APPLICATION MANAGEMENT


Acceptable entries in the ACL
Acceptable entries in the ACL include:
Each entry can have a maximum of 255 characters.

Add names to the ACL in the hierarchical format assigned by the IBMR LotusR Domino(TM) server administrator. For example:


For more information on creating hierarchical name schemes, see Lotus Domino Administrator Help.

Wildcard entries

To allow general access to a database, you can enter hierarchical names with a wildcard character (*) in the ACL. You can use wildcards in the common name and organizational unit components.

Users and/or servers who do not already have a specific user or group name entry in the ACL, and whose hierarchical names include the components that contain a wildcard, are given the highest level of access specified by every one of the wildcard entries that match.

Here is an ACL entry in wildcard format:


This entry grants the chosen access level to:
This entry does not grant the chosen access level to:
You can use a wildcard only at the leftmost portion of the ACL entry. When you use a wildcard ACL entry, set the user type in the ACL as Unspecified, Mixed Group, or Person Group.

User names

You can add to an ACL the names of any individuals with certified IBMR LotusR NotesR user IDs or Internet users who authenticate using name-and-password or SSL client authentication.


For more information on database access for anonymous Internet users, see Anonymous access.

For more information on setting a maximum level of access for Internet users, see Maximum Internet name-and-password access.

Database 'Lotus Domino Designer 8.5.1 Help', View '(All)|All'

Server names

You can add server names to an ACL to control the changes a database receives from a database replica. To ensure tighter security, use the full hierarchical name of the server -- for example, Server1/Sales/Acme -- regardless of whether the name of the server being added is in a different hierarchical organization than that of the server that stores the database.

Group names

You can add a group name -- for example, Training -- to the ACL to represent multiple users or servers that require the same access. Users must be listed in groups with a primary hierarchical name or an alternate name. Groups can also have wildcard entries as members. Before you can use a group name in an ACL, you must create the group in the Domino Directory or in an LDAP directory that has been configured for group expansion in the Directory Assistance database.

Tip Use individual names rather than group names for the managers of a database. Then when users choose Create - Other - Memo to Database Manager, they'll know whom they are addressing.

Groups provide a convenient way to administer a database ACL. Using a group in the ACL offers the following advantages:


Tip You can also use groups to let certain users control access to the database without giving them Manager or Designer access. For example, you can create groups in the Domino Directory for each level of database access needed, add the groups to the ACL, and allow specific users to own the groups. These users can then modify the groups, but they can't modify the database design.

Terminations group

When employees leave an organization, the Domino administrator should remove their names from all groups in the Domino Directory and add them a terminations group, which is denied access to servers. Work with your server administrator to make sure that the names of terminated employees are removed from the ACLs of all databases in your organization. Make sure that the terminations group is added to the ACLs and that the group is assigned No Access.

You can also use the Deny Access group for this purpose. The Deny Access group contains the names of Notes users who no longer have access to Domino servers. When you delete a person from the Domino Directory, you have the option to "Add deleted user to deny access group," if such a group has been created. (If no such group exists, the dialog box displays "No Deny Access group selected or available.")

For more information on the Deny Access group, see Lotus Domino Administrator Help.

Alternate names

An alternate name is an optional alias name that an administrator assigns to a registered Notes user, often to publish a name in two different character sets, such as English and Kanji. You can add alternate names to an ACL. An alternate name provides the same level of security as the user's primary hierarchical name. An example of a user name in alternate name format is Sandy Smith/ANWest/ANSales/ANAcme, where AN is an alternate name.

LDAP users

You can use a secondary LDAP directory to authenticate Web users. You can then add the names of these Internet users to database ACLs to control user access to databases.

You can also create groups in the secondary LDAP directory that include the Internet user names and then add the groups as entries in Notes database ACLs. For example, an Internet user may try to access a database on a Domino Web server. If the Web server authenticates the user, and if the ACL contains a group named "Web," the server can look up the Web user's name in the group "Web" located in the foreign LDAP directory, in addition to searching for the entry in the primary Domino Directory. Note that for this scenario to work, the Directory Assistance database on the Web server must include an LDAP Directory Assistance document for the LDAP directory with the Group Expansion option enabled. You can also use this feature to look up the names of Notes users stored in foreign LDAP directory groups for database ACL checking.

When you add the name of an LDAP directory user or group to a database ACL, use the LDAP format for the name, but use a forward slash (/), rather than a comma (,), as a delimiter. For example, if the name of a user in the LDAP directory is:


enter the following in the database ACL:
To enter the name of a non-hierarchical LDAP directory group in an ACL, enter only the attribute value, not the attribute name. For example, if the non-hierarchical name of the LDAP group is:
in the ACL enter only:
To enter the name of a hierarchical group name, include LDAP attribute names in ACL entries. For example, if the hierarchical name of the group is:
in the ACL enter:
Note that if the attribute names you specify correspond exactly to those used in Notes -- cn, ou, o, c -- the ACL won't display the attributes.

For example, if you enter this name in an ACL:


because the attributes correspond exactly to those used by Notes, the name appears in the ACL as:
Anonymous access

Anonymous database access is given to Internet users and to Notes users who have not authenticated with the server. You can control the level of database access granted to an anonymous user or server by entering the name Anonymous in the access control list, and assigning an appropriate level of access. Typically you assign Anonymous users Reader access to a database.

The table below describes different ways that an anonymous user can access a database:
Access specifiedAnonymous access enabled for Internet protocolAnonymous access not enabled for Internet protocol
Anonymous access enabled in database ACLUsers access the database with the Anonymous entry's access level. For example, if Anonymous access is set to Reader, anonymous users who access the database have Reader access.Users are prompted to authenticate when they attempt to access any resource on the server. If the user is not listed in the database (through a group entry, a wildcard entry, or if the user name is explicitly listed), then the user accesses the database with the -Default- entry's access level.
Anonymous not listed in database ACLAnonymous users access the database with the -Default- entry's access level. For example, if -Default- access is set to Reader, and there is no Anonymous entry in the ACL, anonymous users who access the database have Reader access.
Anonymous assigned "No Access" in database ACL

Note "Read and write public documents" privileges should be disabled

Users will be prompted to authenticate when they attempt to access this database. When authenticated they will be granted the appropriate access level assigned in the ACL.
Anonymous users (both those who are given access to a database through the Anonymous entry and those who have access through the -Default- entry) who try to do something that is not allowed for their access level will be prompted to authenticate. For example, if Anonymous is set to Reader, and an anonymous user tries to create a new document, that user is prompted to authenticate with a name and password.

Tip If you want all users to authenticate with a database, make sure that Anonymous is in the database ACL with an access level of No Access, and add the Internet user's name to the ACL with the level of access you want the user to have. You should also be sure that the Read Public Documents and Write Public Documents privileges are not enabled in the database ACL.

The Domino server uses the group name Anonymous solely for access control checks. For example, if Anonymous has Author access in the database ACL, the true name of the user appears in the Authors field of documents the user creates in the database. The Domino server can display only the true name of anonymous Notes users, but not of anonymous Web users, in the Authors field of the document. Authors fields are never a security feature, regardless if anonymous access is used; if the validity of the author's name is needed for security, then the document should be signed.

Replica IDs

To allow an agent in one database to use @DbColumn or @DbLookup to retrieve data from another database, enter the replica ID of the database containing the agent in the ACL of the database containing the data to be retrieved. The database containing the agent must have at least Reader access to the database containing the data to be retrieved. Both databases must be on the same server. An example of a replica ID in a database ACL is 85255B42:005A8fA4.

If you do not add the replica ID to the access control list, the other database can still retrieve data if the -Default- access level of your database is Reader or higher.

To determine the replica ID of a database, choose File - Database - Properties, and click the Info (i) tab. Or choose File - Database - Design Synopsis, and select Replication.

To add a replica ID to the ACL

Type or copy and paste the replica ID from the Design Synopsis dialog box into the ACL or type the replica ID you get from the info (i) tab of the Database properties box. You can type the replica ID in uppercase or lowercase characters, but do not enclose it in quotation marks.

Order of evaluation for ACL entries

ACL entries are evaluated in a specific order to determine the access level that will be granted to an authenticated Notes user trying to access the database.


See Also