Lotus Domino Administrator 7 Help - Lotus documentation

Server names
You can add server names to an ACL to control the changes a database receives from a database replica.
To ensure tighter security, use the full hierarchical name of the server -- for example, Server1/Sales/Acme
-- regardless of whether the name of the server being added is in a different hierarchical organization
than that of the server that stores the database.
Group names
You add a group name -- for example, Training -- to the ACL to represent multiple users or servers that
require the same access. Users must be listed in groups with a primary hierarchical name or an alternate
name. Groups can also have wildcard entries as members. Before you can use a group name in an ACL,
you must create the group in the Domino Directory or in either a secondary Domino Directory or an
external LDAP Directory that has been configured for group authorization in the Directory Assistance
database.
Note: Be sure that any group names you use in an ACL comply with the specified guidelines for creating
them. The use of erroneous names may cause access problems.
Tip: Use individual names rather than group names for the managers of a database. Then when users
choose Create - Other - Memo to Database Manager, they’ll know whom they are addressing.
Groups provide a convenient way to administer a database ACL. Using a group in the ACL offers the
following advantages:
v Instead of adding a long list of individual names to an ACL, you can add one group name. If a group
is listed in more than one ACL, modify the group document in the Domino Directory or the LDAP
Directory, rather than add and delete individual names in multiple databases.
v If you need to change the access level for several users or servers, you can do so once for the entire
group.
v Use group names to reflect the responsibilities of group members or the organization of a department
or company.
Tip: You can also use groups to let certain users control access to the database without giving them
Manager or Designer access. For example, you can create groups in the Domino Directory for each level
of database access needed, add the groups to the ACL, and allow specific users to own the groups. These
users can then modify the groups, but they can’t modify the database design.
Terminations group
When employees leave your organization, you should remove their names from all groups in the Domino
Directory and add them to a Deny List Only group used to deny access to servers. The Deny Access list
in the Server document contains the names of Notes users and groups who no longer have access to
Domino servers. You should also make sure that the names of terminated employees are removed from
the ACLs of all databases in your organization. When you delete a person from the Domino Directory,
you have the option to ″Add deleted user to deny access group,″ if such a group has been created. (If no
such group exists, the dialog box displays ″No Deny Access group selected or available.″)
For more information on Deny List Only groups, see the chapter ″Setting Up and Managing Groups.″
For more information on the Deny Access list, see the chapter ″Controlling Access to Domino Servers.″For
more information on the Deny Access list, see the chapter ″Controlling Access to Domino Servers.″
Alternate names
An alternate name is an optional alias name that an administrator assigns to a registered Notes user. You
can add alternate names to an ACL. An alternate name provides the same level of security as the user’s
primary hierarchical name. For a user whose primary name is Sandra Brown/West/Sales/Acme, an
example of an alternate name format would be Sandy Smith/ANWest/ANSales/ANAcme, where AN is
an alternate name.
1028 Lotus Domino Administrator 7 Help