OPENNTF WEBINARS
November, 2022
Integrate Keycloak with Domino for Identity Management
Heiko Voigt, sIT GmbH

AGENDA• Welcome• Presentation – Heiko Voigt• Q and A

THANKS TO THE OPENNTF SPONSORS• HCL made a contribution to help our organization• Funds these webinars!
• Contests like Hackathons• Running the organization• Prominic donates all IT related services• Cloud Hosting for OpenNTF• Infrastructure management for HCL Domino and AtlassianServers• System Administration for day-to-day operation

THIS IS OUR COMMUNITY• Join us and get involved!
• We are all volunteers• No effort is too small• If your idea is bigger than you can do on your own, wecan connect you to a team to work on it• Test or help or modify an existing project• Write guides or documentation• Add reviews on projects / stars on Snippets

DECEMBER HAPPY HOUR
• Join us in December for a virtual Happy Hour!
• Thursday 15th
• APAC, Europe, North America• Watch the web site for details

REPAIR CAFE
• Open chat room to bring your questions / problems /ideas• Share your tips
• What topics do you want?
• Use the Discord #suggestion-box• January 12 – Development Topics• January 25 – Admin Topics

ASKING QUESTIONS• First Question – Will this be recorded?

• Yes, view on YouTube!!!
• https://www.youtube.com/user/OpenNTF• Use the Questions Pane in GoToWebinar• We will get to your questions at the end ofthe webinar• The speakers will respond to your questionsverbally• (not in the Questions pane)• Please keep all questions related to thetopics that our speakers are discussing!!!
• Unrelated Question => post at:• https://openntf.org/discordPRESENTATION
Integrate Keycloak with Domino for identity management
Heiko Voigt

ABOUT HEIKO•CEO of SIT GmbH in Germany andHarbour Light Software Development Ltd. in Canada•

Software Architect for 25+ years with N/D, Full-Stack Web Developer•

HCL Ambassador 2019-2022, IBM Champion 2019•

Core Team Member at C3UG and Board Member at OpenNTF•

Proud father of twins•

Sailor, Home brewer

https://www.harbour-light.com

https://www.sit.deAGENDAFew things to clear out:
OAUTH2 != Authentication, only Authorization
OpenID Connect = Identity + Authentication + Authorization

What we will cover:• Keycloak and SAML/Web with Domino (Web + Notes SSO for DS <12.0.2 EA5)
• Keycloak and OIDC/OAUTH2 with AppDevPack and Domino REST APIs
• Keycloak and OIDC/OAUTH2 with Domino >= 12.0.2 EA3• Keycloak and VERSE / Nomad Web /XPAges

WHAT IS KEYCLOAK?

WHY IS KEYCLOAK A GREAT MATCH FOR DOMINO SHOPS?
•Reliable Solution“Red Hat running on Red Hat products (Red Hat SSO)”: the entire
authentication/authorization system is based on Red Hat SSO, which is thedownstream version of upstream product keycloak. It is designed following thestandard security protocols to provide a dynamic single sign-on solution tosmall/large scale industry.

•Open Source (3C’s) : Cost, Customizable / Contributions, Community
Apache License Version 2.0 with support of strong active open source community•

Is it ready for production?
Yes, it can be used in production (Make sure to read documentation guide)•Standard Protocols (supported by keycloak)- OpenID Connect- OAuth 2.0- SAML 2.0•

Applications/Tools that support integration with the above protocols can beplugged with Keycloak.
E.g. MFA components, FIDO2 plugins, HW-Token Handling and much much more.

OUR BASE ARCHITECTURE CHART…
Domino Backend
LDAPKeycloak

OIDCSAMLSPA /Web App

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb Server

SAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

DOMINO REST API/ADP OAUTH2/OIDC FLOWNOTES/DOMINO SAML CONFIGURATION
Create and configure IDP Catalog (idpcat.nsf)
Create trust configuration
Configure Domino HTTP SettingsSetup User Security Policy
If needed: configure ID Vault for federated Login (NotesClient)• Test!
•••••1) DOMINO WEB ACCESS SAML CONFIG – IDPCAT.NSF

1) DOMINO WEB ACCESS SAML CONFIGURATION

2) DOMINO REST API KEYCLOAK CONFIG

2) DOMINO REST API KEYCLOAK CONFIG

2) DOMINO REST API KEYCLOAK CONFIG

3)APPDEVPACK IAM REPLACEMENTLDAPKeycloak

Node.JS /Java/ C#Middleware
AppOIDC/OAUTH2
Additional
ClaimsConfigActAsUserProton
Task

DominoLanguage
BindingsADPConfig.nsf3)APPDEVPACK IAM REPLACEMENT - KEYCLOAK

3)APPDEVPACK IAM REPLACEMENT - SCOPES

3)APPDEVPACK IAM REPLACEMENT - INTROSPECTION

4) APPDEVPACK DSAPI FILTER – OIDC/OAUTH

DEV and Prod
Environments,
Docker (Cluster)Node.JS /Java/ C#Middleware
App

IDP, e.g.
KeycloakOIDC/
OAUTH2
Clients &Claims
Config

Granular access toapps additional to
ACL in DB

Act
As
User

ProtonTask

DominoLanguage
Bindings

ADPConfig.nsf

App & Claims
Definitions

5) DOMINO 12.0.2 – “DANUBE” & OAUTH/OIDC

KEEP
DEV and ProdEnvironments,Docker (Cluster)

4IDP, e.g.
Keycloak

231Web App /XPages(?)

5OIDC/OAUTH27Domino
65) DOMINO 12.0.2 – “DANUBE” TLS IN CERTMGR

5) DOMINO 12.0.2 – “DANUBE” OIDC PROVIDER CONFIG

DOMINO 12.0.2 “DANUBE” KEYCLOAK CONFIGDEMO – REST APIS, XPAGES, OIDC/SAML, SPA

sedulnc Webiw do
N amreo
N Serv o!
inmDo

1ST APP…
Domino Backend
LDAPKeycloakOIDCSAMLSPA /Web App

NGINX RP/LBHTTP

ScopeMapping
NSF

DSAPI / OIDCNOMAD
Web Server

SAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

2ND APP…
Domino Backend
LDAPKeycloak

OIDC

SAML

SPA /Web App

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb Server

SAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

3RD APP… VERSE
Domino Backend
LDAP

Keycloak

OIDC

SAML

SPA /Web App

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb Server

SAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

4TH APP – DOMINO 12.0.2 OIDC
Domino Backend
LDAP

Keycloak

OIDC

SAML

SPA /Web App

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb Server

SAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

5TH APP - XPAGES
Domino Backend
LDAP

Keycloak

OIDC

SAML

SPA /Web App

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb ServerSAML/OIDC

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

6TH APP – NOMAD WEB FOR DOMINO
Domino Backend
LDAP

KeycloakOIDCSAML

Browser

NGINX RP/LB

HTTP

Scope
Mapping
NSF

DSAPI / OIDCNOMADWeb ServerSAML

NSF
NSF

SPA

Domino REST APIs

App Server(Express / Java/ .NETMiddlware)

OIDC

ADP/Proton

NSF

ADPConfig.nsf

NODE.JS SAMPLE CODE OIDC CLIENT (KEEP & ADP) - AUTH

Standard OIDC Clients vs.
Vendor Specific Packages!

Same Code for different APIsNODE.JS SAMPLE CODE OIDC CLIENT (KEEP & ADP) - CALLBACKKEYCLOAK & THE REST OF THE (HCL-) PACK….

SSO between Connections, SameTime and Domino can be done via Keycloak.
We can also include DX and even Commerce.
https://help.hcltechsw.com/connectionscloud/_012_Keycloak+Authentication+and+SSO/download/Keycloak+Authentication+and+SSO.pdf

MFA & STEP-UP AUTHENTICATION IN KEYCLOAK• Keycloak supports step up authentication• TOTP Config per REALM & Users• Supports Google Authenticator and FreeOTP• Business Rules for Step Up Config• Apps request thestep up flow bysending ACR levels• For APIs as well!

With step-up authentication, WebApplications or APIs that allow access todifferent types of resources can require
users to authenticate with a stronger
authentication mechanism to accesssensitive resources.

WHAT IS IDENTITY BROKERING?
Identity Brokering
An Identity Broker is an intermediary service that connects multiple service providers withdifferent identity providers. As an intermediary service, the identity broker is responsible forcreating a trust relationship with an external identity provider in order to use its identities toaccess internal services exposed by service providers.
From a user perspective, an identity broker provides a user-centric and centralized way tomanage identities across different security domains or realms. An existing account can belinked with one or more identities from different identity providers or even created basedon the identity information obtained from them.
An identity provider is usually based on a specific protocol that is used to authenticate
and communicate authentication and authorization information to their users. It can be asocial provider such as Facebook, Google or Twitter. It can be a business partner whoseusers need to access your services. Or it an be a cloud-based identity service that youwant to integrate with.

WHAT’S THE TAKE ?
•Keycloak covers all SSO angles for the HCL Digital Solutions
portfolio.

•

Keycloak offers Identity Brokering capabilities for free•

Token mapping between SAML and OIDC is brilliant•

Open Source and Extensibility•

Cloud Hosting, SaaS and on-premises•

High availability scenarios available (on-prem and SaaS)•Keycloak brings even more that we did not cover(WebAuthn, MFA …)

Keycloak & HCL Domino The perfect match for all things SSO.

QUESTIONS

Thank you !
Heiko Voigt• heiko.voigt@harbour-light.com• @HarbourLightcom• https://github.com/heikovoigt
https://www.c3ug.ca/

QUESTIONS?
Use the GoToWebinar Questions Pane
Please keep all questions related to thetopics that our speakers are discussing!!!
Unrelated Question => post at:https://openntf.org/discord