Under the Hood of Mail Redirection and Its

Under the Hood of Mail Redirection and Its Effects on i. Notes and i. Phone Users Keith Brooks Vanessa Brooks, Inc. © 2010 Wellesley Information Services. All rights reserved.

In This Session. . . • We will discuss: i. Phone usage and the mail redirector configuration Reverse proxies and the redirector Clustered mail servers and the redirector The i. Notes Redirector database and configuration Customization of the Login page for the redirector Making i. Notes, Sametime, Lotus Notes Traveler, and Quickr work together when run off the same server* Troubleshooting i. Notes Login Issues * IBM does not recommend this as a solution 1

Brief Word About Webmail/i. Notes/DWA • • • Seriously, why am I covering this topic? Four blog posts on this topic from me and continuously in my Top 5 Write Once, Remember Never Importance is growing as Webmail and those i. Phones grow … Banged my head (even while writing this) so you don’t have to in the future The true reason why any session should be run … well within reason, who ever used DMCS* anyway. . . right? Have you seen the official detailed documentation? Neither have I … yet 2

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 3

The History of Web. Mail. Redirect/Domino Web. Access. Redirect • • Notes. net Sandbox (now in developer. Works) July 20, 2001 original posting for R 4 Web. Mail. Redirect 261 – Domino 4. x and above Web. Mail. Redirect 641 – Domino 5. x and above Last updated October 15, 2003 for R 6 Web. Access. Redirect 650 – Domino 6. x and above Domino Web Access Redirect 6. 50 is included starting in Domino 6. 5 and is supported by IBM 4

The History of Web. Mail. Redirect/Domino Web. Access. Redirect (cont. ) • • R 7 saw mostly small changes R 8 saw an updated version 8. 0. 2 saw the first offering for the i. Phone, Ultra-light Mode 8. 5 saw full i. Phone support and continues as we move forward 5

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 6

i. Phones and i. Notes • • • Can't really talk about i. Notes without mentioning Apple The first official version of i. Notes to work with the i. Phone was 8. 5 Some hacks existed in the R 8. 0. x stream The ultralite (or ultralight) version is designed for the Safari browser and the i. Phone You can also use it from a browser on your PC With the i. Phone or browser, you hit the server URL and the server recognizes your i. Phone and serves up the appropriate UI 7

i. Phones and i. Notes As Seen from an i. Phone • • Provide access to mail, contacts, and Day At A Glance We will cover the configuration shortly Do not confuse i. Notes and Traveler! Traveler is NOT browserbased and resides on the local device 8

i. Phones and i. Notes as Seen from a Browser • For more details see: www 10. lotus. com/ldd/dominowiki. nsf/dx/Ultralight_for_i. Ph one 9

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 10

Clustered Mail Servers • • • What comes inside the box Sorry you are out of luck, no cluster awareness in the Redirector Thinking out of the box Load balancers Hardware- or software-based but can be expensive Yes, there is Internet Cluster Manager (ICM), but … Setup is beyond the scope of this discussion If clustering is enabled Manually edit the i. Notes Redirector database 11

Clustered Mail Servers Diagram with an ICM Source: www. ibm. com/developerworks/lotus/library/ls. Internet_Cluster_Manager/index. html 12

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 13

What Is a Reverse Proxy? • From Wikipedia: A reverse proxy is a proxy server that is installed in a server network Typically, reverse proxies are used in front of Web servers All connections coming from the Internet addressed to one of the Web servers are routed through the proxy server, which may either deal with the request itself or pass the request wholly or partially to the main Web servers A reverse proxy dispatches in-bound network traffic to a set of servers, presenting a single interface to the caller Benefits to use it include: Security, load balancing, 14 encryption, caching, and compression

Reverse Proxies and the i. Notes Mail Redirector • • Want to use a reverse proxy with mail redirector? You can! It is one of the options of the primary setting in the i. Notes Redirector database You enter the appropriate details and then troubleshoot You’d like to think that it will work on the first attempt, but not so from experience, so be prepared There aren’t many resources for reverse proxy setup for the Mail Redirector, but some are included in the Resources section of this session 15

Reverse Proxy 8. 5 Issue Highlight • The following post is from the Lotus. User. Group. org Web site for Sys Admin Tips August 2009 from Chris Miller • Issue: I have run into a situation in which an Apache Reverse proxy has broken after an 8. 5 upgrade. • When the forms 85 is replaced by the forms 6, it works again. We have looked at the debug logs on the proxy and at the domlogs and found everything works up to a point. It is redirected to the correct server, finds the mail file, and finds forms 85. It then begins to process but stops dead at a point. Do you know if there are changes which may make forms 8 break this? Source: www. lotususergroup. org/submissions. nsf/c 8580 bf 957622 f 128625 16

Reverse Proxy Answer • • • I am guessing that one of the configured attributes in the proxy has changed in version 8. 5 and is causing your error. … Opened a PMR with IBM. Here’s a summary of what was found. The Apache Reverse proxy was setup correctly. Two Domino mail servers were set up and the redirector database was in place. The redirector was modified to replace the hostname with the proper hostname so the proxy would know where to send requests. This was a known issue in the 6. 5 world. The redirector database would do its job and it hand off to the Domino server, which would then replace the FQDN with its own name. It messed lots of things up. It only happened when multiple servers were used. Tested and sniffed for a total of 7+ hours and found that the forms 85 database was the issue. Source: www. lotususergroup. org/submissions. nsf/c 8580 bf 957622 f 12862517

Reverse Proxy Answer (cont. ) • • • Here's what worked: Forms 65 against a 6. 5 mail database Forms 8 against an 8. 5 mail database Here's what did not work: Forms 65 against a mail 8 database or mail 8. 5 database (obvious) Forms 85 against a mail 8 or 8. 5 database Whenever the forms 85 database was used, i. Notes broke Something did change in regards to the forms 85

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 19

Audience Participation Time • • I will need a few volunteers from the audience during this session to help me for a few minutes No one will be harmed and you can still take notes but this will help you remember what to do when faced with a redirection configuration next time So let's get started, I will be using my netbook in parallel to the slides Everything is documented, and if not, you know where to find me 20

Step 1: Creating the Mail Redirector Database 1. CTRL+N or File Application New (R 8) 2. Fill in the form, any Title will do 21

Step 1: Creating the Mail Redirector Database (cont. ) 3. Domino creates your database • You will see this on your screen when it is done creating the database 4. Click Setup 22

Step 1: Creating the Mail Redirector Database (cont. ) • You will see this screen 5. On the left side, click Server Settings 23

Configuring the Mail Redirector: Server Settings • Redirection type dictates the options available 24

Configuring the Mail Redirector: Redirection Type Options • • • Fixed (Server Maintenance Usage) Forces redirection to a different server Example: server. B. com instead of server. A. com Dynamic (Default Option) Built from incoming URL with a path from user’s person document Example: mail. company. com/mail/user. nsf instead of ln 011 bos. na. us. ibm. com/mail/user. nsf Mail Server (Reverse Proxy Usage) If you want the user to see the actual mail server Example: ln 011 bos. na. us. ibm. com instead of mail. company. com 25

Configuring the Mail Redirector: Server Settings — Fixed • Enter a server name as shown including http: // 26

Configuring the Mail Redirector: Server Settings — Fixed (cont. ) • • • Enter the server name Do you want to force a specific path to the mail file? Helpful during server maintenance Need to use SSL? Yes or no does not change any other options If using SSL and on a different port than 443 Edit the field accordingly Enable Debug? Helpful when troubleshooting redirector issues Shows text on top of browser while building the URL so you can fix any issues 27

Configuring the Mail Redirector: Server Settings — Dynamic 28

Configuring the Mail Redirector: Server Settings — Dynamic (cont. ) • • • Do you want to force a specific path to the mail file? Helpful during server maintenance Need to force SSL for the entire session? Self explanatory but you must have SSL enabled Want SSL only during authentication? If using SSL and on a different port than 443 Edit the field accordingly Enable Debug? Helpful when troubleshooting redirector issues Shows text on top of browser while building the URL so you can fix any issues 29

Configuring the Mail Redirector: Server Settings — Debug • Debug information will look like this, but set the delay time so you can take a screenshot of it 30

Configuring the Mail Redirector: Server Settings — Mail. Server 31

Configuring the Mail Redirector: Server Settings — Mail. Server (cont. ) • • • Enter the TCP/IP domain to set the URL properly Example – Admin/The. View will become admin. theview. com when theview. com is used Enter a Reverse Proxy Server Appends this as a path segment The rest of the options on the page (Path, SSL, Debug) are the same as the Dynamic settings 32

Configuring the Mail Redirector: UI Setup — Top Half • Click on UI Setup to see a long screen of options starting with the ones shown below 33

Configuring the Mail Redirector: UI Setup — Top Half (cont. ) • • How long should this redirection take? If you want to use this as a news update or company emergency screen, give it some time … just not too much Enter some text for the Redirection Page or leave the default If you leave the default, I will know, so have fun with it Is there a custom logo or a graphic you want to use? Corporate or sports team, or whatever, but ask first … just in case Select a background color? Well you would think you get a color chart but … 34

Configuring the Mail Redirector: UI Setup — Background Color • What does “Click here for color picker” mean to you? 35

Configuring the Mail Redirector: UI Setup — Background Color (cont. ) • Exactly, you have to guess the color code! • Go to http: //html-color-codes. info/ to pick a color code 36

Configuring the Mail Redirector: UI Setup — Top Part • The top part should now look like this: JUST KIDDING! 37

Configuring the Mail Redirector: UI Setup — Top Part (cont. ) • The top part should now look like this: 38

Configuring the Mail Redirector: UI Setup — Bottom Part • A few more items on the bottom of the page 39

Configuring the Mail Redirector: UI Setup — Bottom Part (cont. ) • • • Want to enable Personal Options? If you are a nice administrator and like to give people choices about where to start from, i. e. , inbox or calendar Want to enable Login Options? This will let people choose which of the three types of i. Notes environments they can use Note: Not available if Personal Options is Enabled Want to enable Save Username Cookies? This provides a “Remember Me” option to store the person’s name Note: Not available if using the shared computer option 40

Configuring the Mail Redirector: Ultra. Light/Mobile Settings • Click on the Ultra-light/Mobile Settings button for i. Phone mode settings 41

Configuring the Mail Redirector: Ultra. Light/Mobile Settings (cont. ) • • • Enables the Ultra-Light button to be seen in the login preferences Only visible if login options is enabled Ultra-Light mode is only supported in Mozilla Firefox Enabling this will not affect logging in from a phone This does not disable Ultra-Light mode It only disables the option to log in to it from the i. Notes Redirector login page Mobile Device checks the words against the device's HTTP user agent string 42

Configuring the Mail Redirector: Ultra. Light/Application Setup • You can follow the directions shown below or click the button that says “Click to Auto Set ACL Settings” 43

Configuring the Mail Redirector: Ultra. Light/Application Setup (cont. ) • Once you “Click to Auto Set the ACL Settings” you will see the following message: 44

Configuring the Mail Redirector — Saving the Configuration • Click Save & Exit to save the file to your server • So, are you ready to see it in action? 45

Step 2: Domino Web Configuration • • Step 1 was the easy part Step 2 is not as difficult, but it is very important Without it no one will be able to login! X 46

Creating the Domino Web Server Configuration Database • Press CTRL+N or select File Application Ne w (R 8) • Fill in the form, Web Configuration is fine as a title • File Name must be domcfg. nsf • Make sure Show advanced templates is checked 47

Opening the Web Server Configuration Database • When you first open the database it is empty • Not to worry, we will add the Mapping (configuration documents) next 48

Creating Mappings in the Web Server Configuration Database • • Click on ‘Sign In’ Form Mappings Then, click on Add Mapping The form opens and looks like this 49

Creating Mappings in the Web Server Configuration Database (cont. ) • • Select what this applies to – All Web Sites/Entire Server or Specific Web Site/Virtual Server If specific, enter the domain or IP address 50

Step 3: Create the Login Site Using Internet Site Documents • • Now that the server is configured, you have to tell the server where people will login Think this out, make it as easy as possible One example is to have a sub-folder (admin. theview. com/mail) which uses redirection to direct everyone to the redirector page Beneficial because it allows you to provide one location, without renaming anything and for the inclusion of other products like Traveler, Sametime, and others 51

Setting Up a Generic Mail URL • • • If you use Internet Site Documents you can add a Web Site Rule (most R 8. x organizations do now) Open the Web site in the Configuration Web-Internet Sites section of names. nsf or via the admin client Click on Web Site and select Create Rule from the drop-down list as shown here 52

Setting Up a Generic Mail URL (cont. ) • You will see the screen shown below Provide a description that makes sense Set the type of rule to Redirection In this example we set the Incoming URL pattern Web URL for /mail at the end of the URL Redirect to this URL requires the mail redirector file and don't forget the ? open Example URL = http: //admin. theview. com/mail • This will auto forward to the mail jump database and the login screen 53

Step 4: Log in and Test the Mail Redirection • • Log in to your server http: //yourcompany. com/mail Check the boxes for shared computer and Remember me, if preferred 54

Logging in to Test the Configuration • If all is set up properly this is what you will see In this case debug is enabled 55

Logging in to See Your Mail … It Worked! 56

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 57

Quirkiness? IBM? Lotus? No way! • • R 8 has brought many changes for the better In fact, some changes came out in R 7 but were ignored or not required yet (like Internet Site Documents) When you install Lotus Notes Traveler, Quickr, Sametime, and even Blackberry Enterprise Server (BES), strange things can happen to your network configuration and break i. Notes redirection So what can you do to fix these installations? 58

Fix It or Work Around It? • • We will presume these issues affect SMB customers and someone using Internet site documents If not using Internet Site Documents then generally the problem is in the field of the Internet Protocols HTTP Mapping Home URL field of your names. nsf Some of the installations we can fix Notes. ini changes or similar fixes Others we have no choice but to edit Reconfigure some documents in the names. nsf 59

Blackberry Enterprise Server (BES) • • • The BES installation since version 4. 17 and continuing in version 5. 0, adds a line to the notes. ini which, if left running, prevents the JVM (HTTP and Traveler both use the JVM) from loading Disable this line: Httpdisablejava=1 REM it out and restart the server and all is good again RIM does not recommend you delete the entry If your BES and Traveler must reside together on the same server, it is not recommended to have more than 50 users and you can keep the line REM’d out 60

Sametime Server • • If you have Sametime installed on the same server as your mail and the i. Notes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the i. Notes just like we did in the hands-on part It works, I have clients doing it today But what if you are not using Internet sites? If nothing else will work, you can configure the Sametime Center (stcenter. nsf) with extra links on its page for mail users We can discuss afterwards or I will post to my blog on this topic 61

Quickr Server • • If you have Quickr installed on the same server as your mail and the i. Notes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the i. Notes just like we did in the hands-on part It works, I have clients doing it today However, when Internet sites are turned on, and Quick. Place is using LDAP authentication, Quick. Place will not function properly Depending on the scenarios (upgraded install, new install, etc. ), the symptoms range from users not being able to login to users being prompted to login twice to mixed up MSSO and basic authentication (from IBM Technote #1252714) 62

Lotus Notes Traveler • • • If you have Traveler installed on the same server as your mail and the i. Notes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the i. Notes just like we did in the hands on part Keep in mind that Traveler does not check the environment before it installs itself, only afterwards, so it misses the httpdisablejava=1 line Traveler also installs a line in the Notes. ini which will override your i. Notes redirector (if you set it up to open at server connection) The line is NTS_WEBSITE_HOME and should be REM’d out 63

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 64

Customizing the Login Page • • Hard or easy, it’s up to you Depends on your knowledge and comfort levels in development 1. Open the mailjump. nsf database in the Domino Designer client 2. In the Forms list find DWALogin. Form and open it 65

Customizing the Login Page (cont. ) • When you open the DWALogin. Form it should look like this 66

Customizing the Login Page (cont. ) 1. Select where to put the graphic 2. From the menu, click Create Picture 67

Customizing the Login Page (cont. ) • Locate the graphic you want to use and import it into the desired location in the top half of the Designer window panes 68

Customizing the Login Page (cont. ) • Your form should look like this once your graphic has been imported • You can also add any text here as well Then save the form and test it • 69

The Completed Customized Login Page 70

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 71

What If It Doesn't Work? • • • Relax, it happens sometimes, we all make mistakes even when following directions There are many pieces of the puzzle to sort out if this doesn't work Now let's look at some places to check your typing, ACLs, configuration settings, and other bits 72

Logging in to See Your Mail … It Failed! You may see this message Or this message or something similar 73

Basic Troubleshooting Tips If Unable to Log in • • Make sure the mail file has the proper server set for the administration server Make sure the security tab for the Internet sites (if you use them) is set as shown here 74

Basic Troubleshooting Tips If Unable to Log in (cont. ) • • • Check the ACL of the mail file to make sure the user did not do something like change all the ACL settings to No Access Make sure the user’s name is properly shown as the owner in the preferences section (Choose More Preferences from the Inbox view) Check that the person document is correct for the server name, file location and name, etc. Mail jump, depending on how you configure it, can be, shall we say, unsympathetic to your errors 75

Basic Troubleshooting Tips If Unable to Log in (cont. ) • • • Change the users Internet password … just in case Did you set up the mail jump properly? Did you set up the Domino Web Services Configuration properly? Check the ACLs on both of those, set Anonymous to reader Make sure the proper, fully qualified names and/or host names or IP addresses are stored in the proper place of the Internet Site Document Basics tab under “Host names or addresses mapped to this site: ” 76

Basic Troubleshooting Tips If Unable to Log in (cont. ) • • Replace the design on the mail file to make sure it is the correct version There is an IBM wiki page that might help if you have an HTTP Authentication issue preventing people from completing their login www-10. lotus. com/ldd/dominowiki. nsf/dx/dominowebserver-authentication-troubleshooting 77

Troubleshooting Reminder • • • What you learn in a presentation and what you configure in real life do not always equal Different versions, even point releases can have major differences While I and other bloggers, even the IBM Info Centers and Wikis, try to keep our posts up to date with changes in the software, don't rely on what you read or hear Your intuition will help you decide as well So will a good Google search 78

What We’ll Cover … • • • Understanding the history of the Lotus Mail Redirector Taking a look at the i. Phone and Webmail Dealing with clustered mail servers Discussing ideas on reverse proxy Implementing the i. Notes Mail Redirector Uncovering some quirkiness with Lotus Software product integration Looking at Login page examples Troubleshooting the Login page Wrap-up 79

Preliminary Resources • • Original Version of Mail Redirector for anyone not on R 6: www 10. lotus. com/ldd/sandbox. nsf/Threads/F 4 B 19 C 0 C 33 27 DF 5385256 A 8 F 0063 BDF 4? Open. Document Custom Login Form with Sametime for i. Notes example: www 10. lotus. com/ldd/sandbox. nsf/By. Audience/2 b 21 f 191 79 f 964 f 485256 c 68005188 e 8? Open. Document New features in IBM Lotus i. Notes 8. 5: Ultra-light mode and the Lotus i. Notes redirector www. ibm. com/developerworks/lotus/library/inotesultra/#N 10140 i. Notes Web Access Deployment and Administration (Old but helpful) 80

Installation Resources • • • Video doing a step-by-step installation of i. Notes redirector: http: //public. dhe. ibm. com/software/dw/lotus/learn/vi ewlets/notesdomino/inotes 851/inotes_redirect_851. s wf Configuring the IBM Lotus i. Notes Redirect database for an accessible login experience, Technote #1326762 (step-by-step) www 01. ibm. com/support/docview. wss? rs=3651&context =SSULMR&context=SSPQ 5 C&dc=DB 520&q 1=13267 62&uid=swg 21326762&loc=en_US&cs=utf 8&lang=en Infocenter for Domino 8. 5. 1 http: //publib. boulder. ibm. com/infocenter/domhelp/v 81

Resources for DWA/i. Notes Redirector — IBM Technotes • Here is a partial list of technotes at IBM with their # and titles: 1089521 – Notes. ini variables for Domino Web Access 1163051 – Using the Domino Web Access Redirect database with LDAP 1164494 – Custom Logo for Browser in Domino Web Access Redirect 1164497 – DWA Redirect Utility Does not Redirect Users to their Mail File as Expected 1297981 – Domino Web Access Redirect overrides the default mode set using the "i. Notes_WA_Default. UI" notes. ini parameter 1419078 – Several i. Notes users are not being redirected to their mail file after upgrading the server to Domino 8. 5. 1 (BUG to be fixed in 8. 5. 2) 1290788 – No option to choose a mode for DWA on the redirect page 1254382 – Force SSL only on authentication does not 82

Resources for Reverse Proxies • • How Apache reverse proxy servers can make sensitive data available to remote users www. ibm. com/developerworks/web/library/wasecdomdat/ Using Apache as a Reverse Proxy and Load Balancer for i. Notes Clustered Servers www-10. lotus. com/ldd/dominowiki. nsf/dx/usingapache-as-a-reverse-proxy-and-load-balancer-fordomino-clustered-servers 83

Additional Resources • • • Instant Messaging IM (AOL/MSN/Yahoo) User name: kbmsg Bleedyellow's Sametime Server www. bleedyellow. com User name: Keith Brooks Skype www. skype. com User name: lotusevangelist Twitter www. twitter. com User name: lotusevangelist My Blog posts http: //lotustech. blogspot. com Lotus Bloggers Aggregated http: //planetlotus. org 84

7 Key Points to Take Home • • You control what people do and see … even i. Phone users Sametime, Traveler, Quickr, and even BES will interfere when they are installed There are three options for the Mail Redirector for you to use including a reverse proxy option The i. Notes Redirector is not cluster aware Be careful when consolidating or moving users between servers so the user does not lose their configuration Debug is your friend, but turn it off once everything works i. Notes is not Lotus Notes Traveler even on an i. Phone 85

Your Turn! How to contact me: Keith Brooks keith@vanessabrooks. com 86