INSUFFICIENT_ACCESS_RIGHTS Error When Acquiring Lotus Notes/Domino (LND) Server in Secure Mode over TLS

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Risk Analytics
• CA Secure Cloud SaaS - Arcot A-OK (WebFort)
• CLOUDMINDER ADVANCED AUTHENTICATION
• CA Secure Cloud SaaS - Advanced Authentication
• CA Secure Cloud SaaS - Identity Management
• CA Secure Cloud SaaS - Single Sign On

Issue/Introduction

When attempting to acquire a Lotus Notes/Domino (LND) endpoint in secure mode using TLS (SSL), the acquisition fails in the Java Connector Server (JCS) with an INSUFFICIENT_ACCESS_RIGHTS error and the following message:

"Session closed due to communications failure: make sure TrustedCerts.class is included in the deployed connector bundle fragment to enable SSL."

 

 

Environment

Release:
Component: IDMGR

Cause

Starting with Lotus Notes Domino 9.0.1 Fix Pack 5, stand-alone Java DIIOP applications support TLS using a standard Java keystore (.jks) on the client side to store server trusted root certificates. The updated NCSO.jar package no longer relies on the legacy TrustedCerts.class file for SSL/TLS connections.

Resolution

The DIIOP Java application code originally configured for TrustedCerts.class is still supported, but now requires a configuration file named dominocertsconfig.

The updated NCSO API package expects to find dominocertsconfig in the Java Home directory of the JVM running the JCS application.

Steps to Resolve:

1. Create a plain text file named dominocertsconfig (without any file extension).

2. Place the file inside your JCS Java Home directory:

   $$\text{\jvm\}$$

3. Add the following two lines to the dominocertsconfig file, pointing to your Java keystore path and password:
   
   

   domino.keystore=<path to the key store>
   domino.kspassword=<password of the key store>

Example Configuration:

File Location:

C:\Program Files (x86)\CA\Identity Manager\Connector Server\jvm\dominocertsconfig

File Content:

domino.keystore=C:\\certs\\cacerts.jks
domino.kspassword=changeit