My tips have dried up I'm afraid. Instead, today, I've got a lesson I learnt recently, which is worth passing on. It's of use to anybody who might encounter the following in a project - SSL, RSS and session-based authentication.

First a lesson in SSL. When a browser makes a SSL request to a server, the server doesn't know what address it's looking for. It only know the IP address of the request. This is because it can't decrypt the request's headers until it finds the right key to use. For Domino this means finding the right Internet Site document, as there's potentially a different key in each one. To do this it has to match the site by IP address. So, if you're using SSL with an Internet Site document you have to store the server's IP address in there, along with the FQDN of the server. Like so:

This is all very well until you start using RSS. RSS and session-based authentication don't mix. Let's say you have an extranet where Anonymous has no access and there's an RSS feed at the address:

The user will have to login before they see it. No problems there. But, there's a big but. But, what if the user is not a user? What if it's an aggregator? For example, I use FeedDemon (FD) to keep up-to-date with RSS feeds.

If I ask FD to create a new "channel" using the above address it can't. Why? Because it expects XML back from the server. Instead, Domino returns HTML in the form of a login page. FD doesn't know this is a call for authentication, assumes the feed has a problem and leaves it there.

However, FD does support authentication, along with others. To do so it requires one thing — the server returns HTTP Status Code 401. At this point of the signup process we see a login box, like this:

Session-based authentication doesn't return a code 401 though. However, normal non-session-based authentication with Domino does. So, we need to turn off session-based auth for the RSS feed. How do we do this while keeping session-based auth for the normal site?

Well, there's only really one way to do it. We need to bind an additional IP address to the server and add an extra entry to the DNS for it, like so:

192.168.0.101    extranet.company.com
192.168.0.102    rss.extranet.company.com

Now we can add an extra Internet Site document where session-based auth is disabled. The document would look something like this:

The address for the feed would then become:

Does that make sense? I hope so. It just took about an hour to write all that. Hopefully it will be of use to somebody (some of it apples to non-secured RSS feeds where authentication is required) If anybody knows of a better way to do it, please tell.

Further Reading:

• Steven Garrity's wrte-up on secure RSS feeds and aggregator support.
• How to add an additional IP to Windows server (see step 6)
• Adding an additional IP address in Linux