Security

IBM® Connections provides a flexible security infrastructure that supports an open, easily shareable data model.

Find out what security applications are provided by default in IBM Connections and how to implement further security measures to protect sensitive information.

Federal Information Processing Standard (FIPS) 140-2 Compliance and IBM Connections
In IBM Connections™, FIPS compliance is managed through IBM WebSphere® Application Server.
Allowing third-party applications access to data via the OAuth2 protocol
Allow third-party applications to ask your IBM Connections users for access to their data.
Configuring single sign-on
Set up single sign-on integration between IBM Connections and other IBM products and third-party security products.
Authentication with SAML
You can use the SAML (Security Assertion Markup Language) 2.0 web SSO redirection services support to implement user authentication and single sign-on (SSO). To establish your SAML environment, you must consider the following information to ensure that your system is a good candidate.
Configuring the AJAX proxy
By default, the IBM Connections AJAX proxy is configured to allow cookies, headers or mime types, and all HTTP actions to be exchanged among the IBM Connections applications. If you want to change the traffic that is allowed from non-IBM Connections services, you must explicitly configure it.
Enabling locked domains
Assuming that you have completed the server setup previously described, to enable locked domains in IBM Connections, specify an additional attribute in the LotusConnections-config.xml to ensure that only ConnectionsOpensocial application is mapped to the locked domain host.
Enabling virus scanning
Edit configuration property settings to force the applications that handle uploaded files to scan all files for viruses.
Forcing traffic to be sent over an encrypted connection
You can configure IBM Connections to force all traffic that passes between an IBM Connections server and a user's web browser to be sent over an encrypted connection.
Forcing traffic to use TLS 1.2
You can configure IBM® Connections to force all traffic that passes between a Connections server and a user's web browser to be sent over TLS 1.2 to avoid security vulnerabilities in TLS 1.1 and earlier versions of SSL.
Forcing users to log in before they can access an application
Change the access levels of members or groups to require them to provide credentials before they can access an IBM Connections application.
Securing applications from malicious attack
IBM Connections provides security measures, such as an active content filter and content upload limits, that you can use to mitigate the risk of malicious attacks. Because these security measures can also limit the flexibility of the applications, you, as the system administrator, must evaluate the security of your network and determine whether or not you need to implement them.
Restricting domains used by the login page redirect parameter
By default, the IBM Connections default login page allows redirecting to any destination. You can configure Connections to use a whitelist of domains to ensure login navigation to a secure page.

Related reference:

Forums configuration properties