QUESTION POSED ON: 03 December 2004
We have a Windows 2000 box, running IIS 5x in the DMZ. Users sign in with a user ID and password that is defined as a local Windows user to a Web site -- https://xxxxx.xxxx.com. We want to take that ID (that belongs to a particular Windows group) and send it to a Domino backend application server -- using a different ID. It can be a Windows ID and/or a Domino ID.
We think we know how to trap a call to a particular URL and pass a logged in ID to Domino by using a plug-in that IBM provides that is loaded on the IIS server (WebSphere Application Server plug-in for Domino). The question is, can we change the login on the IIS box after the user logs in to another ID and passes to the Domino HTTP server? The proxy/single sign-on (SSO) method that we think we can use is the one I mentioned above (IBM plug-in).
There may also be a method defined by IBM/Lotus called DSAPI (Domino Web Server API). We believe the DSAPI allows us to change the user like we want, but we don't have a lot of C expertise.
I found most of what I know regarding proxy, SSO, etc., in the Lotus Security Handbook. I have searched the IBM, Microsoft and Domino third party Web sites for information and haven?t found anything yet.
Can you offer any advice?
|
