This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


Mar 29, 2013, 12:10 PM
8 Posts

RE: Redirect TCP to SSL setting and infinite redirection

  • Category: Domino Server
  • Platform: Windows
  • Release: 9.0
  • Role: Administrator
  • Tags: HTTP,SSL,Security
  • Replies: 24

Mike,

Since we can't repeat this on any servers, I thought it must be a result of a setting coming from my names.nsf. I tried 10-15 different things and found the difference :)

I have a notes.ini setting "HTTPEnableConnectorHeaders=1" which is defined in the configuration document. So it comes to every servers I have (My servers were behind plugin before). After deleting this entry, it is back to normal. I guess the IHS implementation may have changed this behaviour. 

 

Thx for the effort!

Apr 1, 2013, 12:39 PM
27 Posts
HTTPEnableConnectorHeaders=1
Yes, this will cause all kinds of problems if not running IHS in front of Domino in self contained mode or running with the WAS Websphere Web Connectors (reverse proxy modules).  This parameter indicates that we should look for special context headers and use those headers for the context of the SSL connection between the Browser and IHS.  If the SSL context header is not present we think the connection between IHS and the browser is not SSL and can get into an infinite redirection loop.  

The Domino SSL network connection has no effect on whether the connection is SSL or not with this ini. The connection may be normal http between IHS and the Browser and SSL between IHS and Domino (not a likely configuration, but possible).

That explains the behavior you are seeing, and why we were not reproducing in the lab,


This ini should only be set if running Domino in back of the WAS Reverse Proxy Plugins/modules.  It is not used/needed for the case where Domino runs IHS for the TLS stack locally on the same machine, and it should never be used when Domino is a contacted directly by browser clients.

Thanks for the info, this is something we should tech note and/or make support aware of in case others run into this.

This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal