convincing mgmt of project viability.

Hey Brent
Post your email and I will send you something
Steve

Thanks Steve. I can be reached at bhawthorne@centexhomes.com

how to set that the IIS server will be able to see notes Domino cookie(ltpatoken cookie),Waiting for your response!

Hello Leaoner
In the address book, under configuration, web, web configuration, you will see a Web SSO Configurations document. Under the basics tab, there is a field DNS Domain. So if your
notes server: notes.company.com
IIS server: iis.company.com
set that field to .company.com.
Browsers will then submit the token on requests to your iis server.

3KS Steve,I 'll try it following your guidance.Thanks again!

Hey Leaoner
If you are using dot.net and not asp classic, post your email and I will send you the dot.net version.
s

Thanks you again,Steve, You 're so kind ,

would it be possible for you to send me the vb.net code as well? It would be greatly appreciated.
e-mail is Brian_Wiggins@hotmail.com

The asp.net code is in the code bin now

Hello There,
I'm trying the .NET version and I thank you for this great feature.
But i got some troubles because of extended chars (such as , , , etc ...) inside domino usernames. This makes the resolution of username inside iis part responding with errors (Beno�t_DE_BALINCOURT in place of Benot_DE_BALINCOURT for example). Do you know a way to solve it ?
Thanks a lot
Eric

Hi there,
I am able to validate the login credentials, but during call to get user aurhorization details i am not able to get the right xml, It is returning me the html code rather than user details, please some one help in this regard, I think there is something wrong in the url where i am posting http request. I am able to get ltpa token. Please help me it reaaaaaaaaaaalllllllllllly urgent.

<add key="AuthXMLCredentialsURL" value="http:/<<domino servername>>/names.nsf/credentials.xml?readform>
when i am using this url it says htto 404 , page can not found.as much i know there should be credentials.xml but i am afraid it is not there on my domino server.
Thanks a lot in advance

Ravi
<add key="AuthXMLCredentialsURL" value="http://domino.yourdomain.com/sso.nsf/credentials.xml?readform"/> is in the sso database not in the names.nsf.
Steve

HI Steven,
How are you doing. Well i came across the posting, however, I am not able to make it work @ all in my setup. Not sure what wrong is set @ my end and would really appreciate your valuable time to help me out.
I had used both asp and vb version but always stumble with blank page.
When using asp I am not able to capture the current session or token and VB version end up with blank page.
I am runing IIS V6 and Domino 6 and also teted on Domino 7. I am using Windows login (Security) of IIS server.
Will really appreciate if you can guide me step by step to setup either of the solution using VB or aps.
Once again thanks for all the help and time..
Looking forward to hear from u
SC

Hi Sagun
You have to turn off the windows login and use form based authentication.
Steve

i am using ADFS login and want to do a SSO with Domino notes 6.5
Can you send me the .NET or C# code please.
my email address is goddy_g@hotmail.com
Thanks
GG

I found your project and this website last week when I was searching for an SSO solution for our company. This is probably the simplest solution ( and the preferred solution) that I have found so far.
We already tested it on our test servers in the office and for the first time, we were able to demonstrate a working model of Web SSO.
Our programmers will probably need help on their projects in the days to come.

Our company is really interested in your SSO project. How can we get more information?
We are also willing to help you continue and improve the project.
My e-mail address is emergc@gmail.com. Thank you.

Hi Steve,
Greetings!
We are currently evaluating different kinds of SSO solutions. We found that your SSO solution is not so hard to implement. However, we have some problems with regard to implementation. We don't know how to extract the openntf.dll so we can fit it in our web portal project. We are currenlty integrating applications on IIS and Domino servers. Please help us to understand the opnentf.dll file and its functionalities.
I hope to hear from you soon.
Thanks
Au

I've been testing your code cause at my company we want to move from Domino to Asp.NET
But we don't want to change everything immediately, so we would like that the customers could authenticate in the Asp.NET server and still go to the already existing Domino Forms (attached to domino users accounts)
I'm an Asp.NET developper so I don't know very much about Domino. Basically, I asked my collegues to install your sso.nsf Lotus Base in one of our test Domino Server (version 8.5.1) and added a user to ACL as "Manager"
In debug I can see that the requests works fine since I get the LptaToken cookie, with the cookieValue and all the others parameters.
What I cannot see is, where do you use the AuthorizationCookie? I see that you use the Cookie value for the authorization but that's all. It returns me Fullname as anonymous but the Manager role is there.
And after the FormsAuthorizationTicket is encrypted in the cookie, I try to go to a lotus form in the domino web server but it doesn't recognizes me as an authenticated user.
What am I missing? Help me please.
Olivier Voutat

The ACL on the notes database should be set to have "Anonymous" access set to No Access.
In the web config,
- the authorization node says to allow only authenticated users.
- the authentication node sets the mode to forms based auth and allows non authenticated users to the userLogin.aspx page.
While debugging userLogin.aspx.vb, do you reach the call to the function GenerateAuthTicket? Does objUser.FullName have a value?
Steve

Hi Steve,
Thank you for responding so quickly. Here is my authentication and authorization web.config part.
<authentication mode="Forms">
<forms name=".ESPACE" loginUrl="~/Account/Login.aspx" protection="All" timeout="30">
</forms>
</authentication>
<authorization>
<deny users="?" />
<allow users="*" />
</authorization>
I do reach the GenerateAuthTicket part, but the Fullname has only the name Anonymous. But the roles get the Manager role.

Hi Olivier
Post your email and we can talk about it over IM.
Steve

I read in some places that if I want this to work, the Domino Server and the Asp.NET server should be on the same machine?!
http://www.proposion.com/n2nhelp.nsf/769e1b028f863f84852566c100358467/9ed72ebf77225e0f85256c67007c3c8f!OpenDocument&AutoFramed

I'm sorry, we can't. All IM are blocked at my company

So after you login to notes you are redirected back to userlogin.aspx, at the line
securityCookieValue = Request.Cookies(auth.CookieName).Value
do securityCookieValue has a value?
If so in the function
Public Function Authorize(ByVal securityCookie As String) As Boolean
look at the code
authResponse = authRequest.GetResponse()
streamReader = New System.IO.StreamReader(authResponse.GetResponseStream())
' Read The Results into an xml document
Dim document As New XmlDocument
document.Load(streamReader)
streamReader.Close()
authResponse.Close()
Inspect the document variable and see what the content is? Does it look like your notes login page or is there valid xml in there?

Hi Steve,
Yes, it has a value {LtpaToken=AAECAzRDM0FBREJCNEMzQUI0QzMxMDAwMTA5iE8HbM9AEp9yL7sXco7BbRVC58U=}
and I get an xml
<?xml version=\"1.0\"?><security><acl>2</acl><fullname>Anonymous</fullname><commonname>Anonymous</commonname><groups><group>*</group></groups><roles><role>Manager</role></roles></security>
I read in some places that the Asp.NET server should be in the same server but on a different port. Is it that true? Or should I install on a server that has the same domain as the authentication domino server. Example: http://domino.myserver.com & http://aspnet.myserver.com

You do not have to have IIS and Domino installed on the same server as long as the realm of the domino cookie will allow for the browser to submit the ticket when making requests to the IIS server. So if the ticket realm is myserver.com and your IIS server is aspnet.myserver.com, the browser will submit the cookie when making requests.
With a browser, go to the value specified in "AuthXMLLoginURL" in the web config, it should ask you to login. Login, then go to the url specified in "AuthXMLCredentialsURL", do you get xml for a non anonymous user then?

I sincerely don't know how they setup these Domino Servers (Gladly they are Test Servers). Using the AuthXMLLoginURL to authenticate, the XML works. It is not Anonymous.
_
I will try to explain a little bit how the Domino Servers are configured:
_
The AuthXMLAuthenticateURL is like, per example:
http://mytestserver.company.ch/names.nsf?Login
_
The AuthXMLCredentialsURL is like
http://othertestserver.company.ch/tests/rochat/sso.nsf/credentials.xml?readform
_
but mytestserver is a mapping for othertestserver.
_
But if I type
http://othertestserver.company.ch/names.nsf?Login
I don't get any page
_
I will look with our Domino Administrator to see if that can interfere and how.

Extra info, using the AuthXMLLoginURL to authenticate, the XML returns the users data, but the AuthXMLAuthenticateURL shows me the login page, as if it was not authenticate.

The xml was returning me the non anonymous data. I still got it once this morning. But now, I only get anonymous xml's.

Sorry, have a lot of different stuff to do so I put this on waiting for sometime.
Was checking one thing a I got a little surprised.
After logging at (using Internet Explorer)
http://testserver/tests/rochat/sso.nsf/web?openagent&login&redirectto=http://myothersite.com
if I try to get the xml in the same tab
http://testserver/tests/rochat/sso.nsf/credentials.xml?readform
I get the client data. But if I do it in another tab of the same browser, it returns me anonymous.
In Firefox, no problem, I can logging in one tab and get the XML information in another one.
Have you ever seen this?

But if I login using the login page in one tab, and I open it in another tab again, I'm recognized as logged in.

Just confirming an information about your last message:
-
If my domino server is
http://mydomino.mydomain.com
-
my IIS server should be
http://iiserver.mydomain.com
-
so my cookie can be used?
Ok, that's already a partial answer why it will not work after I discover why the login page doesn't work for the credentials XML because actually I have this:
-
My domino server is
http://mydomino.mydomain.com
-
my IIS server is
http://iiserver.otherdomain.com

The browser will resubmit the token regardless of you being in a seperate tag. The thing you have to realize is during authentication from the IIS will reach out to your Notes servers using the token so the IIS server needs to have access to it but it won't if the browser does not see it in the same domain. To verify you have everything working and can understand it, run Visual Studio on your desktop. Put a hostname entry in your localhost file pointing to iisserver.otherdomain.com. Now the browser will see it in the same domain as the notes server and submit the token.
From there you would have a couple options if you are not going to change machine domain names
1. Something like http://www.15seconds.com/issue/971108.htm
2. Pass the token in the query string from you notes login.

Login to add your comment