Tivoli Access Manager

Transcription

1 Tivoli Access Manager for versions 5.1 and 6.0 Lotus Domino Web Access Integration Guide

2

3 Tivoli Access Manager for versions 5.1 and 6.0 Lotus Domino Web Access Integration Guide

4 Note Before using this information and the product it supports, read the information in Appendix C, Notices, on page 19 Fourth Edition (November 2006) This edition applies to version of the IBM Tivoli Access Manager integration with Lotus Domino Web Access and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2003, 2005, All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v Publications v Base Information v WebSEAL Information v Accessing Publications Online vi Contacting Software Support vi Tivoli technical training vi Conventions Used in this Book vii Chapter 1. Introducing the Integration Integration Product Version Information Integration Package Contents Integration Process Flow Integration Checklist Chapter 2. Integration Process Before You Start Configuring Tivoli Access Manager and Web Access User Registry Generating the LTPA key file Tivoli Access Manager WebSEAL Configuration WebSEAL Junction Creation Lotus Domino Configuration Configuring the SSO Document for the Domino Server Configuring the Domino Server for Single Sign-On Adding the LDAP DN to the Person Documents Enabling Domino to Search Through Multiple User Names Configuring The Domino Server For Single Sign Off Integration Successful Checkpoint Uninstallation Troubleshooting Appendix A. Generating an LTPA key Appendix B. IBM Software Support Determine the business impact of your problem Describe your problem and gather background information Submit your problem to IBM Software Support Searching knowledge bases Search the information center on your local system or network Search the Internet Obtaining fixes Appendix C. Notices Trademarks Copyright IBM Corp. 2003, 2005, 2006 iii

6 iv IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

7 Preface Who should read this book This guide tells you how to integrate your IBM Tivoli Access Manager for e-business (Tivoli Access Manager) installation with IBM Lotus Domino Web Access (formerly known as inotes Web Access) to achieve Single Sign On (SSO) and Single Sign Off capability. This document assumes that both Tivoli Access Manager and Domino Web Access are installed, configured and running on your network. It does not provide details on the installation and administration of these products, except where necessary to achieve integration. This guide is for those responsible for the installation, deployment and administration of IBM Tivoli Access Manager, Tivoli Access Manager WebSEAL and Lotus Domino Server. Readers should be familiar with the following: v PC and UNIX operating systems, v Security management, v Internet protocols, including HTTP, HTTPS and TCP/IP, v HTML, v Lightweight Directory Access Protocol (LDAP) and directory services, v A supported user registry, v Authentication and authorization. Publications Base These publications complement the information contained in this publication: Information v IBM Tivoli Access Manager Base Installation Guide Explains how to install, configure, and upgrade Access Manager software, including the Web portal manager interface. v IBM Tivoli Access Manager Base Administrator s Guide Describes the concepts and procedures for using Access Manager services. Provides instructions for performing tasks from the Web portal manager interface and by using the pdadmin command. WebSEAL Information v IBM Tivoli Access Manager WebSEAL Installation Guide Provides installation, configuration, and removal instructions for the WebSEAL server and the WebSEAL application development kit. v IBM Tivoli Access Manager WebSEAL Administrator s Guide Provides background material, administrative procedures, and technical reference information for using WebSEAL to manage the resources of your secure Web domain. Copyright IBM Corp. 2003, 2005, 2006 v

8 v IBM Tivoli Access Manager WebSEAL Developer s Reference Provides administration and programming information for the Cross-domain Authentication Service (CDAS), the Cross-domain Mapping Framework (CDMF), and the Password Strength Module. Accessing Publications Online The publications for this product are available online in Portable Document Format (PDF) or Hypertext Markup Language (HTML) format, or both in the Tivoli Software Library: Contacting Software Support Tivoli technical training To locate product publications in the library, click the Product manuals link on the left side of the Library page. Then, locate and click the name of the product on the Tivoli Software Information Center page. Product publications include release notes, installation guides, user s guides, administrator s guides, and developer s references. Note: To ensure proper printing of PDF publications, select the Fit to page check box in the Adobe Acrobat Print window (which is available when you click File Print). Contact IBM Software Support by using the methods described in the IBM Software Support Guide at the following Web site: The guide provides the following information: v Registration and eligibility requirements for receiving support v Telephone numbers, depending on the country in which you are located v A list of information you should gather before contacting customer support For more information, see Appendix B, IBM Software Support, on page 15. For Tivoli technical training information, refer to the IBM Tivoli Education Web site: vi IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

9 Conventions Used in this Book The following typeface conventions are used in this book: Bold Lowercase commands or mixed case commands that are difficult to distinguish from surrounding text, keywords, parameters, options, names of Java classes, and objects are in bold. Italic Variables, titles of publications, and special words or phrases that are emphasized are in italic. Monospace Code examples, command lines, screen output, file and directory names that are difficult to distinguish from surrounding text, system messages, text that the user must type, and values for arguments or command options are in monospace. Preface vii

10 viii IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

11 SD Chapter 1. Introducing the Integration IBM Lotus Domino Web Access is a sophisticated Web client that gives end users leading Domino messaging and collaboration features that were previously available only with a Lotus Notes client. This integration guide describes the procedures for integrating IBM Tivoli Access Manager for e-business (Tivoli Access Manager) with Lotus Web Access to achieve Single Sign-On (SSO) and Single Sign-Off capability. This integration deploys WebSEAL as a reverse-proxy in front of the Lotus Domino server. WebSEAL acts as a security gateway between the client browser and the Lotus Domino Server, authenticating user access to WebSEAL then using the LTPA authentication scheme to authenticate users to the Domino server, in order to utilize Domino Web Access. IBM Tivoli Access Manager WebSEAL Server 1 3 Lotus Domino Server Domino Web Access Request User Request + LTPA Cookie Browser Content 6 Content 5 Authenticate Authenticate 2 4 Synchronized Distinguished Names Tivoli Access Manager User Registry Domino NAB Figure 1. Integration Process Flow The diagram above shows an integration architecture that supports the following processes: 1. A browser request for Lotus Domino Web Access is submitted through WebSEAL. 2. WebSEAL intercepts the request, authenticates and authorizes the user as required. 3. WebSEAL forwards the request to the Domino Server along with a cookie containing the encrypted LTPA token which holds the unique Distinguished Name (DN) of the user authenticated by WebSEAL. 4. Domino decrypts the LTPA token and authenticates the DN against those in its NAB and if a match is found access is granted. 5. The requested Web Access content for the authenticated user is sent back to WebSEAL. 6. WebSEAL performs filtering as appropriate for the junction method then the content is returned to the browser. Copyright IBM Corp. 2003, 2005,

12 This guide documents the steps required to achieve the integration. To assist you in working through the process, a flowchart of required procedures and a printable checklist are also provided. Integration Product Version Information This integration scenarios is for the following product versions: v Lotus Domino Server v IBM Tivoli Access Manager Base 5.1 or 6.0 v IBM Tivoli Access Manager WebSEAL 5.1 or 6.0 Domino Web Access supports the following Browsers: v Microsoft Internet Explorer 6.0 Integration Package Contents v Mozilla and 1.7.x (Linux clients only) v Mozilla Firefox 1.0 on Win32 and Linux (supported by the DWA7 mail template only, not supported by inotes6 templates) The integration package provides the following file only: File Name Description am_domino_int_guide.pdf This integration guide. Integration Process Flow The diagram below illustrates the optional paths through this scenario to achieve integration. 2 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

13 Before you start WebSEAL junction creation Tivoli Access Manager 6.0? No Yes Virtual host junction Transparent path junction Standard junction Configure the SSO Document for Domino Server Configure Domino to Accept Single Sign-on Add LDAP DN to Each User Document on Domino Server Enable Domino Server to Search Through Multiple User Names Configure Domino for Single Sign-off Checking the integration Figure 2. Process flow using Tivoli Access Manager WebSEAL Chapter 1. Introducing the Integration 3

14 Integration Checklist The following tables can be printed and used as a checklist to assist you as you work through the integration process. A list of each major task heading is provided, with a check box next to it. Each task is detailed fully in the following chapters. Fill out the Planning column prior to starting the integration. Once all steps for the heading are complete, return to this page and check the appropriate box in the Completed column. Table 1. Before You Start Planning Completed Task Heading h To Do h Done Create TAM WebSEAL user accounts for each user who requires access to Domino Web Access ensuring to synchronize the DN s in both the TAM WebSEAL LDAP user directory Lotus Domino s NAB user directory. h To Do h Done Generate LTPA key file and ensure that there is a copy of it on both the WebSEAL and Domino servers. Table 2. Tivoli Access Manager WebSEAL Configuration Planning Completed Task Heading h To Do h Done Creating a junction: v Virtual host junction v Transparent path junction v Standard junction Table 3. Lotus Domino Server Configuration Planning Completed Task Heading h To Do h Done Configuring SSO document for Domino Server to allow LTPA authentication for a given DNS domain using the generated key file. h To Do h Done Apply the configured SSO document the Domino Server that Web Access will be executing from. h To Do h Done For each user account in WebSEAL ensure that their DN is added to their synchronized account on the Domino Server. h To Do h Done Enable Domino to search through multiple user names in a users Person document so that authentication can be granted based on the DN. h To Do h Done Configure the Domino Server to redirect to WebSEAL logout page for Single Sign Off. 4 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

15 Chapter 2. Integration Process Before You Start This chapter contains the following sections: v Before You Start v Tivoli Access Manager WebSEAL Configuration on page 6 v Lotus Domino Configuration on page 8 v Integration Successful Checkpoint on page 10 v Uninstallation on page 11 v Troubleshooting on page 11 Before you begin this integration, review the information in Chapter 1, Introducing the Integration, on page 1. Determine the procedures that you will need to follow by referring to the integration flowchart provided in Integration Process Flow. Then print out the tables provided in Integration Checklist, which will help you work your way through this guide. Before beginning the integration, you should also be aware of the following: Configuring Tivoli Access Manager and Web Access User Registry In this integration both Lotus Domino and Tivoli Access Manager use separate user registries, Lotus Domino s being the Domino Name and Address Book (NAB) and Tivoli Access Manager s IBM Directory Server (TAM LDAP). For this integration a user must have an account in both the Domino NAB and the TAM LDAP directory. The link between these accounts comes from adding the user s LDAP DN to the corresponding Domino person record in the NAB. For each user in the Domino Address Book that requires Domino Web Access, create a corresponding user in Tivoli Access Manager. For example, if a user exists in the Domino Name and Address Book (NAB) called John Smith (John Smith/example in the NAB), and the base DN of the LDAP server is o=example,c=au the following command would create a corresponding user in TAM (entered on one line): pdadmin> user create jsmith cn=john_smith,o=example,c=au John Smith passw0rd pdadmin> user modify jsmith account-valid yes For further details about creating Tivoli Access Manager users with the pdadmin command line utility, refer to the IBM Tivoli Access Manager Command Reference. In the above example, when this user signs into Tivoli WebSEAL with their username and password, the LTPA token will contain the full DN of the user (cn=john_smith,o=example,c=au). This is the value that must be added to User Name field in the person document of the NAB user that owns the Domino Web Access database. This associates the Tivoli Access Manager LDAP user with the Domino NAB user. This step will be covered later in Adding the LDAP DN to the person document. Copyright IBM Corp. 2003, 2005,

16 Generating the LTPA key file To achieve SSO, the LTPA key is required by both WebSEAL and the Domino server. The LTPA key file is needed when creating the WebSEAL junction to the Domino server, and also when creating the SSO document on the Domino server. The same key file MUST be used on both servers, otherwise SSO will fail. To generate an LTPA key, follow the steps in Appendix A, Generating an LTPA key, on page 13. Once the key file has been generated, copy it to the Domino server. Also copy the key to the WebSEAL machine, if it was not generated there. Make a note of the path to the file, as this information is required when creating the WebSEAL junction. Tivoli Access Manager WebSEAL Configuration This section describes the integration steps required on WebSEAL. After completing these steps, you must restart WebSEAL to apply the changes. WebSEAL Junction Creation A WebSEAL junction is required to connect WebSEAL to Lotus Web Access. The junction can be configured to use either TCP or SSL protocol. SSL is recommended for increased security. For this integration all three junction types supported by Tivoli Access Manager WebSEAL 6.0 are available. For further details of WebSEAL junction creation, refer to the IBM Tivoli Access Manager WebSEAL Administration Guide. Regardless of the type of junction chosen for this integration, each junction created to the Domino Server must specify the following options: Option Description -A Enable LTPA cookies -F path_to_ltpa_keyfile Full path name location of the LTPA key file -Z keyfile_password Password required to open the key file The pdadmin commands to create each junction are as follows: Standard Junction The use of a Standard Junction will result in the junction name being included in the URL when using Domino Web Access via the browser. For example: http[s]://tamwebseal.company.com/domino/mail/user.nsf where domino is the name of the junction. This is to allow WebSEAL to identify the back-end server to which requests should be forwarded. As a result, every requested page that the Domino Server sends back to the client via WebSEAL must be filtered. This allows the junction name to be inserted into all the static and dynamically generated links in both the HTML and JavaScript. Below is the template (followed by an example) of the pdadmin command to create a Standard Junction (enter command as one line): 6 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

17 pdadmin> server task webseald-server_name create -t tcp -h domino_server_fqdn -j A -F path_to_keyfile\keyfile_name -Z keyfile_password /jct_name For example: pdadmin> server task default-webseald-tamwebseal.company.com create -t tcp -h dominoserver.company.com j A F C:\Lotus\ltpakey.key -Z mercury1 /domino Note: In the case of a Standard Junction where the junction name is inserted into the URL, for this integration it cannot be called /mail. Transparent Path Junction Transparent Path Junctions eliminate the need to filter pages sent back to WebSEAL from the Domino Server, as the junctions share the name of the actual directories located on the Domino Server. There are three back-end directories that must be junctioned from the WebSEAL server in order to satisfy a Transparent Path solution: v mail, v inotes, and v icons. Below is the template (followed by an example) of the pdadmin command to create a Transparent Path Junction (enter command as one line): pdadmin> server task webseald-server_name create x -t tcp -h domino_server_fqdn A -F path_to_keyfile\keyfile_name -Z keyfile_password /jct_name Example: pdadmin> server task default-webseald-tamwebseal.company.com create x -t tcp -h dominoserver.company.com A F C:\Lotus\ltpakey.key -Z mercury1/mail pdadmin> server task default-webseald-tamwebseal.company.com create x -t tcp -h dominoserver.company.com A F C:\Lotus\ltpakey.key -Z mercury1/inotes pdadmin> server task default-webseald-tamwebseal.company.com create x -t tcp -h dominoserver.company.com A F C:\Lotus\ltpakey.key -Z mercury1/icons Virtual Host Junction Virtual host junctions allow WebSEAL to communicate with local or remote virtual hosts. WebSEAL uses the HTTP Host header in client requests to direct those requests to the appropriate document spaces, located on junctioned servers or on the local machine. Virtual hosting introduces some DNS and session management challenges. For details, refer to the Tivoli Access Manager WebSEAL 6.0 Administration Guide. Below is the template (followed by an example) of the pdadmin command to create a Virtual Host Junction (enter command as one line): pdadmin> server task instance-webseald-server_name virtualhost create -t tcp -h domino_server_fqdn -A -F path_to_keyfile\keyfile_name -Z keyfile_password jct_name Example: Chapter 2. Integration Process 7

18 Lotus Domino Configuration pdadmin> server task default-webseald-tamwebseal.company.com virtualhost create -t tcp -h dominoserver.company.com A F C:\Lotus\ltpakey.key -Z mercury1 domino After configuring the Tivoli Access Manager WebSEAL junction, proceed to Configuring Lotus Domino Server. The following sections describe the integration steps required on the Lotus Domino Server. After the following changes are made, the Domino Server must be restarted to apply the changes. Note: You will need the LTPA key file that was previously generated and used when creating the WebSEAL junction. Copy this file from the WebSEAL machine to an appropriate directory on the Domino server, if it is not already there. Configuring the SSO Document for the Domino Server Perform the following step to create an SSO Document for Domino. 1. Open the Domino Administrator (ensure the administrator is connected to your Domino server instance, and not local). 2. Select the Configuration tab. 3. In the Navigator Pane, expand the Server icon. 4. Select All Server Documents. 5. Select the Web... dropdown menu. 6. Select Create Web SSO Configuration. 7. In the form that is displayed, leave the Organization field blank. 8. In the new screen that appears, in the section DNS Domain, enter the DNS domain of the Domino Server. For example, if the Domino Server s fully qualified domain name is domino.example.com, then.example.com should be entered here. 9. In the section Domino Server Names, select the Domino Web Access server. 10. Change the Expiration (Minutes) figure to an acceptable time, such as 480 minutes for an 8 hour work day. 11. Leave the Idle Session Timeout option unchecked (it has no effect when deployed behind WebSEAL). 12. Select the Keys... drop down menu. 13. Select Import WebSphere LTPA Keys. 14. Enter the path to the LTPA key file followed by the key file name. For example: C:\Lotus\ltpakey.key 15. When prompted, enter the password for the key file. 16. A confirmation dialog box is displayed. Select OK. 17. When the details of the key file are displayed, the entry at LDAP Realm must be modified to place a slash character (\) in front of the colon at the port number. For example, if the entry was ldap-srv.example.com:389, this would need to be changed to ldap-srv.example.com\: Click the Save & Close button to complete the SSO document creation. 8 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

19 After configuring the SSO Document, proceed to Configuring Lotus Domino Server For SSO. Configuring the Domino Server for Single Sign-On To ensure that the Domino Server is properly configured for Single Sign-On: 1. With the Domino Administrator, open the server document. 2. Select the Internet Protocols tab. 3. Select the Domino Web Engine sub-tab. 4. Under the HTTP Sessions section, change the Session Authentication entry to Multiple Servers (SSO). 5. In the Web SSO Configuration section, select the configuration that was created in the previous section (that is, LTPAToken). 6. Select Save & Close to complete Single Sign-On configuration. After configuring the Domino Server for Single Sign-On, proceed to Adding The LDAP DN To Person Documents. Adding the LDAP DN to the Person Documents This step adds the LDAP DN to the User Name field of the user document. For each user requiring SSO through WebSEAL to their Domino Web Access database, complete the following steps: 1. From the Domino Administrator, open the relevant user s Person document. 2. On the Basics tab, find the User Name field. 3. Add the user s corresponding LDAP Distinguished Name to the list of usernames, replacing the comas (,) with forward slashes (/), as required by Domino. For example, if the User Name field currently contains: John Smith/example John Smith and the account created for this user in Tivoli Access Manager has a DN of cn=john Smith,o=example,c=au, then after adding cn=john Smith/o=example/ c=au to the User Name field, it would appear as follows: John Smith/example John Smith John Smith/example/au Notice that cn=john Smith,o=example,c=au is abbreviated to John Smith/example/au by Domino. This is normal Domino behavior. 4. Click Save & Close. After configuring the Person Documents to contain the required LDAP DN s, proceed to Enabling Domino To Search Through Multiple User Names. Enabling Domino to Search Through Multiple User Names In order for Domino to search through multiple usernames in a user s Person document, the Internet Authentication stanza in the server document must be modified as follows: 1. Open the Domino Administrator. 2. Select the Configuration tab. 3. In the navigator pane, select Current Server Document. 4. In the server document, select the Security tab. Chapter 2. Integration Process 9

20 5. Under Internet Access, locate the Internet Authentication field. 6. Change the value to More name variations with lower security. 7. Click Save and Close to save the server document. 8. Restart the server for the changes to take effect. After configuring the Domino Server to search through multiple User Names, proceed to Configuring The Domino Server For Single Sign Off. Configuring The Domino Server For Single Sign Off To ensure that the Domino Server is properly configured for Single Sign Off: 1. Launch the Domino Administrator and select the Configuration sub-tab for the required domain. 2. On the left side, expand the Server list and select the Configurations document. 3. If the required Domino server is not listed, select Add Configuration. Otherwise, select the Domino server you wish to configure and click Edit Configuration. 4. Select the NOTES.INI Settings tab. 5. Click Set/Modify Parameters. 6. In the Item field enter: inotes_wa_logoutredirect 7. In the Value field enter: http[s]://webseal_fqdn/pkmslogout 8. Click Add then OK. 9. Click Save and Close. Integration Successful Checkpoint To test the integration: 1. Open a browser and access Domino Web Access through WebSEAL with the URL: Standard Junction Example: http[s]://webseal_fqdn/junction_name/mail/mail_database_name For example: Transparent Path & Virtual Host Junction Example: http[s]://webseal_fqdn/mail/mail_database_name For example: 2. An authentication request is displayed from the Tivoli Access Manage WebSEAL server. Log in using a Tivoli Access Manager user ID and password that has a corresponding Domino account. 3. Upon successful authentication, the user s Domino Web Access mail page should be displayed. 4. Click Logout. 10 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

21 5. Domino Web Access will remove all cookies from your browser. You will then be forwarded to the WebSEAL logout page, which will end the session on the WebSEAL server. Uninstallation The uninstall process is virtually a reverse of the installation process described above. To remove the integration, you only need to restore your original Lotus Domino server settings. Troubleshooting If you plan to modify your network settings and re-deploy Tivoli Access Manager WebSEAL, you may also wish to restore your original WebSEAL settings. If you experience any problems during the integration, examine the following notes for help in identifying problems: 1. When logging into a user s database, a message You are not authorized to perform this operation and a login prompt from the domino server is displayed. Check the correct DN has been added to the Domino NAB users User Name field. Ensure it matches the user s LDAP DN, which can be retrieved from the pdadmin command line utility, using a user show command. For further details, refer to the IBM Tivoli Access Manager Command Reference. 2. If a Domino log in form is displayed after signing on through WebSEAL, SSO has not been achieved. In this case, check the following: v Ensure that the junction you created is an LTPA junction, and that the key used in creating the junction is the same as used for the Domino Web SSO document. v The system date and time on the WebSEAL server and the Domino server must be synchronized as closely as possible, otherwise Domino may reject the token sent to it from WebSEAL without producing any error logs. v When creating the SSO document, remember to modify the imported key information to contain a forward slash (/) before the colon in the LDAP Realm field. v Ensure that the Domino server resides in the same domain as that for which the LTPA key file was generated. Chapter 2. Integration Process 11

22 12 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

23 Appendix A. Generating an LTPA key In order to generate an LTPA key file refer to the "Configuring Lightweight Third Party Authentication" section of the WebSphere Application Server Guide. The current locations for these guides are shown below: For WebSphere Application Server 5.1.x: index.jsp?topic=/ com.ibm.websphere.base.doc/info/aes/ae/tsec_ltpa.html For WebSphere Application Server 6.1.x: index.jsp?topic=/ com.ibm.websphere.base.doc/info/aes/ae/tsec_ltpa.html Copyright IBM Corp. 2003, 2005,

24 14 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

25 Appendix B. IBM Software Support IBM Software Support provides assistance with product defects. Before contacting IBM Software Support, your company must have an active IBM software maintenance contract, and you must be authorized to submit problems to IBM. The type of software maintenance contract that you need depends on the type of product you have: v For IBM distributed software products (including, but not limited to, Tivoli, Lotus, and Rational products, as well as DB2 and WebSphere products that run on Windows or UNIX operating systems), enroll in Passport Advantage in one of the following ways: Online: Go to the following Passport Advantage Web page and click How to Enroll: Passport_Advantage_Home By phone: For the phone number to call in your country, go to the IBM Software Support Web site ( contacts.html) and click the name of your geographic region. v For IBM eserver software products (including, but not limited to, DB2 and WebSphere products that run in zseries, pseries, and iseries environments), you can purchase a software maintenance agreement by working directly with an IBM sales representative or an IBM Business Partner. For more information about support for eserver software products, go to the IBM Technical Support Advantage Web page ( If you are not sure what type of software maintenance contract you need, call IBMSERV ( ) in the United States or, from other countries, go to the contacts page of the IBM Software Support Handbook on the Web ( and click the name of your geographic region for phone numbers of people who provide support for your location. Follow the steps in this topic to contact IBM Software Support: 1. Determine the business impact of your problem 2. Describe your problem and gather background information on page Submit your problem to IBM Software Support on page 16 Determine the business impact of your problem When you report a problem to IBM, you are asked to supply a severity level. Therefore, you need to understand and assess the business impact of the problem you are reporting. Use the following criteria: Severity 1 Critical business impact: You are unable to use the program, resulting in a critical impact on operations. This condition requires an immediate solution. Severity 2 Significant business impact: The program is usable but is severely limited. Copyright IBM Corp. 2003, 2005,

26 Severity 3 Some business impact: The program is usable with less significant features (not critical to operations) unavailable. Severity 4 Minimal business impact: The problem causes little impact on operations, or a reasonable circumvention to the problem has been implemented. Describe your problem and gather background information When explaining a problem to IBM, be as specific as possible. Include all relevant background information so that IBM Software Support specialists can help you solve the problem efficiently. To save time, know the answers to these questions: v What software versions were you running when the problem occurred? v Do you have logs, traces, and messages that are related to the problem symptoms? IBM Software Support is likely to ask for this information. v Can the problem be recreated? If so, what steps led to the failure? v Have any changes been made to the system? (For example, hardware, operating system, networking software, and so on.) v Are you currently using a workaround for this problem? If so, please be prepared to explain it when you report the problem. Submit your problem to IBM Software Support Searching knowledge bases You can submit your problem in one of two ways: v Online: Go to the Submit and track problems page on the IBM Software Support site ( Enter your information into the appropriate problem submission tool. v By phone: For the phone number to call in your country, go to the contacts page of the IBM Software Support Handbook on the Web ( techsupport.services.ibm.com/guides/contacts.html) and click the name of your geographic region. If the problem you submit is for a software defect or for missing or inaccurate documentation, IBM Software Support creates an Authorized Program Analysis Report (APAR). The APAR describes the problem in detail. Whenever possible, IBM Software Support provides a workaround for you to implement until the APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the IBM product support Web pages daily, so that other users who experience the same problem can benefit from the same resolutions. For more information about problem resolution, see Searching knowledge bases and Obtaining fixes on page 17. If you have a problem with your IBM software, you want it resolved quickly. Begin by searching the available knowledge bases to determine whether the resolution to your problem is already documented. 16 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

27 Search the information center on your local system or network IBM provides extensive documentation that can be installed on your local machine or on an intranet server. You can use the search function of this information center to query conceptual information, instructions for completing tasks, reference information, and support documents. Search the Internet If you cannot find an answer to your question in the information center, search the Internet for the latest, most complete information that might help you resolve your problem. To search multiple Internet resources for your product, expand the product folder in the navigation frame to the left and select Support on the Web. From this topic, you can search a variety of resources including: v IBM technotes v IBM downloads v IBM Redbooks v IBM DeveloperWorks v Forums and newsgroups v Google Obtaining fixes A product fix might be available to resolve your problem. You can determine what fixes are available for your IBM software product by checking the product support Web site: 1. Go to the IBM Software Support Web site ( support). 2. Under Products A - Z, select your product name. This opens a product-specific support site. 3. Under Self help, follow the link to All Updates, where you will find a list of fixes, fix packs, and other service updates for your product. For tips on refining your search, click Search tips. 4. Click the name of a fix to read the description and optionally download the fix. To receive weekly notifications about fixes and other news about IBM products, follow these steps: 1. From the support page for any IBM product, click My support in the upper-right corner of the page. 2. If you have already registered, skip to the next step. If you have not registered, click register in the upper-right corner of the support page to establish your user ID and password. 3. Sign in to My support. 4. On the My support page, click Edit profiles in the left navigation pane, and scroll to Select Mail Preferences. Select a product family and check the appropriate boxes for the type of information you want. 5. Click Submit. 6. For notification for other products, repeat Steps 4 and 5. For more information about types of fixes, see the Software Support Handbook ( Appendix B. IBM Software Support 17

28 18 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

29 Appendix C. Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user s responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Copyright IBM Corp. 2003, 2005,

30 Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM s future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. This information is for planning purposes only. The information herein is subject to change before the products described become available. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrates programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any 20 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

31 form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM s application programming interfaces. If you are viewing this information softcopy, the photographs and color illustrations may not appear. Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: AIX DB2 IBM IBM(logo) SecureWay Tivoli Tivoli (logo) Universal Database WebSphere IBM-Lotus Trademarks Domino inotes Lotus Notes Lotus Notes Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries, or both. ActionMedia, LANDesk, MMX, Pentium and ProShare are trademarks of Intel Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction LLC. Other company, product, and service names may be trademarks or service marks of others. Appendix C. Notices 21

32 22 IBM Tivoli Access Manager: Lotus Domino Web Access Integration Guide

33

34 Printed in USA