Implementing Certificate Based Authentication for HCL Traveler Access - EngageUG 2020
- 1. Implementing Certificate Based Authentication For HCL Traveler Access Because Basic Is LAME! 1#engageug
- 2. About Me • Milan Matejic • First contact with Notes → 2012 • Thinks he knows something about • HCL Collaboration portfolio • DeskCenter • Mail migrations 2#engageug
- 5. About Us • Axians ICT Austria GmbH 5#engageug
- 6. Table Of Contents • Why is this interesting? • How does it work? • What do we need? • Implementation • Demo 6#engageug
- 7. Table Of Contents (Cont.) • General thoughts for production use • Some issues • Sources • Any questions? • Bonus! 7#engageug
- 8. Why Is This Interesting? • Lazy users • Bad passwords • Close to SSO • Comfort • Mutual authentication • MDM & Windows CA 8#engageug
- 9. 9#engageug
- 10. How Does It Actually Work? • CA (Certificate authority) • User certificate • Device certificate • Authentication confirms identity of both parties 10#engageug 1. User enters private-key password. 2. Client retrieves private key and creates digital signature. 3. Client sends certificate and digital signature. SSL Connection 4. Server uses the data received to authenticate the user. 5. Server authorizes the user to access the requested data.
- 11. 11#engageug 1. User enters private-key password. 2. Client retrieves private key and creates digital signature. 3. Client sends certificate and digital signature. SSLConnection 4. Server uses the data received to authenticate the user. 5. Server authorizes the user to access the requested data.
- 12. What Do We Need? • Traveler server (requires SSL) • Basic knowledge about certificates • OpenSSL or a CA 12#engageug
- 13. What Do We Need? (Cont.) • KeyTool / Key Store Explorer or similar • KYRTool • Access to Domino Directory • Android device 13#engageug
- 14. Implementation • Create CA & user certificates • Import CA certificate • In the Domino Directory • In the Keyring File • In the Java „cacerts“ 14#engageug
- 15. Implementation (Cont.) • Import user certificate to the person document • Push the user certificate to the mobile device • Switch to certificate-based authentication 15#engageug
- 16. Create CA & User Certificates • Windows CA • OpenSSL • „make_certs.cmd“ from AppDev Pack • Still using OpenSSL 16#engageug
- 17. 17#engageug
- 18. Import CA Certificate To The Domino Directory • Via Notes/Administrator client „Actions“ ➔ „Import internet certificates“ 18#engageug
- 19. Import User Certificate In The Person Document • Via Notes/Administrator Client „Actions“ ➔ „Import internet certificates“ • Or via Proton task: load proton --importcert c:certsuser.crt 19#engageug
- 20. Import CA Certificate In The Keyring File • Existing keyring file • kyrtool import roots -i C:root.crt -k "C:HCLnotesdatakeyring.kyr„ • Very well documented! • Do this on a client! 20#engageug
- 21. Import the CA To The Java CACerts • Default PW „changeit“ • <Domino_program_directo ry>jvmlibsecurity 21#engageug
- 22. Import The CA To The Java CACerts (Cont.) • Java Keytool • C:IBMNotesjvmbin • keytool -import -trustcacerts - keystore $JAVA_HOME/jre/lib/security/ cacerts -storepass changeit - alias Root -import -file Trustedcaroot.txt • KeyStore Explorer • Do this on a client! 22#engageug
- 23. Push the User Certificate To The Mobile Device • P12 file • CA & personal certificate • Including private key • MDM • Not part of Domino • Use e-mail for testing 23#engageug
- 24. Switch To Certificate-Based Authentication • Change the security settings • Restart • Test using browser 24#engageug
- 25. Demo 25#engageug
- 26. 26#engageug
- 27. What Happens If We Enable… • „Name & password“ & „Client certificate“ • Multi-factor!? • Additional authentication option • Product ideas • DOMINO-I-1172 27#engageug
- 28. General Thoughts For Production Use • Automation • Create • Import • Rollout • Renew 28#engageug
- 29. Some Issues • iOS App doesn´t supports certificate-based a. • Product ideas (VRSIOS-I-18) • No automated way for importing user certificates in Domino • Dependent on MDM 29#engageug
- 30. Sources • HCL Domino official documentation • HCL Domino AppDev Pack • knowledge.digicert.com • Pixabay, Unsplash • keystore-explorer.org • imgflip.com 30#engageug
- 32. Remember Paul!? • Protect your server IDs with a PW… • Paul is still killing puppies… • Don´t let Paul kill puppies… 32#engageug