Blog, published February 8, 2024 by Justin Hill

Domino v14: A Deep Dive into Its Enhanced Security Features

HCL has progressed with its deep-dive series on Domino V14 with a great overview of security. Let’s explore why security is such an important piece of the Domino puzzle.

Here are some of the things that you must have by now in terms of security:

HCL Domino V14 comes with some more security benefits, making a good product better. You might have noticed when talking to people in IT that security does not mean the same thing for everyone. Here are some aspects included when talking about security:

Text list on cybersecurity topics in black font over a gray word cloud. Topics include Authentication, Compliance, Encryption, and more.

When talking about authentication you must make sure that it is simple and secure and yet sometimes we get experiences that are not that easy:

Grid of snow-covered trees, part of a captcha challenge text: select all images with Finnish snipers. White and blue tones.

Image showing a comparison of protocol level and HTTP application level techniques, with bullet points listing various security methods.

Domino V14: Authentication Approaches

There are several approaches to the authentication process, these being just a small number of them:

Many of these rely on passwords, and it’s best not to have to use passwords since they need to be remembered by the user’s number one.

Secondly, they need to be strong, unique, changed regularly, and never reused. That often is not the case as experience has taught us all.

Last but not least, passwords are the weakest link due to phishing, shoulder surfing, keylogging, etc.

Fortunately, there is a solution to this problem. The first step to take is to authenticate to a central identity provider, not the back-end server.

The old classic standard here is Security Assertion Markup Language 2.0 (SAML). It’s web browser-centric, heavy-weight, and supported by Domino for federated identity since version 9.0.

Another option is OpenID Connect 1.0 (OIDC). This is the new standard built on top of the OAuth 2.0 framework. It connects well with bearer Auth, it’s mobile/native / SPA friendly and lighter weight than SAML.

Some problems that arise with both are: the configuration is usually hard, interoperability is iffy, they are not a universal solution, and cannot federate everything.

Challenges with Federated Identity

Passkeys

Passkeys are considered to be a solution to the whole password management issue:

Grid of blue text boxes highlighting security features: multi-factor, no password change, private keys. Mentions device compatibility.

You can check out a demo of how passkeys work with Domino v14 in the recording of the webinar.

Passkeys – Setup

Requirements

Supported Platforms:

Web page showing a settings menu for a website with "Domino Web Engine" highlighted. Options include session authentication and TLS settings.

Create Passkey database

Replication:

New application setup window with fields for server, title, and file name. "Passkey" is selected in a template dropdown, with blue highlights.

Optional: Customize the Domino Server Relying Party Name

For example your site is: https://www.domino.example.com:8443

Default configuration allows to authenticate at: www.domino.example.com

Table showing domain configurations: "PASSKEY_DOMAIN_LEVELS=3" and "PASSKEY_SKIP_LEVEL=1" with lists of compatible domains.

Enable Passkey support for the internet site

Web security settings screen showing TCP and TLS authentication options. "Security" and "Passkey (WebAuthn): No" are highlighted.

New Login Form

HCL Domino login page with fields for username and password. Options: Login or Login with a passkey. Blue and white color scheme.

Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.

Domcfg.nsf – Domino Web Server Configuration

Login Form Mapping:

Diagram explaining login form mapping with tables and options for adding mappings for all websites or specific sites. Text and red highlights.

Those are about all the steps you need to take to have the passkeys set up. After that, everything should run smoothly:

Dashboard showing passkey data and list, including user details and login times, with sections highlighted in green. Text notes on passkey management.

OIDC – Improvements

Overall

HTTP bearerAuth

Web login with OIDC

Improved OIDC UI

Settings page for Google OIDC provider with fields like base URL, client ID, and client secret. Text includes security options and descriptions.

OIDC Enhancements

Configuring Domino as a fake ODIC provider

Step 1: Create a file in the Domino HTTP server $DATA\domino\html\fakeprovider.well-known\openid-configuration

{

“issuer”:”Fake OIDC Provider”, <- Issuer name in JWTs

“jwks_uri”: http://yourcompany.com/auth/protocol/oidc/keys

}

Step 2: Configure trust for that fake provider in idpcat.nsf

Step 3 : Ensure the Internet Site allows anonymous over TLS

OIDC provider settings screen titled "Ultraviolet fake provider" with fields for URLs, client ID, client secret, and other configurations.

OIDC Troubleshooting

Text document showing instructions for OIDC configuration on a Domino server, including debugging commands and troubleshooting tips.

TLS Ciphers for RSA Keys changed

TLS Cipher Settings window displaying selectable encryption options. Four are checked within a red box, highlighting their selection.

Note: Sametime 12.0.2 finally supports current ciphers by using a current OpenSSL Version. No weak Cipher configuration is needed for LDAPS connections.

Dependencies updated

LibCurl and OpenSSL logos with version updates and URLs. LibCurl upgraded to 8.2.1, OpenSSL to 3.1.2, addressing CVEs. White background.

Security Improvements

Password change screen with fields for new password and confirmation, encryption strength set to 256 bit AES and SHA-512.

Domino 14 on Windows

Domino Security – Inbound disclaimer

Inbound Mail Disclaimers

Inbound Mail Disclaimer Configuration

Settings page for external email notifications, showing options like notification type, text format, and a caution message in red text.

Inbound Mail Disclaimers

Recommendation:

Federated Login Enforcement

The Notes Client can be configured against a federal login meaning that instead of typing your Notes ID file password you are providing your ADFS credentials.

You now have the option of having NFL mandatory by setting this variable:

Notes.ini Make NFLMandatory=1

HCL Notes login screen with blue abstract design. Fields for email and password. Text reads "Your SAML IdP Name" and "At Location."

Let us know which security features you find most useful. Don’t hesitate to contact us if you have any issues with Domino V14, we are happy to be of service.

Filed under hcl domino