Notes / Domino
Overdue PSA: Reverse-Proxy Headers in Domino 12.0.1FP1 and Newer 
By Jesse Gallagher | 1/25/23 11:19 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
Just over a year ago now, I wrote a blog post describing the sudden removal of my beloved HTTPEnableConnectorHeaders notes.ini parameter in the 12.0.1 release.
However, during the administration-focused OpenNTF Repair Café today, I was reminded that I never modified that post or made a followup to detail the changes since then. I plan to remedy that here!
Nomad Web server connection options
By Daniel Nashed | 1/25/23 7:30 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
Nomad Web is a modern HCL client offering in form of a Progressive Web Application (PWA) running in your web browser.
In addition to Windows or Mac, it also works on Ubuntu and other Linux distributions! So there is finally a client offering for Linux clients again!
The Nomad Web application is installed on a server providing the required files for download.
Those files can be stored on a SafeLinx or Domino/Nomad Web server.
Windows Sandbox - A feature you should know
By Daniel Nashed | 1/23/23 2:20 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
The sandbox can be a very useful tool for many different situations.
I am often using it for Domino server or client install tests.
But there are many other use cases including training environments etc.
It's a full throw away sandbox environment recreated every time you start it.
The only limitation is that you can't reboot the Windows for example after a software update.
But even installing the Windows re-distributable run-time package does not require a boot.
Most applications like Notes/Domino install it on their own.
I needed it to test my own applications. But there is an easy way to download and silent install it:
NGINX TCP Stream with SNI support. More than helpful for lab environments
By Daniel Nashed | 1/23/23 2:15 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
In production you usually want centralized certificate handling and off-loading TLS termination to a load-balancer.
I posted scripts to have NGINX realod certs automatically from Domino CertMgr via HTTPS to leverage Domino's Let's Encrypt implementation.
But sometimes you really want all your servers directly exposed over TLS.
For example in a lab environment with limited resources and only one IP, you might want to still have each of the hosts expose their services on their own.
Quest for SAML to everybody continues
By Fredrik Norling | 1/23/23 2:10 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
My article regarding debugging SAML on HCL Domino is updated today with 2 points
What is the SP certificate used for
What can be wrong when you get a login loop
Check it out in the article https://www.xpagedeveloper.com/2022/debugging-saml-setups-in-hcl-domino
Certificate Information tool
By Fredrik Norling | 1/17/23 2:40 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
SSL certificates, SAML certificates, Signing certificates the number is long of different kinds of certificates and you might need to check the name of a certificate, the start or end date or perhaps the thumbprint.
I use the tool mainly to get end dates of certificates sent to me from customers because I hate when they expire and need to be changed without any preparation. And the worst kind that most administrators often miss is the certificates that is auto created i.e. in ADFS servers, Azure Enterprise apps, Okta
Email Encryption
By Prominic.NET | 1/12/23 9:20 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Emails are now not only an important part of our daily lives but also one of the most used gateways for cybercriminals into our lives. Let’s explore how we can keep the door shut.
Please wait until that HTTP service is ready
By Stephan Wissel | 1/3/23 10:17 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Our brave new world of containers and microservices runs on a combination of YAML and shell scripts. Getting them to run in the desired sequence can be a challenge. When ready isn't ready All container environments have a 'depends' clause, so the container runtime can determine the correct startup startup sequence for the zoo of containers comprising the application to be launched. Each container will usually signal when it is ready.
However ready can mean different things to different applications.
In the container world it should be: the service is available.
However it could be: service was successfully started, but might be busy with house keeping. In the later case the start scripts of the dependent services need to do their own waiting
HCL Domino, view indexer stuck with very high CPU usage
By Jesper Kiær | 1/2/23 6:16 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
I have a customer who has a Domino server running with very high CPU usage, and it should not, since it is not a very busy server.
It is the indexer which gets stuck with very high CPU usage
Solution for broken TrendMicro ScanMail for Domino 12.0.2 on Windows
By Remco Angioni | 12/23/22 4:16 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
After upgrading the Domino to 12.0.2, TrendMicro scanmail stops working. The cause is C API OSLoadLibrary changes in Domino 12.0.2.
TrendMicro had identified the problem and created a temp workaround for it.
See article: https://success.trendmicro.com/dcx/s/solution/000291870?language=en_US
Posted presentation on CompareDBs
By Andre Guirard | 12/14/22 2:16 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
I gave a presentation about CompareDBs, the new template in 12.0.1 Domino server, for a recent OpenNTF webinar. The slides for that — with their attached notes — are a reasonably good summary of what the tool is good for, so I decided to post them here.
How to configure SAML SSO for HCL Nomad Web for Domino using Keycloak - Part 2
By Heiko Voigt | 12/13/22 12:38 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
So it took a little bit longer to get this 2nd part of the series - I ran into some issues during the configuration, also, we decided to upgrade our Keycloak implementation to the latest version 20.x and experienced some setbacks when re-importing the configuration from version 18.x - we lost a couple of settings and it took a while to find the differences and patch them up.
How to get the error message for a Notes error code
By Daniel Nashed | 12/13/22 1:34 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Sometimes scripts or Domino server commands only return an error code and you would like to know the error message.
There is an easy way to get the error message back from a server command.
"show message [module]
In most cases you don't need server tasks specific error messages and just use the decimal error code.
Setup DKIM for HCL Domino 12.0.2
By Remco Angioni | 12/9/22 1:58 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Finally we can setup and use DKIM email authentication in HCL Domino. Here are the steps for adding DKIM in Domino and DNS.The actions are my actual commands for adding DKIM to my angioni.nl domain.
HCL Notes Client – “Invalid RTF Data On The Clipboard”
By Ulrich Krause | 12/3/22 11:30 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
The issue applies to HCL Notes 12.0.1 standard and basic as well as HCL Notes 12.0.2 32/64Bit standard and basic.
When you try to change your signature in the Calendar Profile, you get the error message
OpenNTF Quickie: Install Domino + Nomad + Leap on Docker - YouTube
By OpenNTF | 11/30/22 3:40 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
This video demonstrates the installation process for Domino 12.0.2 including HCL Nomad Web and HCL Domino Leap on Docker using the Domino Container build script.
ID Vault “Invalid or nonexistent document” error caused by Cluster Symmetry Repair
By Kim Greene | 11/29/22 12:34 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
In helping a customer who was having an issue with getting TOTP working, I came upon an interesting situation with their ID Vault. When issuing ‘show idvault’, the following error was displayed.
Invalid or nonexistent document: Vault replica list inconsistency for vault /ID_Vault
The really strange thing about this situation was the replica of the ID Vault was on both the primary and secondary server, however only the primary server was listed as a Vault Server in the ID Vault itself.
How to configure SAML SSO for HCL Nomad Web for Domino using Keycloak - Part 1
By Heiko Voigt | 11/29/22 10:57 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
This is part one of my series on how to utilize Keycloak as the SAML IDP for HCL Nomad Web for Domino. While HCL describes the use of ADFS in the online documemtation, Keycloak can serve for this purpose with ease as well. Within this series I want to describe the components and configurations that are necessary to make the two work together.
The lsconst expedient
By Andre Guirard | 11/28/22 10:12 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
There are a lot of handy constants included in the LotusScript file lsconst.lss, which you can include in your scripts via the statement:
%Include "lsconst.lss"
It contains many “Const” definitions for symbolic names needed for calling built-in functions, such as this constant useful when calling Messagebox function:
Public Const MB_OK = 0
None of these constants is necessary since you can also hardcode the constant value when you make your call. But it makes your code easier to read and maintain if you use the symbolic names, so this is a best practice.
Domino 12.0.2 on Docker - some changes with One Touch setup
By Oliver Busse | 11/28/22 4:03 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Today I learned the hard way what it means to "reset" the Docker Desktop installation using a tool like "Clean My Mac X", a tool that I strongly recommend to get rid of all crap that slows down your system - and does much more.
However, resetting a Docker Desktop installation means that everything is wiped - except from the program itself. Docker started to be unstable, so my plan was to re-install it.
After I did this task, I found out that all my containers were gone - including the images and volumes. The latter is the worst, so be careful.
Restic – Command Line Tool supporting Windows VSS
By Daniel Nashed | 11/24/22 2:03 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Now that Domino 12.0.2 is has a native VSS Writer, we can look into new interesting integrations.
In my session at SUTOL conference this week, I showed a first version of a Restic integration for Domino 12.0.2 via VSS.
Restic is a very interesting application (https://restic.net)
It's a single binary written in GO
And uses a approach like Borg Backup uses. But in contrast to Borg Backup it has full Windows support.
This includes VSS Writer + AutoRecovery support!
It is Open Source, efficient, flexible & secure.
And very simple to setup & use!
Domino Oddness on Azure - 38 second delay in sending mail from web UI
By Sean Cull | 11/22/22 10:43 AM | Infrastructure - Notes / Domino | Added by Oliver Busse
We have had an odd issue on Domino that we have not been able to resolve despite lots of input from HCL. I just wanted to post it in case any other person comes across it.
The symptom is a Domlog entry for 38 seconds when you trigger an email via XPages.
This happened @4 years ago on an Azure Linux Domino 9 server ( which we scrapped ) and then started again with an Azure Windows Domino 11 server about a year ago.
HCL Notes 12.0.2 - New Signature feature seems broken
By Jesper Kiær | 11/21/22 2:07 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
To test the new HCL Notes 12.0.2 "Signature" feature I created a simple form with a Rich Text Lite field for testing out the feature.
I have have removed all options,but the signature feature for the field.
Only a part of the image seem to be saved in the field.
Tinkering with Mastodon, Keycloak, and Domino
By Jesse Gallagher | 11/11/22 4:00 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Because of what I'll euphemistically call the current historical moment on Twitter, I (like a lot of people) decided to give another look at Mastodon. The normal way one would use it would be to sign up at mastodon.social and be on one's merry way, treating it just like a slightly-different Twitter.
However, Mastodon is intentionally designed to be federated in a way similar to email, and the software is available on GitHub complete with scripts for Docker Compose, Vagrant, and so forth. So I went and did that, setting up my currently-barely-used account at @jesse@pub.frostillic.us.
That on its own isn't particularly notable, nor are the specifics of how I set it up (it was a hodgepodge of a couple posts you can find by looking for "mastodon docker compose"). What I found neat for our purposes here was the way I could piggyback authentication onto stuff I had recently done with Keycloak. Keycloak, incidentally, was the topic of today's OpenNTF webinar, so, if you didn't see it, check back there for the replay when it's posted.
November OpenNTF Webinar: Integrate Keycloak with Domino for Identity Management
By OpenNTF | 11/9/22 4:09 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
In the days of micro-services, Identity Management, Identity Brokering and Single-Sign-On Capabilities are getting more and more important. HCL has put some serious investment into modernizing the various Domino authentication capabilities but still a lot of services require external system integration to be a nice citizen in a service orchestra. In this session, Heiko want to demonstrate the use cases and technical ways to integrate one major Open Source Identity Management system with HCL Domino - Keycloak.
Protecting your Domino container with fail2ban
By Martijn de Jong | 11/7/22 4:25 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
If your Domino server is connected to the Internet, you’ll find that bots (hacked systems running a script) will throw a brute force attack on your Domino server. For me, especially, my SMTP server was under heavy attack.
The reason why it’s interesting for hackers to find a valid login on an SMTP server, is that this will probably allow them to send spam through your mail server. Most mail servers allow sending mail through their servers for other domains for authenticated users only. The chances of them guessing any of the users in my Domino directory right and then also guessing the password correctly are basically zero, but the pollution of my log file is reason enough to stop them.
Fail2ban is a very elegant program for Linux to do just that. You can configure it to scan log files for certain patterns (it uses RegEx to recognise them) and add hosts that match those patterns too often within a defined period of time, to the block list of iptables.
First look at the Genesis Catalog - the App Store for Domino software
By Prominic.NET | 11/3/22 1:26 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
During Collabsphere 2022, Prominic’s CTO Justin Hill presented a new tool we’ve made at Prominic that is not only very useful but also has a great potential: Genesis.
SnTT - Which Database has an FTI?
By Keith Brooks | 11/3/22 6:43 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Earlier this year, Martin Vogel and I gave a session at Engage titled "Teaching Young and Old Dogs New Tricks: Notes & Domino Shortcuts You Wish You Knew," It was a great session with a filled capacity of the room.
But I was neglectful; I had planned to post some essential tips in my blog at the time but did not get to it. I will try to make up for it over the next few weeks.
The first one that not everyone may know about is how to find out which databases have a FTI, Full Text Index.
Here is the scenario:
You are asked to build new servers for your customer or organization and while looking at the old server, notice some indexing on some databases. This causes you to think, how do I find out which databases have an FTI so they can be rebuilt on the new server?
How to Enable, or Disable, TOTP for HCL Traveler and Verse
By Keith Brooks | 10/28/22 3:01 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
After a discussion with fellow HCL Ambassador David Hablewitz, I realized I did not fully explain the HCL Traveler/Verse (will just refer to it as Verse) and TOTP issue in my blog post the other day,
I intended to explain the pros and cons of using TOTP and Verse, but I neglected to explain how to enable or disable TOTP and what you do if you have one server or separate servers.
The how-to is what this post is about.
Returning a 401 status
By Tom Van Aken | 10/27/22 12:17 PM | Infrastructure - Notes / Domino | Added by Oliver Busse
This section was originally part of a blogpost in my LotusScript REST API series. Since this is an interesting topic and also relevant for other REST API solutions, I decided to create a separate blogpost on this topic.