Advanced Inotes Configurations:: Proxies / Plugins / Troubleshooting
Advanced Inotes Configurations:: Proxies / Plugins / Troubleshooting
Amy Knox
Brandon Kutsch
Austin, TX USA
Lemo Lazo
JoAnn Nuas
Manila, PH
2
1.0 Domino with Proxies
1.1 Proxy Server Basics
1.2 Configuring Domino with Proxy Servers
1.3 iNotes Redirection Database
2.0 iNotes Browser Plugins
2.1 ActiveX Attachment Control
2.2 Browser Cache Management
3.0 Troubleshooting iNotes
3.1 Defining the Problem
3.2 Troubleshooting Flowchart
3.3 Known Issues
3.4 Tools and Debug
3
Amy Knox
5
1.1 Proxy Servers Basics
●
Many vendors to choose from:
– IBM®, Juniper®, F5®, Barracuda®, Apache®,
and many others
●
Several possible configurations
●
Benefits include:
– Security: 'The bouncer' – controls what gets into
the network via URL masking
– Load balancing and failover: 'The traffic cop' –
directs user requests to an available resource,
caches static content
– SSL Acceleration: 'The math whiz' – handles
SSL encryption with clients
IBM Corporation ©2015
6
Possible variation of Domino iNotes configuration
with Reverse Proxy
– Before introducing a Proxy server to the environment, test to ensure everything works as
expected when connecting directly to Domino
– In general, the Domino Web server is network agnostic: it doesn't matter how the user
arrives to the Domino http server, as long as the request makes it to its HTTP port
– Typically, the proxy admin will take care of re-write rules to account for any host name
changes, so no additional configuration changes are necessary at Domino
●
Headers:
– All iNotes headers need to be passed by the proxy between the server and the browser
– Referer checking / NONCE headers used by iNotes for security (TN# 1412267)
– If headers are blocked by a proxy, connections may fail or have unexpected results
●
Persistent Connections:
– Session headers and login tokens are used for session persistence: shimmer and shimmerS cookies
– Persistent connections enabled by default; (Server doc → Internet Protocols tab)
– May need to also be configured on the reverse proxy server configuration
Troubleshooting:
●
Test with/without going through the proxy server
●
Compare and Verify that request data is not being corrupted by the proxy :
– Client HTTP request logs (Fiddler)
– Server HTTP request logs
– iNotes_WA_UseRelativeUrl=1
● New with 8.5.3
● Tells iNotes to use relative URLs instead of explicit URLs
IBM Corporation ©2015
11
1.2 Configuring Domino with Proxy Servers
TN# 1508407: Unable to access iNotes mail archive or open another user's mail file through reverse proxy or load balancer
TN# 1377779: Optional notes.ini parameter to allow DWA to use the HTTP hostname when generating a URL
TN# 1258823 : Should the Domino HTTP server be configured to use Persistent Connections?
TN# 1453878: Security enhancements in iNotes 8.5.2 may require configuration changes in environments with reverse proxies
Using Apache as a Reverse Proxy and Load Balancer for iNotes Clustered Servers
Apache as a reverse proxy for IBM Domino iNotes with home server redirection
Achieving high availability with IBM Lotus iNotes: (Also see: iNotes high availability case study - PDF 2013
ii) Browser Cache Control - cleans up temporary directory after reading or use of attachments
Iii) DOLS Control: Domino Offline Services – used for archiving locally (not dealing with in this session)
(1) End User manually downloads from server. ActiveX control is invoked when a user opens:
- An email with an attachment , expands the attachments section
- Creates an email, opens attachment area
- Opens iNotes preferences
Note: Prior to 9.0.1 ActiveX used to require Admin rights to install. However since 9.0.1, a standard user can now install ActiveX
without UAC interference. For more see technote below:
Title: Is it possible to install ActiveX for use with iNotes without Administrative rights?
http://www.ibm.com/support/docview.wss?uid=swg21669475
(2) ActiveX can be pre-installed via an MSI. This is normally pushed out via MS Group Policy.
Note: ActiveX files which are installed by MSI installer must be un-installed by its own un-installer from "Add or Remove
Programs" in the Windows Control Panel. If the files are removed in another way, it will cause a problem because the registry
values can be left behind.
(2) User clicks OK at (a), to install the control, and then clicks "Install" at (b) to allow the add-on to run
•
IE then reloads the entire web page (remembering
these decisions) and allows iNotes ActiveX usage
for this session and subsequent sessions.
•
•
IBM Corporation ©2015
23
2.1 Browser prompts contd..
(4). Clicking “More options” from previous prompt gives us the dialog as in (d).
Selecting "Always install..." here is to trust the certificate of the publisher (IBM)
and means the prompt won't appear again for subsequent installs from the
same publisher. The certificate is stored in Internet Options.
If the certificate is removed, the previous add-in dialog (c) will appear again
when the iNotes Control is installed or upgraded.
•
Finally you may see a security warning before running as in (e).
Notes:
● If using the MSI to install ActiveX you should use the MSI again to un-install ActiveX (otherwise registry entries left behind)
● The current MSI does not un-install previous versions before installing new ones (Open Enh SPR # SDOY9RLDEM - iNotes,
MSI Does Not Un-install Previous ActiveX Versions)
● Must use the matching MSI for your installed server version to push out the correct ActiveX controls.
(1) Through the command prompt (by invoking Windows start menu > All Programs > Accessories > Command Prompt)
Or Windows Explorer:
- C: \Users\<>\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files when another user installs it, for e.g. a
standard user
Not recommended:
Installing with standard user first, then installing as administrator (or installing for all users) is not recommend.
The control may not load correctly and then its impossible to un-install it from Manage Add-ons panel. It would then be
necessary to manually delete the DLL control from the installed folder and clean up the registry.
SPR # SDOY8HMLJB - Inotes: enh Request: Tool To Clean Up All The Activex Files And Registry Entries Before Installing A
New Version
The forms file i.e. Forms9.nsf shows the iNotes version. To display its number, login to iNotes, click on iNotes help /about iNotes
Alternatively you can check it from the iNotes console ($Haiku version) Ref TN: 1169544
SPR # NKEY9LCM7X -Enhancement Request - That The Inotes Activex Control , BCM And MSI Filenames Reflect The Exact
Version Being Used..(for eg. 9.0.1_msi_fp3)
• Purpose of BCM
• Reasons to use BCM
• Browser Helper Object - dwabho.dll
• Installing BCM
• Upgrading BCM
• Known issues / tech-notes
An updated browser cache dwabho.dll only comes out at major releases (one exception when we sent out a
new dwabho.dll was 8.5.1FP2, see known issues section)
Active X needs to be installed with Admin Rights and the browser open with Admin Rights
Once BCM has been installed, if the user selects logout, they will see the following:
- There was a reported issue where BCM was installed in 901, that caused Internet Explorer to crash - SPR #
PPET9J3H9X , this issue was resolved in v9.0.1FP2.
- There was a reported that “Clicking 'Logout' button in iNotes 8.5.3 full mode logs user out of Sametime but not iNotes”.
http://www-01.ibm.com/support/docview.wss?uid=swg21568710
–>SPR# MJON8MSK2V Resolved in 8.5.3 Fix Pack 1 and Interim Fix 1 for Lotus iNotes 8.5.3.
Enhancement:
- To install Browser Cache Management you must logon to Windows as Administrator. See enhancement SPR: #
SDOY9RXG47 - iNotes: Browser Cache installation to work as ActiveX does so it can be installed by non-admin user
●
Problem definition: Need clear view of the problem
Is it an iNotes issue?
Some common iNotes issues: There are known issues that affects
● Attachments/Activex Control iNotes:
● Browser related Yes/ ● Poodle Vulnerability
● Disappearing buttons/Unusual Behavior No ● Security/SSL certificate issue
● Workstation specific ● Network connectivity
● Errors encountered ● Web Redirection issue
Troubleshooting Tools
● What logs/files to gather
● What to look for in the logs/files
● What are the reasons why we gather
logs/files
Title: Error while accessing mail file on Domino server through HTTP "ERR_VERSION_OR_CIPHER_MISMATCH" and
"ssl_error_no_cypher_overlap"
Doc #: 1695548
URL: http://www.ibm.com/support/docview.wss?uid=swg21695548
IBM Corporation ©2015
45
3.3 Known Issues
Title: How to delete one user's Personal Options in the Redirect database
Doc #: 1272957
URL: http://www.ibm.com/support/docview.wss?uid=swg21272957
Title: How to allow the user to delete the iNotes profile in iNotes
Doc #: 1512367
URL: http://www.ibm.com/support/docview.wss?uid=swg21512367
IBM Corporation ©2015
47
3.3 Known Issues
Workstation Specific
Can the problem be reproduced on multiple workstations?
Check and Troubleshoot the network connection
There is a possibility also that it can be caused by a Windows Workstation Policy
Attachment/Activex Issue
Can't open attachment in Inotes
http://www-
01.ibm.com/support/knowledgecenter/SSKTMJ_8.5.3/com.ibm.help.domino.admin85.doc/___whatsnewinibmlotusdomino853.html?
cp=SSKTMJ_8.5.3%2F1
●
What to look for in the logs/files
Inotes console
- If an error message displays in the status bar, you can view the console for information by clicking on
Show Console. In rare instances in which the text length of an error message obscures Show Console,
use the method below to view the console.It would definitely help if the troubleshooting if you gather the
iNotes console log
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/using-the-inotes-console-log-to-inspect-and-copy-debug-information
Server console logs
- This contains relevant information such as errors that Domino captured on the time of the failure
HTTP request logs
- Contains http response information (http status codes) from the server.
Fiddler logs
- Contains client side http information to the server.
Screen shots related to the issues
- Views of the actual error seen by the users.
IBM Corporation ©2015
49
Questions?
Press *1 on your telephone to ask a question.
Visit our Support Technical Exchange page or our Facebook page for details on
future events.
To help shape the future of IBM software, take this quality survey and share your
opinion of IBM software used within your organization: https://ibm.biz/BdxqB2