In the last few weeks, I’ve been working on configuring authentication for various HCL Domino clients with OIDC. I was trying to configure Notes Federated Login (NFL) with OIDC, but I couldn’t get it to work. After putting all of the required configuration in place, Notes Federated Login would fail without any error messages in the GUI.
The observed behavior indicated that the client simply didn’t receive the instruction to authenticate using NFL with OIDC.
The HCL Domino server in my test environment is currently running on HCL Domino 14.5.1 FP1. For the purposes of testing NFL with OIDC, I was consequently using HCL Notes 14.5.1 FP1.
After opening a case and looking into the logs with colleagues, we found out that the needed parameters set in the policy were not getting applied. After setting the debug parameters as described in KB0130187 - Collecting Data: Notes Federated Login with Domino as the OIDC Provider, we could observe the following error message:
SECPolicyGetNFLOIDCInfoFromPolicyRecord Trust Root KeyChain not foundAs it turns out, this was caused by a defect in the latest pubnames.ntf (Domino Directory Template). After a hotfix was provided and applied, the issue was resolved in my test environment.
If you encounter the same issue while deploying Notes Federated Login with OIDC, you can request a hotfix for this issue by referencing the following article: KB0133973 - Notes Federated Login with OIDC fails due to Trust Root KeyChain not found
I hope this article saves you some time!