© 2010 Wellesley Information Services. All rights reserved. Under the Hood of Mail Redirection and...

© 2010 Wellesley Information Services. All rights reserved.

Under the Hood of Mail Redirection and Its Effects on iNotes and iPhone Users

Keith BrooksVanessa Brooks, Inc.

2

In This Session ...

• We will discuss: iPhone usage and the mail redirector configuration Reverse proxies and the redirector Clustered mail servers and the redirector The iNotes Redirector database and configuration Customization of the Login page for the redirector Making iNotes, Sametime, Lotus Notes Traveler, and Quickr

work together when run off the same server* Troubleshooting iNotes Login Issues

* IBM does not recommend this as a solution

3

Brief Word About Webmail/iNotes/DWA

• Seriously, why am I covering this topic? Four blog posts on this topic from me and continuously in my

Top 5• Write Once, Remember Never• Importance is growing as Webmail and those iPhones grow …• Banged my head (even while writing this) so you don’t have to in

the future The true reason why any session should be run … well within

reason, who ever used DMCS* anyway ... right?• Have you seen the official detailed documentation?

Neither have I … yet

* DMCS = Domino Media Connect Services

4

What We’ll Cover …

• Understanding the history of the Lotus Mail Redirector• Taking a look at the iPhone and Webmail• Dealing with clustered mail servers• Discussing ideas on reverse proxy• Implementing the iNotes Mail Redirector • Uncovering some quirkiness with Lotus Software product

integration• Looking at Login page examples• Troubleshooting the Login page• Wrap-up

5

The History of WebMailRedirect/DominoWebAccessRedirect

• Notes.net Sandbox (now in developerWorks) July 20, 2001 original posting for R4

WebMailRedirect261 – Domino 4.x and above WebMailRedirect641 – Domino 5.x and above

Last updated October 15, 2003 for R6 WebAccessRedirect650 – Domino 6.x and above

• Domino Web Access Redirect 6.50 is included starting in Domino 6.5 and is supported by IBM

6

The History of WebMailRedirect/Domino WebAccessRedirect (cont.)

• R7 saw mostly small changes• R8 saw an updated version

8.0.2 saw the first offering for the iPhone, Ultra-light Mode 8.5 saw full iPhone support and continues as we move forward

7




8

iPhones and iNotes

• Can't really talk about iNotes without mentioning Apple• The first official version of iNotes to work with the iPhone was 8.5

Some hacks existed in the R8.0.x stream• The ultralite (or ultralight) version is designed for the Safari

browser and the iPhone You can also use it from a browser on your PC With the iPhone or browser, you hit the server URL and the

server recognizes your iPhone and serves up the appropriate UI

9

iPhones and iNotes As Seen from an iPhone

• Provide access to mail, contacts, and Day At A Glance• We will cover the configuration shortly

Do not confuse iNotes

and Traveler!

Traveler is NOT browser- based and resides on the

local device

10

iPhones and iNotes as Seen from a Browser

• For more details see: www-10.lotus.com/ldd/dominowiki.nsf/dx/Ultralight_for_iPhone

11




12

Clustered Mail Servers

• What comes inside the box Sorry you are out of luck, no cluster awareness in the

Redirector• Thinking out of the box

Load balancers Hardware- or software-based but can be expensive Yes, there is Internet Cluster Manager (ICM), but …

Setup is beyond the scope of this discussion• If clustering is enabled

Manually edit the iNotes Redirector database

13

Clustered Mail Servers Diagram with an ICM

Source: www.ibm.com/developerworks/lotus/library/ls-Internet_Cluster_Manager/index.html

14




15

What Is a Reverse Proxy?

• From Wikipedia: A reverse proxy is a proxy server that is installed in a server

network Typically, reverse proxies are used in front of Web servers All connections coming from the Internet addressed to one of

the Web servers are routed through the proxy server, which may either deal with the request itself or pass the request wholly or partially to the main Web servers

A reverse proxy dispatches in-bound network traffic to a set of servers, presenting a single interface to the caller

Benefits to use it include: Security, load balancing, encryption, caching, and compression

16

Reverse Proxies and the iNotes Mail Redirector

• Want to use a reverse proxy with mail redirector? You can!• It is one of the options of the primary setting in the iNotes

Redirector database• You enter the appropriate details and then troubleshoot

You’d like to think that it will work on the first attempt, but not so from experience, so be prepared

• There aren’t many resources for reverse proxy setup for the Mail Redirector, but some are included in the Resources section of this session

17

Reverse Proxy 8.5 Issue Highlight

• The following post is from the LotusUserGroup.org Web site for Sys Admin Tips August 2009 from Chris Miller

• Issue: I have run into a situation in which an Apache Reverse proxy has broken after an 8.5 upgrade. When the forms85 is replaced by the forms6, it works again. We have looked at the debug logs on the proxy and at the domlogs and

found everything works up to a point. It is redirected to the correct server, finds the mail file, and finds forms85. It then begins to process but stops dead at a point. Do you know if there are changes which may make forms8 break this?

• Source: www.lotususergroup.org/submissions.nsf/c8580bf957622f1286257088005cd73b/0fe037a0cade29148625761d00647488?OpenDocument

18

Reverse Proxy Answer

• I am guessing that one of the configured attributes in the proxy has changed in version 8.5 and is causing your error.

• … Opened a PMR with IBM. Here’s a summary of what was found. The Apache Reverse proxy was setup correctly. Two Domino mail servers were set up and the redirector database was in

place. The redirector was modified to replace the hostname with the proper

hostname so the proxy would know where to send requests. This was a known issue in the 6.5 world. The redirector database would do its job and it hand off to the Domino

server, which would then replace the FQDN with its own name. It messed lots of things up. It only happened when multiple servers were used. Tested and sniffed for a total of 7+ hours and found that the forms85

database was the issue.

• Source: www.lotususergroup.org/submissions.nsf/c8580bf957622f1286257088005cd73b/0fe037a0cade29148625761d00647488?OpenDocument

Reverse Proxy Answer (cont.)

• Here's what worked: Forms65 against a 6.5 mail database Forms8 against an 8 mail database Forms8 against an 8.5 mail database

• Here's what did not work: Forms65 against a mail 8 database or mail 8.5 database

(obvious) Forms85 against a mail 8 or 8.5 database

• Whenever the forms85 database was used, iNotes broke Something did change in regards to the forms85

20




21

Audience Participation Time

• I will need a few volunteers from the audience during this session to help me for a few minutes

• No one will be harmed and you can still take notes but this will help you remember what to do when faced with a redirection configuration next time

• So let's get started, I will be using my netbook in parallel to the slides

• Everything is documented, and if not, you know where to find me

22

Step 1: Creating the Mail Redirector Database

1. CTRL+N or File Application New (R8)

2. Fill in the form, any Title will do

23

Step 1: Creating the Mail Redirector Database (cont.)

3. Domino creates your database• You will see this on your screen when it is done creating the

database

4. Click Setup

24

Step 1: Creating the Mail Redirector Database (cont.)

• You will see this screen

5. On the left side, click Server Settings

25

Configuring the Mail Redirector: Server Settings

• Redirection type dictates the options available

26

Configuring the Mail Redirector: Redirection Type Options

• Fixed (Server Maintenance Usage) Forces redirection to a different server

Example: serverB.com instead of serverA.com• Dynamic (Default Option)

Built from incoming URL with a path from user’s person document Example: mail.company.com/mail/user.nsf instead of

ln011bos.na.us.ibm.com/mail/user.nsf• Mail Server (Reverse Proxy Usage)

If you want the user to see the actual mail server Example: ln011bos.na.us.ibm.com instead of

mail.company.com

27

Configuring the Mail Redirector: Server Settings — Fixed

• Enter a server name as shown including http://

28

Configuring the Mail Redirector: Server Settings — Fixed (cont.)

• Enter the server name• Do you want to force a specific path to the mail file?

Helpful during server maintenance• Need to use SSL?

Yes or no does not change any other options• If using SSL and on a different port than 443

Edit the field accordingly• Enable Debug?

Helpful when troubleshooting redirector issues Shows text on top of browser while building the URL so you

can fix any issues

29

Configuring the Mail Redirector: Server Settings — Dynamic

30

Configuring the Mail Redirector: Server Settings — Dynamic (cont.)

• Do you want to force a specific path to the mail file? Helpful during server maintenance

• Need to force SSL for the entire session? Self explanatory but you must have SSL enabled

• Want SSL only during authentication?• If using SSL and on a different port than 443

Edit the field accordingly• Enable Debug?

Helpful when troubleshooting redirector issues Shows text on top of browser while building the URL so you

can fix any issues

31

Configuring the Mail Redirector: Server Settings — Debug

• Debug information will look like this, but set the delay time so you can take a screenshot of it

32

Configuring the Mail Redirector: Server Settings — MailServer

33

Configuring the Mail Redirector: Server Settings — MailServer (cont.)• Enter the TCP/IP domain to set the URL properly

Example – Admin/TheView will become admin.theview.com when theview.com is used

• Enter a Reverse Proxy Server Appends this as a path segment

• The rest of the options on the page (Path, SSL, Debug) are the same as the Dynamic settings

34

Configuring the Mail Redirector: UI Setup — Top Half

• Click on UI Setup to see a long screen of options starting with the ones shown below

35

Configuring the Mail Redirector: UI Setup — Top Half (cont.)

• How long should this redirection take? If you want to use this as a news update or company

emergency screen, give it some time … just not too much• Enter some text for the Redirection Page or leave the default

If you leave the default, I will know, so have fun with it• Is there a custom logo or a graphic you want to use?

Corporate or sports team, or whatever, but ask first … justin case

• Select a background color? Well you would think you get a color chart but …

36

Configuring the Mail Redirector: UI Setup — Background Color

• What does “Click here for color picker” mean to you?

37

Configuring the Mail Redirector: UI Setup — Background Color (cont.)

• Exactly, you have to guess the color code!

• Go to http://html-color-codes.info/ to pick a color code

38

Configuring the Mail Redirector: UI Setup — Top Part

JUST KIDDING!

• The top part should now look like this:

39

Configuring the Mail Redirector: UI Setup — Top Part (cont.)

• The top part should now look like this:

40

Configuring the Mail Redirector: UI Setup — Bottom Part

• A few more items on the bottom of the page

41

Configuring the Mail Redirector: UI Setup — Bottom Part (cont.)

• Want to enable Personal Options? If you are a nice administrator and like to give people choices

about where to start from, i.e., inbox or calendar• Want to enable Login Options?

This will let people choose which of the three types of iNotes environments they can use Note: Not available if Personal Options is Enabled

• Want to enable Save Username Cookies? This provides a “Remember Me” option to store the person’s

name Note: Not available if using the shared computer option

42

Configuring the Mail Redirector: Ultra-Light/Mobile Settings

• Click on the Ultra-light/Mobile Settings button for iPhone mode settings

43

Configuring the Mail Redirector: Ultra-Light/Mobile Settings (cont.)

• Enables the Ultra-Light button to be seen in the login preferences Only visible if login options is enabled

• Ultra-Light mode is only supported in Mozilla Firefox Enabling this will not affect logging in from a phone This does not disable Ultra-Light mode

It only disables the option to log in to it from the iNotes Redirector login page

• Mobile Device checks the words against the device's HTTP user agent string

44

Configuring the Mail Redirector: Ultra-Light/Application Setup

• You can follow the directions shown below or click the button that says “Click to Auto Set ACL Settings”

45

Configuring the Mail Redirector: Ultra-Light/Application Setup (cont.)

• Once you “Click to Auto Set the ACL Settings” you will see the following message:

46

Configuring the Mail Redirector — Saving the Configuration

• Click Save & Exit to save the file to your server

• So, are you ready to see it in action?

47

Step 2: Domino Web Configuration

• Step 1 was the easy part• Step 2 is not as difficult, but it is very important

Without it no one will be able to login!

X

48

Creating the Domino Web Server Configuration Database

• Press CTRL+N or select FileApplicationNew (R8)

• Fill in the form, Web Configuration is fine as a title

• File Name must be domcfg.nsf

• Make sure Show advanced templates is checked

49

Opening the Web Server Configuration Database

• When you first open the database it is empty

• Not to worry, we will add the Mapping (configuration documents) next

50

Creating Mappings in the Web Server Configuration Database

• Click on ‘Sign In’ Form Mappings • Then, click on Add Mapping

The form opens andlooks like this

51

Creating Mappings in the Web Server Configuration Database (cont.)

• Select what this applies to – All Web Sites/Entire Server or Specific Web Site/Virtual Server

• If specific, enter the domain or IP address

52

Step 3: Create the Login Site Using Internet Site Documents

• Now that the server is configured, you have to tell the server where people will login Think this out, make it as easy as possible

• One example is to have a sub-folder (admin.theview.com/mail) which uses redirection to direct everyone to the redirector page Beneficial because it allows you to provide one location,

without renaming anything and for the inclusion of other products like Traveler, Sametime, and others

53

Setting Up a Generic Mail URL

• If you use Internet Site Documents you can add a Web Site Rule (most R8.x organizations do now)

• Open the Web site in the ConfigurationWeb-Internet Sites section of names.nsf or via the admin client

• Click on Web Site and select Create Rule from the drop-down list as shown here

54

Setting Up a Generic Mail URL (cont.)

• You will see the screen shown below Provide a description that makes sense Set the type of rule to Redirection In this example we set the Incoming URL pattern Web URL

for /mail at the end of the URL Redirect to this URL requires the mail redirector file and don't

forget the ?open

Example URL =

http://admin.theview.com/mail • This will auto forward to the mail

jump database and the login screen

55

Step 4: Log in and Test the Mail Redirection

• Log in to your server http://yourcompany.com/mail

• Check the boxes for shared computer and Remember me, if preferred

56

Logging in to Test the Configuration

• If all is set up properly this is what you will see In this case debug is enabled

57

Logging in to See Your Mail … It Worked!

58




59

Quirkiness? IBM? Lotus? No way!

• R8 has brought many changes for the better In fact, some changes came out in R7 but were ignored or not

required yet (like Internet Site Documents)• When you install Lotus Notes Traveler, Quickr, Sametime, and

even Blackberry Enterprise Server (BES), strange things can happen to your network configuration and break iNotes redirection So what can you do to fix these installations?

60

Fix It or Work Around It?

• We will presume these issues affect SMB customers and someone using Internet site documents

• If not using Internet Site Documents then generally the problem is in the field of the Internet ProtocolsHTTP Mapping Home URL field of your names.nsf

• Some of the installations we can fix Notes.ini changes or similar fixes

• Others we have no choice but to edit Reconfigure some documents in the names.nsf

61

Blackberry Enterprise Server (BES)

• The BES installation since version 4.17 and continuing in version 5.0, adds a line to the notes.ini which, if left running, prevents the JVM (HTTP and Traveler both use the JVM) from loading Disable this line: Httpdisablejava=1

REM it out and restart the server and all is good again• RIM does not recommend you delete the entry• If your BES and Traveler must reside together on the same server,

it is not recommended to have more than 50 users and you can keep the line REM’d out

62

Sametime Server

• If you have Sametime installed on the same server as your mail and the iNotes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the

iNotes just like we did in the hands-on part It works, I have clients doing it today

• But what if you are not using Internet sites? If nothing else will work, you can configure the Sametime

Center (stcenter.nsf) with extra links on its page for mail users We can discuss afterwards or I will post to my blog on this

topic

63

Quickr Server

• If you have Quickr installed on the same server as your mail and the iNotes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the

iNotes just like we did in the hands-on part It works, I have clients doing it today

• However, when Internet sites are turned on, and QuickPlace is using LDAP authentication, QuickPlace will not function properly Depending on the scenarios (upgraded install, new install, etc.),

the symptoms range from users not being able to login to users being prompted to login twice to mixed up MSSO and basic authentication (from IBM Technote #1252714)

64

Lotus Notes Traveler

• If you have Traveler installed on the same server as your mail and the iNotes redirector, how do you use both at the same time? The answer is to configure an Internet site document for the

iNotes just like we did in the hands on part• Keep in mind that Traveler does not check the environment before

it installs itself, only afterwards, so it misses the httpdisablejava=1 line

• Traveler also installs a line in the Notes.ini which will override your iNotes redirector (if you set it up to open at server connection) The line is NTS_WEBSITE_HOME and should be REM’d out

65




66

Customizing the Login Page

• Hard or easy, it’s up to you• Depends on your knowledge and comfort levels in development

1. Open the mailjump.nsf database in the Domino Designer client

2. In the Forms list find DWALoginForm and open it

67

Customizing the Login Page (cont.)

• When you open the DWALoginForm it should look like this

68


2. From the menu, click Create Picture

1. Select where to put the graphic

69


• Locate the graphic you want to use and import it into the desired location in the top half of the Designer window panes

70


• Your form should look like this once your graphic has been imported

• You can also add any text here as well• Then save the form and test it

71

The Completed Customized Login Page

72




73

What If It Doesn't Work?

• Relax, it happens sometimes, we all make mistakes even when following directions

• There are many pieces of the puzzle to sort out if this doesn't work

• Now let's look at some places to check your typing, ACLs, configuration settings, and other bits

74

Logging in to See Your Mail … It Failed!

You may see this message

Or this message or something similar

75

Basic Troubleshooting Tips If Unable to Log in

• Make sure the mail file has the proper server set for the administration server

• Make sure the security tab for the Internet sites (if you use them) is set as shown here

76

Basic Troubleshooting Tips If Unable to Log in (cont.)

• Check the ACL of the mail file to make sure the user did not do something like change all the ACL settings to No Access

• Make sure the user’s name is properly shown as theowner in the preferences section (Choose More Preferences from the Inbox view)

• Check that the person document is correct for the server name, file location and name, etc. Mail jump, depending on how you configure it, can be, shall we

say, unsympathetic to your errors

77


• Change the users Internet password … just in case• Did you set up the mail jump properly? Did you set up the Domino

Web Services Configuration properly? Check the ACLs on both of those, set Anonymous to reader

• Make sure the proper, fully qualified names and/or host names or IP addresses are stored in the proper place of the Internet Site Document Basics tab under “Host names or addresses mapped to this site:”

78


• Replace the design on the mail file to make sure it is the correct version

• There is an IBM wiki page that might help if you have an HTTP Authentication issue preventing people from completing their login www-10.lotus.com/ldd/dominowiki.nsf/dx/domino-webserver-

authentication-troubleshooting

79

Troubleshooting Reminder

• What you learn in a presentation and what you configure in real life do not always equal

• Different versions, even point releases can have major differences• While I and other bloggers, even the IBM Info Centers and Wikis,

try to keep our posts up to date with changes in the software, don't rely only on what you read or hear Your intuition will help you decide as well So will a good Google search

80




81

Preliminary Resources

• Original Version of Mail Redirector for anyone not on R6: www-10.lotus.com/ldd/sandbox.nsf/Threads/

F4B19C0C3327DF5385256A8F0063BDF4?OpenDocument• Custom Login Form with Sametime for iNotes example:

www-10.lotus.com/ldd/sandbox.nsf/ByAudience/2b21f19179f964f485256c68005188e8?OpenDocument

• New features in IBM Lotus iNotes 8.5: Ultra-light mode and the Lotus iNotes redirector www.ibm.com/developerworks/lotus/library/inotes-ultra/

#N10140• iNotes Web Access Deployment and Administration (Old but

helpful) www.redbooks.ibm.com/redbooks/SG246518.html

82

Installation Resources

• Video doing a step-by-step installation of iNotes redirector: http://public.dhe.ibm.com/software/dw/lotus/learn/viewlets/

notesdomino/inotes851/inotes_redirect_851.swf• Configuring the IBM Lotus iNotes Redirect database for an

accessible login experience, Technote #1326762 (step-by-step) www-01.ibm.com/support/docview.wss?

rs=3651&context=SSULMR&context=SSPQ5C&dc=DB520&q1=1326762&uid=swg21326762&loc=en_US&cs=utf-8&lang=en

• Infocenter for Domino 8.5.1 http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/

index.jsp?topic=/com.ibm.help.domino.admin85.doc/H_USING_INOTES_REDIRECT_TO_ACCESS_MAIL_IN_LOTUS_INOTES_STEPS.html

83

Resources for DWA/iNotes Redirector — IBM Technotes

• Here is a partial list of technotes at IBM with their # and titles: 1089521 – Notes.ini variables for Domino Web Access 1163051 – Using the Domino Web Access Redirect database with LDAP 1164494 – Custom Logo for Browser in Domino Web Access Redirect 1164497 – DWA Redirect Utility Does not Redirect Users to their Mail

File as Expected 1297981 – Domino Web Access Redirect overrides the default mode set

using the "iNotes_WA_DefaultUI" notes.ini parameter 1419078 – Several iNotes users are not being redirected to their mail

file after upgrading the server to Domino 8.5.1 (BUG to be fixed in 8.5.2) 1290788 – No option to choose a mode for DWA on the redirect page 1254382 – Force SSL only on authentication does not work in DWA

redirect database 1197471 – Domino Web Access Redirect database redirects user to

WebMail interface 1326778 – Encrypted mail SSL redirect fails on Lotus iNotes ultralite

mode when JavaScript is disabled in the device browser settings

84

Resources for Reverse Proxies

• How Apache reverse proxy servers can make sensitive data available to remote users www.ibm.com/developerworks/web/library/wa-secdomdat/

• Using Apache as a Reverse Proxy and Load Balancer for iNotes Clustered Servers www-10.lotus.com/ldd/dominowiki.nsf/dx/using-apache-as-a-

reverse-proxy-and-load-balancer-for-domino-clustered-servers

85

Additional Resources

• Instant Messaging IM (AOL/MSN/Yahoo)

User name: kbmsg Bleedyellow's Sametime Server

www.bleedyellow.com User name: Keith Brooks

Skype www.skype.com

User name: lotusevangelist Twitter

www.twitter.com User name: lotusevangelist

• My Blog posts http://lotustech.blogspot.com

• Lotus Bloggers Aggregated http://planetlotus.org

86

7 Key Points to Take Home

• You control what people do and see … even iPhone users• Sametime, Traveler, Quickr, and even BES will interfere when they

are installed• There are three options for the Mail Redirector for you to use

including a reverse proxy option• The iNotes Redirector is not cluster aware• Be careful when consolidating or moving users between servers

so the user does not lose their configuration• Debug is your friend, but turn it off once everything works• iNotes is not Lotus Notes Traveler even on an iPhone

87

Your Turn!

How to contact me:Keith Brooks

[email protected]

© 2010 Wellesley Information Services. All rights reserved. Under the Hood of Mail Redirection and...

Documents

Transcript of © 2010 Wellesley Information Services. All rights reserved. Under the Hood of Mail Redirection and...