Front cover - IBM Redbooks

502 Lotus Security Handbook
of whether the name of the server being added is in a different hierarchical
organization than that of the server that stores the database.
Group names
You add a group name – for example, Training – to the ACL to represent multiple
users or servers that require the same access. Users must be listed in groups
with a primary hierarchical name or an alternate name. Groups can also have
wildcard entries as members. Before you can use a group name in an ACL, you
must create the group in the Domino Directory or in either a secondary Domino
Directory or an external LDAP Directory that has been configured for group
authorization in the Directory Assistance database.
Groups provide a convenient way to administer a database ACL. Using a group
in the ACL offers the following advantages:
► Instead of adding a long list of individual names to an ACL, you can add one
group name. If a group is listed in more than one ACL, modify the group
document in the Domino Directory or the LDAP Directory, rather than add and
delete individual names in multiple databases.
► If you need to change the access level for several users or servers, you can
do so once for the entire group.
► Use group names to reflect the responsibilities of group members or the
organization of a department or company.
Tip: You can also use groups to let certain users control access to the
database without giving them Manager or Designer access. For example, you
can create groups in the Domino Directory for each level of database access
needed, add the groups to the ACL, and allow specific users to own the
groups. These users can then modify the groups, but they can't modify the
database design.
Terminations group
When employees leave an organization, you should remove their names from all
groups in the Domino Directory and add them to a Deny List Only group used to
deny access to servers. The Deny Access list in the Server document contains
the names of Notes users and groups who no longer have access to Domino
servers. You should also make sure that the names of terminated employees are
removed from the ACLs of all databases in your organization. When you delete a
person from the Domino Directory, you have the option to “Add deleted user to
deny access group,” if such a group has been created. (If no such group exists,
the dialog box displays “No Deny Access group selected or available.”)