Configuring A Domino OIDC Provider With One-Touch Setup
Wed Jul 29 15:22:00 EDT 2026
HCL released Fixpack 1 for 14.5.1 the other day, and they decided to toss in a few features. While I imagine the RAG thing had a bunch of people clamoring for it and the proxy port one is a natural small feature to add, the addition to One-Touch Setup stands out a bit. It gains a new property in the configuration JSON but has a pretty-limited scope: it lets you stash a created document's UNID and use it in another doc.
I'm not sure what other use cases people have had for this, but I actually had one specific one that this surprisingly solves: configuring Domino as an OIDC Provider and registering a client. The documents involved in this are a bit unusual in that the Provider document references a Web Site document (from names.nsf) by UNID and not name or host, while the Registered Client document references the Provider document (in the same NSF) by UNID but not as a response document. I've had a couple cases where I want to stand up a reproducible Domino OIDCP server container for development/test purposes, and previously I ended up having to make an NSF housing an agent that does this configuration at launch. That worked, but it meant having a binary NSF, and doing it in text is much nicer for this kind of case.
Anyway, if you're in this very-specific niche with me, here's how you do it. This will assume that you have other ducks in a row (like providing or self-generating TLS certificates and configuring the rest of the JSON as desired).
First off, you'll need a Web Site document for your OIDC Provider, like in this JSON fragment:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 | {
"appConfiguration": {
"databases": [
{
"filePath": "names.nsf",
"action": "update",
"documents": [
{
"action": "create",
"computeWithForm": true,
"referenceName": "$UNID:website",
"items": {
"Form": "WebSite",
"Type": "WebSite",
"ISiteName": "domino-oidcp.example.com",
"ISiteOrg": "OIDCP",
"ISiteAdrs": [
"domino-oidcp.example.com"
],
"WSHostingSrvrs": [
"CN=OIDCPTest/O=OIDCP"
],
"WSIsDflt": "0",
"WSDominoOIDCProvider": "domino-oidcp.example.com",
"HTTP_MaxPostDataLength": "1000000",
"HTTP_EnableSessionAuth": "1",
"HTTP_UTF8": "1",
"TCPAnonymous": "0",
"TCPNameAndPwd": "0",
"HTTP_TCP_Redirect": "1",
"SSLAnonymous": "0",
"SSLBearerToken": "0",
"SSLNameAndPwd": "1",
"SSLCert": "0",
"SSLPasskey": "1",
"HTTP_SessionCookieHTTPOnly": "1",
"HTTP_SessionCookieSecure": "1"
}
}
]
}
]
}
}
|
The new feature is "referenceName", where we set "$UNID:website". The "$UNID" bit is obligatory, while "website" can be a name you pick. That can now be referenced later. As in the later example, I'm using various ".example.com" addresses and "/O=OIDCP" server names from my dev setup, so replace them as desired.
Next up, it's time to create idpcat.nsf and use this feature a couple more times to create the OIDC Provider and Registered Client documents:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | {
"appConfiguration": {
"databases": [
{
"action": "create",
"filePath": "idpcat.nsf",
"templatePath": "idpcat.ntf",
"title": "IdP Catalog",
"documents": [
{
"action": "create",
"computeWithForm": true,
"referenceName": "$UNID:oidcp",
"items": {
"Form": "DominoOIDCProvider",
"DominoServers": "OIDCPTest/OIDCP",
"OIDCP_DominoServers": "OIDCPTest/OIDCP",
"OIDCP_InternetSite": "domino-oidcp.example.com",
"OIDCP_MaxSessionLifetime": 18,
"OIDCP_PrimaryDominoServer": "OIDCPTest/OIDCP",
"SiteUNID": "$UNID:website"
}
},
{
"action": "create",
"computeWithForm": true,
"items": {
"Form": "RegisteredOAuthClient",
"OIDC_ProviderID": "$UNID:oidcp",
"RC_aud": "https://domino-oidcp.example.com/",
"RC_client_id": "example-clientid",
"RC_client_secret": "supersecret",
"RC_redirect_uris": "http://oidcp-testapp.example.com/oidcp-client-app/callback",
"RC_PKCEOptional": "1",
"RC_Name": "example",
"RC_ProviderName": "domino-oidcp.example.com",
"RC_auth_method": "4",
"RC_scope": "openid email $DATA"
}
}
]
}
]
}
}
|
In this, you can see how I set "SiteUNID" in the first document to the UNID of the Web Site document and then subsequently "OIDC_ProviderID" to the UNID of the OIDC Provider doc.
In your use, you may or may not need to make PKCE optional depending on what app you're going to register, and you may want to set "RC_auth_method" differently. In general, you can configure one like you'd want in the Notes UI and then grab the set field values.
Though this feature is pretty limited, maybe it will be of use to you some day, at least to save on an agent or two.