Last week I had an issue that some Domino Server didn’t provide SSO through SPNEGO any longer (environment worked for over 2 years now). This environment uses the customized domcfg.nsf template of Andreas Artner, maybe it’s related, but I don’t think so, on Windows 7 with latest Internet Explorer 11 and Domino Servers 9.0.1 with latest fix pack.
So what happened? The Domino servers are placed in the “Local Intranet Zone” of IE through Group Policy from beginning. The Windows administrators started to enable “Enterprise Mode” for better handling of compatibility mode and one of the steps is to deactivate the “Display intranet sites in compatibility View” option.
After this, all sites which are not explicitly configured in “Enterprise Mode” are loading in “Edge Mode” and not longer in quirks mode.
Nearly everything worked fine, XPages load every HTML5 Element, the sites seem to deliver content faster and so on.
The configured SPNEGO authentication does not load any longer. The domcfg.nsf loads directly the fallback login form. I analyzed with Fiddler 4, but nothing suspicious was in the trace. So we configured one Domino Url to load in Quirks Mode (IE Level 5) and Desktop SSO worked immediately. So we played with the different levels and it showed that only the “Edge Mode” in IE11 made problems, when we went a step back and used the IE 10 compatibility mode everything worked: XPages, HTML5 and Desktop Single Sign-On.
I hope this saves you some time during troubleshooting, I think the Enterprise Mode is a trending thing and removing the Quirks Mode is an important step.
Some more points to my working configuration of Single Sign-On in Lotus Notes.
Automating configuration with plugin_customization.ini
I do a lot of software tests with my productive Notes Client (on Mac OS), so i often delete the Expeditor-folder in ~/Library/Application Support/Lotus Notes Data/. So i place configuration details in /Applications/Notes.app/Contents/MacOS/rcp/plugin_customization.ini, then the settings get automatically applied.
# Connections Config
# Sametime Config
com.ibm.collaboration.realtime.community/name=$Name for Community$
com.ibm.collaboration.realtime.community/host=$Hostname of Sametime Server$
com.ibm.collaboration.realtime.community/authServerUrl=$hierarchical Domino Server Name$
# Status Updater Fix to show profile pictures
Sametime will only apply the settings of plugin_customization.ini, when following file is not present!
~/Library/Application Support/Lotus Notes Data/Expeditor/Applications/.metadata/.plugins/com.ibm.collaboration.realtime.login/CANONICAL_NAME.xml
Applying these settings through a Desktop setting document and policy
You can apply this through a policy too, you have to add the values to a Desktop settings document. Syntax is described here: IBM KB 21407709.
There is a bug in the desktop settings document until Notes / Domino 8.5.3, you can’t delete the entries.
Comments on Detlef Poettgen tells, that error is still active in 8.5.2 FP3, i tested 8.5.3 and it works.
Please be aware, that Domino Directory allows stored forms and if you want to delete Managed Settings of an Desktop settings document which is created before 8.5.3, the error still occurs.
Path in Windows Installations
- Expeditor\Applications folder is $Notes Data$\workspace.
- Path to plugin_customization.ini: $Notes Program$\framework\rcp
In only two weeks starts LCTY Edcom Nachlese 2012 in Munich.
I prepare a session on Single Sign On in Notes / Domino environments.
So i had time to check some settings in Lotus Notes. Since 8.5.3 we have a new option Domino-SSO for Connections Plugin.
I made several tests with my installed Notes Client on Mac OS, but i had no success. I tested with several settings in the preferences dialog and with different settings in plugin_customization.ini.
I had one configuration where i can use Sametime Tokenbased Login and leave “Domino Single Sign-On Server” empty in connections preferences, but this works only with running Notes Client and i had to apply the setting again after restart the client.
Now i deleted the Expeditor folder in my Notes Data to reconfigure the client. What should i say? The SSO-Server works now. I had to use the hierarchical Domino server name. It would be interesting, which technique is used here, because the Domino and Connections Server are in different domains, so it is no LTPA SSO.
Only a short add-on. It is LTPA SSO, but i think domain from Web SSO document gets applied.