Proxy from Domino 8.5.3 to Connections

Question

I am trying to setup a proxy configuration on a dev 853 domino server, so I can connect to a dev connections server from an XPage (using java).

It's an SSO environment, and both the domino server and connections server are protected by WebSEAL. I want to make server-side calls in java (using the Apache HTTP Client), so my XPages application can make a call across to the Connections server.

I followed some information I found in Niklas Heidloff's Social Enabler documentation: http://www.openntf.org/Projects/pmt.nsf/DA2F4D351A9F15B28625792D002D1F18/%24file/SocialEnabler111006.pdf and also in here: http://www.ibm.com/developerworks/lotus/library/inotes-full/index.html

I setup the proxy like this:

Context:    /xsp/proxy/BasicProxy/
URL:        https://connectionsserver.acompany.com
Actions:    GET,HEAD,POST,DELETE,PUT
Cookies:    -List of cookies-
Mime-types: *
Headers:    User-Agent,Accept*,Content*,Authorization*,Set-Cookie

When I try the call, it gives me the following error:

2/28/13 12:34 PM: Exception Thrown
javax.servlet.ServletException: com.ibm.jsse2.util.g: No trusted certificate found
at com.ibm.domino.servlets.proxy.BasicProxy.throwServletException(BasicProxy.java:765)
at com.ibm.domino.servlets.proxy.BasicProxy.service(BasicProxy.java:357)..
...
Caused by: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.g: No trusted certificate found

I thought that passing the cookies across in this way should work (the cookies should work between both the domino-webseal and connections-webseal environments).

The error suggests that I need to import a certificate. I don't have access to the domino server to allow me to import certificates, so before I request that, I wanted to check I wasn't missing something from somewhere else.

Is there something else I am missing? Or any suggestions on doing this a different way?

Thanks, Pam.

stwissel stwissel · Accepted Answer · 2013-03-01T01:00:30

You have to import the certificates if they are not present. That is what the error message is indicating. There is IBM Technote 21588966 describing the necessary steps.

Furthermore (that could become the next showstopper after you sorted out SSL) you have to have a hard look how WebSeal is configured. The challenge here: WebSeal is designed to accommodate any possible backends and it is easy to get it almost working - almost as in: works for direct access via browser but fails on server-2-server or Ajax etc. The super-highly-recommended-ignore-on-your-own-risk setting for Connections/Domino is to use WebSeal's LTPA capabilities and not some ludicrous code injection.

Hth

Proxy from Domino 8.5.3 to Connections

1 Answers