OPENNTF WEBINARSMarch 16, 2023
OpenNTF March, 2023 Webinar:
TOTP - This is the Way

AGENDA• Welcome• Presentation
Keith Brooks• Q and A

THANKS TO THE OPENNTF SPONSORS• HCL made a contribution to help our organization• Funds these webinars!
• Contests like Hackathons• Running the organization• Prominic donates all IT related services• Cloud Hosting for OpenNTF• Infrastructure management for HCL Domino and AtlassianServers• System Administration for day-to-day operation

THIS IS OUR COMMUNITY• Join us and get involved!
• We are all volunteers• No effort is too small• If your idea is bigger than you can do on your own, we
can connect you to a team to work on it• Test or help or modify an existing project• Write guides or documentation• Add reviews on projects / stars on Snippets

UPCOMING EVENTS• Engage User Group Meeting
The Future is NOW
April 24-26
Felix Meritis
Amsterdam, Netherlands• MWLUG• In Person!
• Save the Date, August 30 and 31

ADMIN REPAIR CAFES• Bring your topic!
• Discuss ideas on how to tackle the issue• Two Scheduled this month:• Wednesday, March 22 at 12:00PM Eastern US time (EDT)• (APAC) Thursday, March 23 at 9:00PM Eastern US time
(EDT)

NEXT WEBINAR
April Webinar: Domino REST API by HCL
April 20thASKING QUESTIONS• First Question – Will this be recorded?

• Yes, view on YouTube!!!
• https://www.youtube.com/user/OpenNTF• Use the Questions Pane in GoToWebinar• We will get to your questions at the end of
the webinar• The speakers will respond to your questions
verbally• (not in the Questions pane)• Please keep all questions related to the
topics that our speakers are discussing!!!
• Unrelated Question => post at:• https://openntf.org/discord

PRESENTATIONOpenNTF March, 2023 Webinar: TOTP - This is the Way
Keith Brooks

OPENNTF WEBINARSMarch Edition
Presented by Keith Brooks@LotusEvangelist
HCL Ambassador
IBM Champion
OpenNTF Contributor

AGENDA• Welcome – Howard Greenberg and Graham Acres• Presentation –• Q and A - All

Keith Brooks
CEO - B2B Whispererkeith@b2bwhisperer.com

2

Keith Brooks

Blog: https://blog.vanessabrooks.com
keith@b2bwhisperer.com@Lotusevangelist
Certificate Exams Writer 2012-2014, 2022

2013-20192019 - 2023

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythinghttps://www.statista.com/statistics/1305250/reasons-for-not-using-mfa-us-uk/

WhatisWhat
is this
thisMFA
MFA
Thing?
Thing?

6• MFA (Multi-Factor Authentication)• OTP (One Time Password)• HOTP/HMAC OTP (Hash-Based
Message Authentication
Code/Counter)• TOTP (Time-Based One-Time
Password)• Are Notes ID files a form of MFA?
• Is SSO a form of MFA?
• Is SSO a secure idea?
• Why do you, or your customers, need
TOTP?

Insurance/ComplianceReasons for TOTP

Reasons Against TOTP

Insurance/Compliance/Security

What security does it add if the MFA is on
the phone?
Increase in Support Tickets due to lockouts
Must login every time to check for mail,but this can be adjusted
ID Vault may not be up to date foreveryone to have their ID files there
SAML is not supported for TOTP

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythingThis is the way

TOTP for Domino
Is URL defined,
NOT
Server or Application defined!
The setup and installation is Server
defined,but how a user interacts with TOTP,
starts with a URL,

ALWAYS!

Planning
is
a
MUST

• iNotes is the most common TOTP requirement• iNotes Redirector works with TOTP
• Web applications also are a top TOTP
requirement• What if you also have Traveler/Verse users?
• https://help.hcltechsw.com/traveler/12.0.2/mobile_support_totp.html• You may need some secondary
domains(Internet Site Documents) because
Traveler users will not want to log in every time tocheck their mail.

Applications vs Mail for TOTP
Application /Product
Verse/iNotes

Internal /External
Internal

TOTP
RequiredNo

Website URL Example (Need a website document per URL)
MAIL.ABC.COM

Verse/iNotes

External

Yes

WEBMAIL.ABC.COM

Application

Internal

No

APPN.ABC.COM

Application

External

Yes

APPT.ABC.COM

Traveler/VerseExternal

Yes/NoTRAVELER.ABC.COM

NOMAD

External

Yes/NoNOMAD.ABC.COM

DOESN’T WORK WITH DOMINO
TOTP
Remember to update your outside and inside, DNS and FirewallWho’s ready for NOMAD?
Domino TOTP is NOT supported by
NOMAD

NOMAD
and
TOTP

NOMAD will work with some other
TOTP offerings, namely HCL’s SafeLinx.
If you want DOMINO TOTP to workwith NOMAD,
go vote for it:
https://domino-ideas.hcltechsw.com/ideas/DMA-I-179

TOTP
Prerequisites• User’s IDs need to be in the ID Vault that is set
up and working correctly• Server must be R12• Mail templates do not need to be on R12,
but should be if possible• Need a cert.id file accessible in the server Data
directory• If putting it there now, you may need torestart the server to recognize it properly• SSL should be enabled. Most companies havedone this. If you have not, creating SSL
certificates is included in R12 for free*Mail Users, ID Vault ID Files, and TOTP
User

Type of User

Internal

Mail(Notes/iNotes/Verse)
Mail(Notes/iNotes/Verse)
Mail(Notes/iNotes/Verse)
Mail(Notes/iNotes/Verse)

External
Internal
External

ID File in
Next Steps
Vault
Yes
Set up a URL, Set up TOTPYes

Set up a URL, Set up TOTPNo

Set up a URL, Create ID Vault, upload ID via.csv or wait for login^, Set up TOTP
Set up a URL, Create ID Vault, upload ID via.csv or wait for login^, Set up TOTP

No^=To enable the use of ID vault for iNotes users, select Yes for Allow Notes-based
programs to use the Notes ID vault on the ID Vault tab of the Security policy settings
document.

App Users, ID Vault ID Files, and TOTP
User
Internal

Type of User
Applications Only

ID File in Vault
Yes

External
Internal

Applications Only
Applications Only

Yes
No

External

Applications OnlyNo

Next Steps
Set up a URL, Set up TOTP
Set up a URL, Set up TOTP
Set up a URL, Create ID Vault, upload ID
via .csv*, Set up TOTP
Set up a URL, Create ID Vault, upload ID
via .csv*, Set up TOTP*= Must be registered as a Notes user with a mail file and home server• The .csv file and details to correct everything is in a blog post I wrote:•

https://blog.vanessabrooks.com/2021/10/sntt-totp-needs-id-file-in-id-vault-to.html\• You will need to write some simple agents, as explained, and delete unwanted mailfiles in the mail folder.
• If you agree HCL could do better and fix this for us, go vote on the Aha request
here: https://domino-ideas.hcltechsw.com/ideas/ADMIN-I-99

Most common way is once the ID Vault is running, the IDs go
there automatically when created or recertified

How to put
ID Filesinthe
ID Vault

But what if you already have 1,000s of people registered andnow created the ID Vault?

The process is a mix of Registering users via a .txt filecoupled with some automatic settings
Due to time constraints, I have provided links to blog posts
from myself and Ales Lichtenberg that explain how to do thisand can be found at the end of this presentation

MobileClientSupportandLimitsfor
TOTP
Authenti
cationTOTP Support requirements• HCL Verse for Android 12.0.0 and later clients. HCL Verse for iOS
12.0.2 and later clients.
• Traveler server endpoint configured for TOTP authentication (requires
HCL Domino 12.0.0 and higher).
• 3rd party signed SSL certificates for the Traveler server endpoint.
Limitations• TOTP authentication support is limited to the HCL Domino support.
Authentication proxies that may provide multi-factor authentication
are not supported.
• The HCL Companion or To Do applications for iOS do not support TOTP
Authentication.
• TOTP authentication is not supported by clients that use the Microsoft
Exchange ActiveSync protocol, including the Apple iOS Mail client.
• The HCL Traveler for Outlook clients does not support TOTP
Authentication.
• TOTP authentication is not available when working with encrypted
mail. The end user is prompted for their Notes ID password.
• For HCL Verse Android, application passwords are not supported when
configured for TOTP authentication. A Traveler server setting or policy
setting requiring application passwords will be ignored.

No
SAML
or
Basic
Authentication

SupportTOTP is NOT available for Basic Authentication
or SAML Session Authentication configurations.
https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_enabling_for_server_t
hrough_internetsite.html

One customer wants to use SAML for users
from Windows computers and TOTP forother devices (Mobile/tablets).

SAML
and
TOTP

They will end up with multiple URLs since
TOTP does not support SAML.
It is easier if you are talking about specificcustomers or applications.
Not simple if random people in yourcompany or customers need it.

Your
CertifierID
andPassword
is
Required

The cert.id needs to be placed in the Domino\datadirectory to set up TOTP. It can be removed once TOTP is
setup.
Let us presume you have no idea where your Certifier ID
is, or maybe you lost the password to it.
What do you do now? TOTP Requires it for the setup
If you said, you need to create a new certifier, migrate
everyone to it, or cross-certify everyone for the moment,
you win this round.
OR
If you had the CA setup there is a way to reverse out yourID and passwords.

If you follow Best Practices and maintain at least a Dev andProd environment, great, but some of you live dangerously.

Windows
ServerUpdateAnd
DominoR12
UpdateIf you are replacing your old Windows server and upgrading
to R12, you may find the TOTP process easier while testingwith a clean environment.

You can copy the R9 files to the R12 server and configure
everything as needed, just do not turn on replication withthe old server until you are ready to cut over the data. You
have been warned!
Once you build a new server to migrate the old data, how
do you manage the ID Vault on 2 servers and versions?

Remember When You Created Your ID Vault?
1. Guess what?
• It expires after 10 years! WTF? Right? Go renew it!
Your ID
Vault Age
2. At the time you created an ID Vault ID file, youandalso created a password at the same time.
Password• Why do you need it now?
• You will need the password for your ID vault ID filearein order to replicate your ID vault to your new R12
Importantserver.
••https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0037905
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0076358•

Why would I do that?

You may want to replicate the ID Vault
from the old one:• https://help.hcltechsw.com/domino/11.0.0/conf_addingorremovingidvaultservers_t.html

ID Vault
Replication
But you may run into a snag looking foranda lost id vault ID and password
Building a• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0038943
New
Server
The below won’t help either. You need
the original password• https://help.hcltechsw.com/domino/10.0.1/conf_changingthepasswordonthevaultidfile_t.html

Because the ID Vault is so integral to TOTP, you
should review the policies, settings, and especially
the Administrators assigned to the ID Vault.
Now is an excellent time to update your Admins
listed.

UpdateYour ID
Vault
AdminsPassword Reset:
In the Admin client, open the names.nsf – SecurityID Vaults-Password Reset Authority
Add/Remove Vault Administrators:
In the Admin client, open the names.nsf – SecurityID Vaults- Manage- Add or Remove Vault
Administrators

•Create or replicate an ID vault on the Domino
on Docker server.
•All TOTP-specific configuration is saved in users'
ID vault documents.

TOTP forDockerRequires•Make sure that the websites or virtual servers
within the Docker container are accessible
from outside the container.
•HCL recommends running the Domino HTTP
server with a default Internet site, TLS
enabled, and Server Name Indication (SNI)
enabled to connect to a web site or hostname.

You can enable TOTP authentication for users in asecondary Domino domain.

Configuringcrossdomain
TOTPauthenticat
ion

When the configuration is complete, users registered in
the secondary domain can set up and use TOTP
authentication configured in the primary Domino domain.

NOTE:
Domino Web servers from both domains participating in
TOTP authentication must run at least Domino 12.
At least one ID vault server in the primary or secondary
domain must run at least Domino 12.
There are steps to run in both the primary and secondary
domains.

Configuring
thePrimary
Domainfor crossdomain
TOTP
Authentica
tion

1.Add the following notes.ini setting to all Web servers in Domain1 and to the ID
vault server in Domain1:ENABLE_IDV_CROSSDOMAIN_AUTHENTICATION=1
2.Ensure the Domain1 Domino directory has a Notes cross-certificate at the /Orglevel for Domain2 that establishes trust.
3.Configure DA (directory assistance) to look up names in the Domain2 Domino
directory.
• Create a directory assistance database (if not created already) on a server in
Domain1.
• Add a Directory Assistance Document for Domain2. The following fields inthe document are required•On the Basics tab: Domain type Select Notes.
•Domain name Specify the Domino domain of the secondary
directory•Make this domain available to Select Notes Clients & Internet
Authentication/Authorization•Enabled Select Yes.
4. On the Naming Contexts (Rules) tab, select Enabled > Yes and Trusted for
Credentials > Yes for at least one rule that applies to Domain2.
5. On the Domino tab, specify the replica of the Domain2 Domino directory on the
Domain2 administration server.
6. Configure TOTP authentication for Domain1 like normal.
7. Replicate the Domain1 Domino directory and Directory Assistance database to
all participating Web servers in Domain1.

Configuring
theSecondary
Domainfor CrossDomain
TOTP
Authentica
tion

1.Add the following notes.ini setting to all Web servers in Domain2 and to the ID
vault server in Domain2:ENABLE_IDV_CROSSDOMAIN_AUTHENTICATION=1
2.Ensure that the Domain2 Domino directory has a Notes cross-certificate at the/Org level for the Domain1 /Org that establishes trust.
3.Create a replica of the Domain1 Domino directory on the ID vault server for
Domain2.
4.Configure directory assistance on the ID vault server for Domain2 to look up
names in its local replica of the Domain1 Domino directory.
1. Create a directory assistance database (if not created already) on the ID
vault server for Domain2.
2. Add a Directory Assistance Document for the Domain1 Domino directory.
The following fields in the document are required•On the Basics tab: Domain type Select Notes.
•Domain name Specify the Domino domain of the secondary
directory.
•Make this domain available to Select Notes Clients & Internet
Authentication/Authorization•Enabled Select Yes.
•On the Naming Contexts (Rules) tab, select Enabled > Yes andTrusted for Credentials > Yes for at least one rule that applies to
Domain2.
3. On the Domino tab, specify the replica of the Domain1 Domino directorythat you created on the ID vault server in Domain2.

Configuring
theSecondary
Domainfor CrossDomain
TOTP
Authentica
tion
Continued

4. Run the following commands from the server
console of the ID vault server to create Multi-Factor
Authentication Certificates for the Domain1 Org
and the Domain2 Org using each one’s respective
certifier id.
mfamgmt create trustcert <Notes DN1 to allow><certifier ID1 file> <certifier1 password>
Example: mfamgmt create trustcert */O=Org1 cert1.id P@ssword1

mfamgmt create trustcert <Notes DN2 to allow><certifier ID2 file> <certifier2 password>
Example: mfamgmt create trustcert */O=Org2 cert2.id P@ssword2

These certificates are created in the Domain2
Domino directory.
Replicate the Domain2 Domino directory andDirectory Assistance database to all participating ID
vault servers in Domain2.

TOTP requires the ID vault to have the V12 design andbe running on a V12 server.
Will this cause problems for other servers with the ID
vault not yet upgraded to V12?

Common
Question

Yes, and No.
HCL says it is fine.
• My customers have not been able to do this without
issues.
• You can run an ID Vault from another server in
conjunction with TOTP on a different server.
• As long as both servers are R12 AND their templates
have been updated for ID Vault, DOMCFG and the
Directory

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythingGo to the server console (easier from the Adminclient) and after putting the cert.id on the server
type:•

Configuration

Step1

mfamgmt create trustcert */O=domainname cert.id certidpassword• Replicate the Directory across your domain• In the Directory, check the Certificates view for a
Multi-Factor Authentication Certificate section• From a server console type: show idvault• Look for the following:• Administration Server: DOM1/Domain• /DOMAIN trusts this vault• /Domain trusts /Domain for MFA
COMMAND SENT: sh idvault
ID Vault /VBI_ID (IBM_ID_VAULT\VBI_ID.nsf)
Vault Name: /VBI_ID
Description: VBI ID Vault
Administrators: Keith Brooks/VBI
Servers: Music/Server/VBI
Administration Server: Music/Server/VBI/VBI trusts this vault/VBI trusts /VBI for MFA
Setting VBI_IDVaultSetting uses this vault

Configuration

Step
2

1. From the Admin client, open the
Configuration tab
2. Go to the Messaging section
3. Open the Default Configuration
Settings document (or the server
specific one that will handle theTOTP)
4. Open the Security tab
5. Configure the MFA options (Seenext screen for example)
6. Save the page and close it

# of Devices:pc, phone, ipad

Select the one
you requireThis supports
Google, PingID.
Authy, Duo,Microsoft use
HMAC-SHA1

Configuration - Step 3 (Web Site Document)
From the Directory go
to the ConfigurationWeb-Internet Sites

Go to the Configurationtab

Go to the Security tab

In the web site
document go to the
Domino Web
Engine tab

In the Domino
Access Services
section select TOTP
from the drop down

Select the TOTP
option in bothName and
Password fields

Set Session
Authentication toSingle Server

In the Allowed
Methods section,
you must check
Delete and Put

Save your changes

Configuration

Step
4A(SecureMail
Operations)

Note: When you enable this feature, the ability for
iNotes users to upload and download their IDs to andfrom the vault is disabled.
• Open the Security Settings Policy document andclick the ID Vault tab.
• In the section TOTP-based ID Downloads,
select Yes in the Allow TOTP authentication with
the ID vault field.
• To allow web users who do not use TOTP tocontinue downloading their Notes IDs for secure
mail operations, select Yes in the Allow password
authentication with the ID vault.
• To require all web users to use TOTP to
download their Notes IDs, select No.

Configuration

Step 4B(SecureMail
Operations)

In the vault Configuration document of theidvault.nsf (IBM_ID_Vault folder), specify theservers that use the ID vault and are enabled for
TOTP and secure mail operations.
• Open the vault database.
• Open the Configuration document.
• In the TOTP authenticated vault
login section, specify all of the Domino web
mail server names in the Trusted
servers field.

38

NOTE: If you have a domcfg file, you can skip thisand go to the next page
How to Create the Domino Web Server Configuration
database (DOMCFG.NSF):

Configuration

Step 5A(The TOTP
Login
Form)

1.From the Domino Administrator, choose
File > Application > New
2.Enter the name of the Web server in
the Server field
3.Select Show Advanced Templates
4.Select the Domino Web Server Configuration
template (DOMCFG5.NTF)
5.Enter a Title for the database
6.For the File name field, you MUST
enter DOMCFG.NSF
7.Click OK

Configuration

Step 5A(The TOTP
Login
Form)

Need to Specify the $$LoginUserFormMFA as the login form:• Open the DOMCFG.NSF and open the Sign In
Form Mappings view.
1.Click Add Mapping.
2.Under Site Information, choose either: All Web
Sites/Entire Server or Specific Web Sites/VirtualServers• To use the custom log-in form for all Web Sites
on the server, or for the entire Web server• Or to map the custom log-in form to specific Web Site
documents or Virtual Servers.

• Under Form Mapping, for Target
Database specify DOMCFG.NSF• And for Target Form, specify $$LoginUserFormMFA.

Make sure you set the ACL properly
for the domcfg.nsf
Configuration

Step 5C(ACL andRestart)And then restart your ID Vault
server

41

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverything• TOTP is supported for HCL Verse 2.2 users.

What was
New for
TOTP in12.0.1• When users who do not have Notes IDs in
the ID vault try to log in when TOTP isenabled, they now see the message:• Multi-Factor Authentication is
supported for vaulted users
only.

43

Setting

Description

TOTP_STEPSIZE=seconds

How long, in seconds, a TOTP token is valid. Without
the setting, tokens are valid for 30 seconds before
they expire.
NOTE: Not all TOTP applications honor this setting.

If you feel your users require more time,
this is where you change the default

Notes.ini
Optional
Settings
These
Require aServerRestart

TOTP_TIMESKEW_STEPS=TOTP_STEPSIZE
factorAdditional time allowed to accommodate timedifferences between the ID vault server and the user
devices.
Specify the TOTP_STEPSIZE factor to add before andafter the TOTPStepSize.
By default, the value is a factor of 1, meaning
assuming default TOTP_STEPSIZE value of 30 seconds,
by default an allowance of 30 seconds is added
before and after.

ENABLE_IDV_CROSSDOMAIN_AUTHENTICATION=1

If directory assistance is configured for cross-domain
directory lookups, add the notes.ini setting to your
Domino servers. Then, when a user accesses a
Domino server and the user is registered in asecondary domain, the server is able to access the ID
vault in the secondary domain to manage TOTP
authentication.

If you need DA Cross-Domain
lookup support add this one

DEBUG_TOTP=2
To help troubleshoot TOTP problems, use
Very
Detailed
DEBUG_IDV_TOTP_TRANS=1
these settings to enable debug logging in
info
to
help
you
DEBUG_IDV_TRUSTCERT=1
console.log.

Some
IDVault
Debug
Parameters•

DEBUG_IDV_CONNECT=1 (Details each ID Vault Connection)•

DEBUG_IDV_API=1 (checks ID Vault API access)•

DEBUG_IDVAULT_SERVER_SELECTION=1 (Traces search for an ID
Vault Server)•

DEBUG_INETPWD_CHECK=1 (checks internet password)•

WEBAUTH_VERBOSE_TRACE=1 (authentication, access, andLDAP verifications)•

DEBUG_SAML=31 (full SAML debug)•

DEBUG_IDV_QVAULT=3 (1 does not help, use 3)•

DEBUG_IDV_TRACE=1 (ID Vault Client behavior)•

DEBUG_IDV_TrustCert=1 (ID Vault trust certificate validation)•

DEBUG_IDV_ViewUpdate=1 (force update the IDFile view in the
Vault on each look up of the user in the Vault)•

DEBUG_IDV_IDP_CONFIG=1

If you do not see “Upload ID Files to ID Vault” when you
right-click on a user in the Directory, or when selecting
Actions from the menu bar, you may have a “no update
People view” customization in your directory

Unable toUpload ID
Files

One way to fix this, open your Directory in the Designerclient and find the People View and, in the Properties, –Design box below, uncheck “Prohibit design refresh or
replace to modify”

If you see this message in your server console orlogs, your ID Vault was not properly setup.

ID Vault
CreationError

1. Delete the Vault Trust and Multi-Factor
certificates, Security-Certificates section of
the Directory

2. Then recreate the ID Vault and run themfamgmt command again

AnotherAnother
ID Vault
ID Vault
Error
Error
Message

This points to ID Vault corruption
1. Delete the Vault Trust and MultiFactor certificates, SecurityCertificates section of the
Directory
2. Then recreate the ID Vault andthen run the mfamgmt commandIf
The MFAIs
Not
Allowing
User Setup• You may see the login page, that is presetin the domcfg.nsf• But it may not take you to the setup after
you try to login with your name andpassword• Or if you try to click on MFA it will not doanything• This means you may have to redo theconsole command: mfamgmt create
trustcert• And/or you may need to say NO in the
Configuration document where it asks
“Allow TOTP authentication with the ID
vault field”

If the server reports an error like one of thesewhen you try to check the TOTP Configuration:

Odd Issuewith
Some
Environm
ents

TOTP Configuration Checker Report
Checking Web Site MFA Site.
There is no 'Sign In' Form Mapping for Virtual Server
MFA Site.

You Need the Public Directory Template for 12.0.2 andverify domcfg is also up to dateTokenField isMissing
Error

This came up in testing.
The token field issue was because of 3 things.
1. A second reference to the TOTP server
showed up
2. The template(s) needed to get replaced
3. The domcfg, needed a new file created that
ignored the existing one, we had replicatedit overmfamgmt create trustcert */O=mfatest1 cert.id
C0llab$ph3r3
Server Console says it worked but• Server Console “Show IDVault” does not show it worked

CreateMfamgmt
Issues• Certificate list in the Directory does not show any MFA
Entry

Verify the Directory template is R12, most likely, it is not.
Once you replace the template, it will appear in theCertificate viewBypassing the TOTP authentication
If you have enabled Directory Assistance ( DA ) there’s
an issue where TOTP is bypassed.

Hot Fix
Alert
For DA
Issue in12.0.1FP1

This is documented under SPR # SPPPCDVFB2 and a
hotfix is available to install on top of Domino server
version 12.0.1FP1.
If you enabled DA and want TOTP to be active, feel free
to open a case at HCL and receive the hotfix (should bein 12.0.2).

• HCL Verse for iOS already configured for TOTP Authentication• HCL Traveler server running on Domino 12.0.1 (any fixpack level)

Verse iOS
12.0.14andTraveler
12.0.1
with TOTP(1 weekago)• After updating the HCL Verse for iOS application to 12.0.14, the user fails
to login to the Traveler server via TOTP Authentication. After entering theuser's credentials and MFA token on the TOTP login form, nothing
happens after tapping "Login".

Workaround• The customer can upgrade the Domino version of their Traveler
server to 12.0.2 (or higher) to take advantage of the new TOTP
features available. HCL Verse for iOS 12.0.14 has added support forthe mobile setup of MFA on the HCL Verse mobile apps.
• Upgrading the Domino server to 12.0.2 will require that theTraveler server be updated to 12.0.2. If the Traveler server isalready running 12.0.2 when Domino is upgraded to 12.0.2, theTraveler server will need to be re-installed.
• After upgrading the Domino server to 12.0.2 it is recommended torun a Refresh Design on the DOMCFG.nsf using the updated
domcfg5.ntf template. This will ensure that the TOTP login form
will buse the new design and upport the Mobile MFA Setup on
Domino 12.0.2.
• Or go to Verse iOS 12.0.15• https://support.hcltechsw.com/csm?id=kb_article&sys_id=cd7784581b652190574121f7ec4bcbc9

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverything

How
Users
Set upTOTP• Users need to install on their device one of thecommon authenticator applications• Duo, Google, Microsoft, Authy, PingID, etc.
• Go to the Domino Login page with the TOTP
and then log in as usual FROM A COMPUTER• The system will bring them to the MFA setup• User enters a name for the account and thenscans the bar code shown on the screen or
enters the code into their Authenticator• Afterwards, they enter the code from theAuthenticator• They receive scratch codes for emergencies
and then select Done
• They log in as usual but now include theauthenticator code

Changing
Authentic
ation
Configurations

Enabling or disabling TOTP for the Traveler server endpoint
affects existing HCL Verse mobile clients.
Enabling TOTP for existing clients• An existing HCL Verse for Android client (that supports
TOTP) already configured for Traveler can detect and switch
to the TOTP authentication mode without requiring areconfiguration and re-synchronization.
• An existing HCL Verse for iOS client (that supports TOTP)
must be re-installed/re-configured to detect a TOTPenabled endpoint.
Disabling TOTP with existing clients• If the TOTP configuration for HCL Traveler is disabled,
existing HCL Verse mobile clients cannot switch back toanother authentication method. In this scenario, all clientsneed to be reconfigured.

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverything

Your Admin tools, while testing and after:
1. The Internet Password Lockout database• Users lock themselves out, and you will needto clear them from the lockout database

2. The ID Vault database

Managing
TOTP• The ID Vault database can tell you who has
set up TOTP plus more details

3. The Person Document• TOTP Configuration Check

4. The Server Document• TOTP Configuration Check

5. The Web/Internet Side Document• TOTP Configuration CheckTheInternet
Password
Lockout
Database

TOTP
ID Vault
Database

TOTP
PersonDocument

TOTP
ServerDocument

TOTP
Web /
Internet
Site
Document

A new qvault command option, -p, allows you to updateuser data in the ID vault.

New
qvaultOptionUpdatesUser
Data
12.0.1This option checks for new user certificates in the
Domino directory to update in the ID file stored in the
ID vault.
It also updates new ID file size and certificate expiration
columns in the Vault Users view.
The syntax for the command is: load qvault -x<vaultname> -u <username> -p.
Omit -u to run against all user data.

Example for all users: load qvault -x O=Renovations –p
Example run for one user:
load qvault -x O=Renovations -u "CN=John
Doe/O=Renovations" -pThe Query Vault (qvault) command provides options to inactivate
and reactivate a user's ID vault documents.
For example: if you have seasonal employees, you could inactivate
their ID vault documents when they're not working to prevent
them from authenticating and reactivate the ID vault documents
when they return.

New Query
Vault
To inactivate: load qvault -x <vaultname> -u <username> -i
Commands For example: load qvault -x O=Renovations -u "CN=Samantha(12.0.1) Daryn/O=Renovations" –I
To reactivate: load qvault -x <vaultname> -u <username> -v
For example: load qvault -x O=Renovations -u "CN=Samantha
Daryn/O=Renovations" -v

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythingResetting
the
Users
TOTP

You MUST log on as an ID Vault administrator
and then use one of these two options to reset auser's TOTP details:• From the ID Vault database• In the ID Vault Users view, select a user
• Select from the Actions menu “Reset TOTP
Items”• From the Domino Administrator client, selectthe People & Groups tab then:• Select Tools, then ID Vaults• Select the person document in question• Select Reset TOTP Configuration

CheckingandResetting
the User’s
ID Vault
Document

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythingCustomizing the Login Page Graphic
Export the
MFASetup1.png file
to your PC andopen in yourgraphic editor

Add your company logo
or any text on the LEFT
side of the graphic,
about an inch or 2 awayfrom the border

Upload the file byclicking “Import
Image Resource”
from the Designer
ClientRename theoriginal to #3

Change theoriginal Alias in
Basic properties
as well to #3

Set the alias in theProperties-Basics
box, to
MFASetup1.png
also

Save your changes,
replace domcfg.nsf
design and thenrefresh your login
pageOpen theDOMCFG5.NTF
file in the
Designer client

Go to ResourcesImages

Save the file to yourlocal desktop using
a different #(MFASetup2.png)

Rename theuploaded file to
MFASetup1.png

One client asked to remove the HCL Domino Namefrom being displayed.
A different client asked us to move it.

Customizing
theLogin Page
TEXT

• To edit the login form, open the Designer client• Open domcfg5.NTF• Go to the Forms list and open$$LoginUserFormMFA• Edit the HTML• Replace the domcfg.NSF design• Refresh your browser• Remember to test it!
• It may not appear where you think or how you expect
it to be seen if you are adding text

The Plan For Today
What is this MFA
thing? And why
you might need it

TOTP Planning andPrerequisites

How do we
configure TOTP

Troubleshooting
when the TOTP
configuration does
not work

User instructions
to setup TOTP on
their end

Managing Your
TOTP Environment

Resetting a User’s
TOTP Details

Customizing theTOTP Form Login
Pages

Links forEverythingLinks and References for TOTP Topics• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_overview.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_configuring.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_how_users_setup_totp.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_resetting_users_secret_keys.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_docker_requirements.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_totp_configuring_cross_domain.html• https://blog.vanessabrooks.com/2021/10/sntt-changing-some-but-not-all-users.html• https://help.hcltechsw.com/domino/12.0.2/admin/conf_registeringusersfromatextfile_t.html?hl=regis
tering%2Cusers%2Ctext%2Cfile• https://help.hcltechsw.com/traveler/12.0.2/mobile_support_totp.html• https://blog.vanessabrooks.com/2021/10/sntt-totp-needs-id-file-in-id-vault-to.html• https://blog.vanessabrooks.com/2010/06/id-registration-via-text-file.html• https://alichtenberg.cz/how-to-register-notes-users-from-a-file/• My Previous Decks about TOTP:• https://drive.google.com/viewerng/viewer?url=keithbrooks.com/download/SUTOL_2022_kbrooks_TO
TP.pdf• https://e1.pcloud.link/publink/show?code=kZ3PjRZclvMCiF7euVOlBTWLd9rl0c4zIx7• https://www.slideshare.net/kbmsg/yes-its-number-one-its-totp• HAR File Details: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0091868

QUESTIONS?

Thank You!

Keith Brooks@Lotusevangelistkeith@b2bwhisperer.com

QUESTIONS?
Use the GoToWebinar Questions Pane
Please keep all questions related to the
topics that our speakers are discussing!!!

Unrelated Question => post at:https://openntf.org/discord