Configuring Sametime awareness for Domino Web Access when Sametime uses a non-Domino LDAP server

• "Complete steps to configure Sametime Integration with DWA 7.x" (#1221591)
• "Are there any considerations for Notes Instant Messaging or DWA Instant Messaging when using an LDAP directory?" (#1138689)

To configure Sametime awareness in Domino Web Access when the Sametime server is using a non-Domino LDAP server, make sure the following conditions exist:

• The Domino Web Access server must be at least version 7.0
• The Sametime server can be version 6.5.1 or 7.0.
• Single Sign-On (SSO, also called Multiple Server Session Authentication) is set up between the Domino Web Access server and Sametime server

1. Create a Configuration document for the Domino Web Access server.

2. Click the Domino Web Access tab in the document.

3. Enter the following values for the Instant Messaging fields, then save and close the document:

4. Open the Web SSO Configuration document.

5. Make sure the field "Map names in LTPA tokens" is Enabled. Save and close the document.

6. Configure Domino Web Access to understand the non-Domino LDAP Distinguished Name that should be passed to Sametime. There are two possible ways to accomplish this setup:

• Synchronize the user name in the Person document in the Domino Directory with the non-Domino LDAP name that Sametime uses to authenticate a user.

For example, if the non-Domino LDAP Sametime directory is IBM Directory Server, and a user's dn from IBM Directory Server is as follows:

uid=wpsadmin,cn=users,dc=ibm,dc=com

then you need to add the following to the LTPA user name field (located on the Administration Tab of the Person document) for wpsadmin in Domino:

LTPA user name:  uid=wpsadmin/cn=users/dc=ibm/dc=com

• Or, synchronize the user name in the non-Domino LDAP with the name that Domino Web Access uses to authenticate the user by using Directory Assistance. For more information on creating and configuring Directory Assistance, refer to the Domino Administrator help database.
  
  a. Extend the LDAP Schema by adding the following attributes, or use an attribute that is already available:
  
  NotesDN=CN=wpsadmin,O=ibm
  
  This entry must match the attribute name defined in Directory Assistance.
  
  b. Use Directory Assistance on all the Domino servers, and point it to your LDAP Directory (the same as the one Sametime is using).
  
  c. On the LDAP tab in the Directory Assistance document, add the LDAP attribute that contains your Notes Canonical name. You use this to solve the multiple identity issue, as your Notes Name is used for everything while you are connected to the Domino server, and you get access to your mail database without modifying the ACL.
  
  Screen capture of LDAP tab:
  
  
  d. On the Basic tab in the Directory Assistance document, set the following:
  Attribute to be used as name in an SSO token (map to Notes LTPA_UsrNm): $DN
  
  e. If extending the schema and adding the NoteDN attribute, then also add the following to the sametime.ini file on the Sametime server under the [Directory] section:
  
  ST_DB_LDAP_ALLOW_SEARCH_ON_DN=1
  
  Note: If the [Directory] section does not exist, then add that section.

var HTTP_TUNNELING_PORT=80;
var TUNNELING_ADDRESS="";