Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

ADFS Configuration in German

Daniel Nashed  29 August 2018 22:33:22
Today I hit the first German ADFS configuration.
Looking into the German UI I was completely lost on first look.
The UI translation really opens a lot of questions. I really had to take my English server to compare and find out what they really mean.

I cannot recommend using a translated UI. You should really use it in English!

After having a look into the UI I googled the the German documentation.
If you are German speaking you should have a look. This is really too funny!!

The screens are still English. The text looks completely machine translated and even the German settings in the description is machine translated and doesn't match the German UI in the product.

Here is a link and I also appended a current snapshot of the page.

-- Daniel

https://docs.microsoft.com/de-de/windows-server/identity/ad-fs/operations/create-a-relying-party-trust


Domino 10 Platform Requirement based on build plattform

Daniel Nashed  21 August 2018 18:50:23
Just learned that the new Linux build platform and version for Domino 10 means that the only supported platforms will be SLES 12, RHEL 7.4 and CentOS 7.4.

The main reason for not supporting RHEL 6.x is the older libs that come with RHEL 6.x including RHEL 6.10 (just checked).
RHEL 6.10 still comes with GLIBC 2.12 and RHEL 7.4 comes with GLIBC 2.14. There is no easy way to upgrade the GLIBC version!

So you have to keep that in mind and should already have a look into RHEL 7.4 / CentOS 7.4.
7.4 is stable and not much more complicated beside one major change.
Instead of init.d SLES 12 (which already around for a longer time) and RHEL 7 leverage systemd which is quite a change!
But the good news is that my start script already supports it for quite a while and many customers are happy with their RHEL 7.x environments.

I am posting that as a heads up to be prepared. That also means that I have to upgrade my production machines to a new version once Domino 10 is available..

-- Daniel



Notes 9.0.1 FP10 IF4 and Domino 9.0.1 FP 10 IF3 released

Daniel Nashed  15 August 2018 05:38:03
Finally the long waited new Interim Fixes for FP 10 have been released.

Notes 9.0.1 FP10 IF4 and Domino 9.0.1 FP10 IF3 are available for download.


I have already installed IF3 on Domino Linux64.

But there is no official fixlist available yet.


Confirmed are the following two important fixes:


SWAS96ZP5B: Server hang due to semaphore deadlock between a doc update & nsf search (cc# 323200)

JMANAS8HZP - Crash on router after upgrade to 901FP9 on nIMAP with PANIC: OSBBlockAddr: Bad BBlock handle (FFFFFFFB) (cc# 322553)


The fixlist should be updated soon.

This link will show the updated fixlist -->
https://www.ibm.com/support/docview.wss?uid=swg21657963

For those two SPRs alone it makes sense to look into Domino 9.0.1 FP10 IF3 asap.

Update 15.8.2017: The fixlist has been released. And there are also important fixes on the client side. The 4K issue has been fixed as well. So this is great news.


And there is a fix for a crash that had impact on server and client!

See details below..


-- Daniel



Domino 9.0.1 FP 10 IF3


JMANAS8HZP    Fix a crash on router after upgrade to 901FP9 on nIMAP with PANIC: OSBBlockAddr: Bad BBlock handle (FFFFFFFB)

SWAS96ZP5B    Fix a server hang due to semaphore deadlock between a doc update & nsf search
MSKAAYZMRS    Fix an issue where the service provider XML exported from idpcat.nsf is missing the encryption certificate
RJDTARDK8U    Fix an issue where authentication is trying to use the Spengo token for the user name instead of pulling the name from the Spengo token
SCRL9JVMER    After Upgrading To 9.01 From 8.5 Domino Server, there Was A Change In The Way That The Address Header Was Being Sent
YYYY9BN6KK    Fixed a crash opening a database


Notes 9.0.1 FP 10 IF4

Help > About shows 9.0.1FP10 SHF252
         

JYJG9PAAUB    Fix a database icon issue where it wasn't updated after a user's home/mail server has been changed during the user move process

YYYY9BN6KK    Fix a Notes crash opening a database
ARUIB25MFN    Remove dependency on ffi29.dll
ANKUATR9RJ    Fix a high resolution screen issue (Regression with FP10)
GKSIAYNPVL    Fixed an issue where an upgrade with ST addons should work
HPUTAZEDJM    Fixed a CSIViewPart tab when searching



-- Daniel

    Vote for my View Rebuild Idea if you like it

    Daniel Nashed  28 July 2018 11:35:50
    In the last days  have submitted a couple of ideas to the IBM/HCL ideas website.
    This is a great way to place wish list items. I am not asking just for myself but what I think customers and other partner could need.

    One of the ideas is to get rid of the View Rebuild Directory and have all the operations processed in RAM instead.
    On Linux it is not a big deal because we can use a kind of RAM based cache called TMPFS.
    But on Windows you need add-on software like a RAM disk. And there are not many good solutions out there.

    If you are interested in that feature as well, you might want to vote for my idea

    --> https://domino.ideas.aha.io/ideas/DOMINO-I-53

    -- Daniel

    Domino10 planned CentOS 7.4 Support

    Daniel Nashed  19 July 2018 23:37:05

    From what I heard IBM/HCL is planning to support CentOS 7.4 with Domin 10.
    This is great news specially for developers and smaller customers because today only SuSE enterprise and RHEL enterprise servers are supported.

    CentOS LTS (Long Term Releases) are source code compatible with the corresponding RHEL Linux versions and are very stable.
    And even IBM does not support it today and you cannot open support calls, this is currently the only additional supported Linux version for my start script.

    You will be also able to compile C-API applications on CentOS. Which makes it very convenient for business partners.

    So if you are planning to look into Domino on Linux it's definitely a good idea to look into CentOS in future.
    It's free, stable and it is very easy to keep it updated without any subscription.

    I am using CentOS for a long time for my production servers. It works like a charm for me.

    -- Daniel


    SAML Support in Domino 10

    Daniel Nashed  15 July 2018 09:08:35
    SAML support in Domino is limited to ADFS 2.0 / 3.0 and TFIM - Tivoli Federated Identity Manager in Domino 9.0.1.
    We got other IdPs working like F5 by emulating some behavior that is ADFS implementation specific. But this wasn't a fully supported configuration.

    With Domino 10 the plan is to have generic SAML 2.0 support and to be compatible with different type of SAML 2.0 implementations.
    IBM/HCL cannot test all combinations before Domino 10 ships. But the plan is that if the provider is fully SAML 2.0 compliant it should work and you get support for it.

    I have already looked into the new SAML support Domino 10 Beta 1 and have tested to configure it with Jumpcloud (https://jumpcloud.com/).
    Jumpcloud is providing directory/authentication as a service. Some weeks ago I got a partner request to help implementing Domino with Jumpcloud.
    We ran into issues because of some back-end limitations in the implementation in Domino 9.

    With Domino 10 it works like a charm even without any extra tweaking.
    In fact there are changes in the configuration which not only makes it more flexible to configure it for other SAML 2.0 compliant IdPs but also the configuration has been simplified.

    The new configuration option that you can chose instead of "ADFS" is "AuthnRequest SAML 2.0 compatible".

    Some details might still change but what I see so far really provides us with full SAML 2.0 support with a flexible and easy to use configuration.
    When I first looked into SAML support when it was released with the limited available documentation, it was really difficult to setup.
    With the new version I was able to configure SAML with Domino against a IdP like Jumpcloud in a couple of minutes.

    Actually if you want to play around with SAML with the upcoming Domino 10 public beta , Jumpcloud is a great option.
    You can get a free account for up to 10 users and you don't need to setup your own ADFS server.

    -- Daniel

      New IdeaJam like Website from IBM/HCL for Collobaration Products

      Daniel Nashed  14 July 2018 23:07:12
      Notes/Domino 10 is already planned and the first private beta already contained many of the new features.
      IBM and HCL already announced that there will be a new version every 9-10 month.


      So they are already planning for Notes/Domino 11 and also about new Traveler and Sametime versions.

      From what I heard HCL has already assigned developers working on the first features of Notes/Domino 11.


      In the mobile area all energy is focused on the new Nomad client!  So we will have to be patient for new Traveler features.


      Beside the Jam events they will continue after Notes/Domino 10 shipped there is a new idea website, where you can provide feedback today.


      -->
      https://domino.ideas.aha.io/

      IBM and specially HCL really want our feedback and you can see from the first features they have shared in the latest presentations that they take our feedback really serious.

      So I would really like to encourage you to have look into the website to submit your ideas and vote for existing ideas!

      Update 17.7.2018:

      We have been wondering why IBM/HCL did not use IdeaJam which is a great tool to collect ideas and get them prioritized.
      When you look at
      https://www.aha.io you see that it does much more than just that and it is used at IBM and HCL by offering management for release planning and more.
      So that makes perfectly sense for me from their point of view.

      On the other side IdeaJam is still a great tool for customers and partner for idea-management internally and externally.

      IdeaJam is around for 11 years as someone mentioned today in a discussion.


      -- Daniel


      Looking forward to DNUG in Darmstadt next week

      Daniel Nashed  15 June 2018 16:43:23

      IMHO this DNUG will be the most interesting DNUG we had for years.
      Our track for Notes/Domino isn't the only interesting track. I also saw many interesting other sessions poping up in my Facebook stream the last days which I did not spot on the agenda (DNUG gave all the speakers a graphic to use for their session).
      There are great guys coming from the development side. At Engage in Rotterdam those have been the most interesting and refreshing sessions at the conference.
      "HCL" is the new "Iris inside" branding and those guys want to deliver functionality that we are waited for!
      If you have the chance to attend, you should go!  IBM and specially HCL is looking for feedback and they are very open to answer questions.
      Beside the technical sessions we planned round table sessions and you will be able to see and feel the new Notes client on iPad (aka Nomad). The beta is about to be shipped and the Notes/Domino first round of beta is planned for this month as well. I am pretty sure we will at least see some live demos and hear about the current feature list.
      As said before Notes/Domino 10 is just the beginning of the new journey. Domino 11 has been mentioned before and is currently planned for 2019. Mike Gagnon from HCL has a technical session about Domino 10 and beyond!

      If you still bleed yellow DNUG next week is the place to be!
      For DNUG members the conference this year is free again. And I still have my personal ticket to give away, because as a speaker and track manager I can give away my personal ticket.
      https://dnug.de/dnug45-jahreskonferenz-im-darmstadium/

      -- Daniel

      @Transform -- a very powerful Notes formula function

      Daniel Nashed  31 May 2018 10:39:57

      Notes Formula language is a very powerful part of Notes/Domino which has been around since the first Notes version.
      We take it for granted but this is really a key element of the flexibility and RAD we have in Notes.
      It's used in forms, views, can be invoked from Lotus Script and even C-API. I am using it every day.
      There isn't ,much current training material but it's derived from spreadsheet formula language (this is where actually Notes has it's roots as well).

      The @Transform function is very powerful and I don't know why I did not use it for a long time. After I rediscovered it I have used it for views multiple times in a week!

      When you work with lists you can only do list operations on the whole list. But if you want to do different operations depending on the element you would need to implement a loop -- which is possible as well in @formulas.
      But there is a more convenient function that you can use.

      @Transform allows you to operate on each element and build a new list.

      The syntax is pretty simple. You provide a list and define a variable that is used in the formula that is executed on each element. The result is a new text list.

      Here is a simple example:

      mylist:="abc":"edf"; @Transform(mylist; "x"; @if (@Begins(x;"a"); @Right(x;"a"); x))


      You can only execute one formula but you can use @Do to group multiple operations if needed.
      In a formula I wrote yesterday, I even used a @Transform inside another @Transform.

      I had to build a view showing the delegation used in mail-databases based on my own catalog application ("nshdbcat").
      Depending on the ACL entry I show the different delegation.
      This can be done in a view and it is pretty fast. Rebuild of the view takes a couple of seconds even with 30000 database entries in the catalog.

      So if you are working with lists and need flexible operations, @Transform is your friend. I don't know why I forgot about this @function. But it is very usefull!

      I have appended the syntax below and my view column formula I build yesterday for evaluating delegation as a more complex example.

      -- Daniel


      Syntax
      @Transform( list ; variableName ; formula )

      Parameters
      list - Text, number, or time-date list. The list to be acted upon.
      variableName - Text. The name of a variable. Use this variable in the formula to refer to the list element being acted upon.
      formula - Valid formula that evaluates to a result. The remainder of @Transform after the second parameter is the formula that is applied to each element of the input list. The formula must return a value.

      Return value- list
      Text, number, or time-date. The result of the transformation on the input list. The first value returned by the formula determines the data type of the list. Subsequent return values must be of the same type.

      Usage
      An iteration of the formula can return a list, which adds multiple values to the return list.
      @Transform returns an error if any iteration of the formula returns an error.
      If an iteration of the formula returns @Nothing, no element is added to the return list.



      u:="User\\";
      g:="Group\\";
      public:= @Transform (NoAccess; "x";
      @If (
      @Trim (x) = ""; @Nothing;
      @Contains (@Word (x; "|"; 3); "W"); "2. PublicWrite\\"+@Transform(@Word(x; "|"; 1);"z";@If(@Begins (z;"CN="); u; g)+@Name([Abbreviate];z));
      @Contains (@Word (x; "|"; 3); "R"); "1. PublicRead\\"+@Transform(@Word(x; "|"; 1);"z";@If(@Begins (z;"CN="); u; g)+@Name([Abbreviate];z));
      @Nothing));


      r:=@Transform(@Word(Reader; "|"; 1);"z";@If(@Trim(z)=""; @Nothing;@If(@Begins (z;"CN="); u; g)+@Name([Abbreviate];z)));
      a:=@Transform(@Word(Author; "|"; 1);"z";@If(@Trim(z)="";  @Nothing;@If(@Begins (z;"CN="); u; g)+@Name([Abbreviate];z)));
      e:=@Transform(@Word(Editor; "|"; 1);"z";@If(@Trim(z)="";  @Nothing; z=MailFileOwner; @Nothing; @If(@Begins (z;"CN="); u; g)+@Name([Abbreviate];z)));


      all:=@Trim(public:
      @If (r="";@Nothing; "3. Reader\\"+ r):
      @If (a=""; @Nothing; "4. Author\\"+a):
      @If (e=""; @Nothing; "5. Editor\\"+e));
      @If (all=""; "-- No Delegation --"; all)

      Domino Startup Program Docs by Weekday

      Daniel Nashed  31 May 2018 08:50:03
      We ran into this by coincident. Usually this doesn't happen when you have a new program doc.
      But we copied existing program docs and modified them.

      If you change your program document from "Enabled" to "At server startup only" the weekdays to run the program are hidden in the UI.
      You would assume that the program is started when the server starts at any day -- But the weekdays are still effective for this program document!

      In our case the Saturday wasn't selected because Saturday is our maintenance day and we copied the program doc from other program docs before modifying the trigger.
      We had scheduled server maintenance on Saturdays. So this program doc wasn't executed when the server was booted...

      In most cases when you create a program doc from scratch this will never cause any issues because by default all weekdays are selected.
      The UI and the code are not following the same logic. And at least this isn't an intended behavior and I don't see that I would have a use case for that.

      If you are a copy&paste fan like me, you should check your startup program docs!
      The fieldname is Field Name: WeekDays and the textlist should contain the numbers "1" to "7".

      -- Daniel



      Archives


      • [IBM Lotus Domino]
      • [Domino on Linux]
      • [Nash!Com]
      • [Daniel Nashed]