Completing Domino prerequisites for SAML
Complete the following Domino configuration that is required by SAML.
Directory name mapping (ADFS only)
If user addresses in the Active Directory mail attribute are identical to
addresses in the Internet Address field in Domino directory Person documents,
no additional directory configuration is required. If not, you must add the Notes distinguished name
to an Active Directory attribute such as altSecurityIdentities. Then, configure
directory assistance to use that attribute to map Domino names to names in Active Directory. For
more information, see Using Notes distinguished names in a remote LDAP directory.
Single Sign-on
If users will access more than one Domino server or WebSphere and Domino servers, single sign-on is required. Configure single sign-on and test that it works before configuring SAML authentication. Using multi-server session authentication rather than single-server session authentication is a best practice. For more information, see Multi-server session-based authentication (single sign-on).
SSL certificate
ID Vault
For Web federated login or Notes federated login, an ID vault must be set up and participating users must have IDs in the vault. Ensure that users are assigned to a vault through Security policy settings. For more information, see Assigning users to a vault.
Be sure to enable iNotes to use the vault. To see whether an iNotes user’s ID file is uploaded to the vault, a vault administrator can open the ID vault application and check for the user's name in the Vault Users view. For more information, see Enabling programs that store IDs in databases to use a vault.
Security settings
- Disable the field Enforce Internet Password Lockout on the Security tab of the server Configuration document.
- Disable any Web password management settings, such as synchronizing the Notes® client password with the Internet password, that are enabled in security policies that are assigned to SAML users.
Domino Web server testing (Recommended)
Because SAML configuration requires cooperating configuration for Domino® and for the identity provider (IdP), Domino® Web server configuration should first be fundamentally sound when being used independently of an IdP. Therefore, before configuring SAML, consider setting up the Domino® HTTP server for single-server session authentication. This task includes configuring Domino® to log in as a Web user (for example, the Domino® administrator that has been configured in the Domino® Directory during the Domino® server setup). After you as this administrator are able to log in as the Domino® user, successfully browsing to URLs on the Domino® server, the server is ready for SAML configuration and enablement.