You must prepare a Domino® server for Windows™ single sign-on for Web clients.

Procedure

1. Run the HTTP task on the Domino server.

2. If you have not done so already, set up the Domino server to use multi-server session-based authentication (single sign-on).

• The single sign-on (SSO) configuration can use keys imported from WebSphere® or it can use Domino SSO keys created in the SSO configuration.
• The SSO configuration can be done through Web Sites or Server documents. Web Sites are advantageous because they enable you to set up a separate Web Site for Web clients to use that don't participate in Windows single sign-on. For more information, see the topic Setting up separate Web sites for participating and non-participating Web clients in the related links.
• The Idle Session Timeout option available for a Domino-only Web SSO configuration, which prompts users to log in again after HTTP sessions are idle for a specified period, does not apply in an environment that uses Windows single sign-on.

• If your SSO configuration is done through Web Sites, edit the Web SSO Configuration document located in the Configuration -> Web -> Internet Sites view of the Domino Directory.
• If your SSO configuration is done through Server documents, edit the Web SSO Configuration document located in the Configuration -> Web -> Web Configurations view of the Domino Directory.

Windows single sign-on for Web clients can involve the use of up to three different names for a single user, therefore increasing the Maximum cached users value on the server may be warranted. To determine an appropriate value for this setting, first estimate the number of authenticated users who will log in at any one time. If there are relatively few users, for example a number about equivalent to the default cached users value of 64, specify a value that is about 3 times the number of users. If there are many users, for example about 1000 or more, specify a value that is 20% to 50% greater than the number of users.

Setting up separate Web sites for participating and non-participating Web clients
Windows single sign-on is not available to some Web clients, for example, Web clients that connect over the Internet (rather than the intranet) or that are not set up to use the feature. When these clients connect to a Domino server through a URL participating in Windows single sign-on, they are either blocked from accessing the server (Firefox users) or are inconvenienced by extra login prompts (Internet Explorer users). If your SSO configuration is done through Web Sites, you can work around this problem by setting up separate Web Sites, one for participating Web clients to use and another for non-participating Web clients to use.

Related tasks
Setting up separate Web sites for participating and non-participating Web clients
Multi-server session-based authentication (single sign-on)
Creating a Web SSO configuration document
Managing the memory cache on the Web server
Setting up Windows single sign-on for Web clients

Related information
Troubleshooting Windows single sign-on for Web clients (SPNEGO)