22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

506 Lotus Security Handbook<br />

Replica IDs<br />

To allow an agent in one database to use @DbColumn or @DbLookup to<br />

retrieve data from another database, enter the replica ID of the database<br />

containing the agent in the ACL of the database containing the data to be<br />

retrieved. The database containing the agent must have at least Reader access<br />

to the database containing the data to be retrieved. Both databases must be on<br />

the same server. An example of a replica ID in a database ACL is<br />

85255B42:005A8fA4. You can enter the replica ID in uppercase or lowercase<br />

letters, but do not enclose it in quotation marks.<br />

If you do not add the replica ID to the access control list, the other database can<br />

still retrieve data if the -Default- access level of your database is Reader or<br />

higher.<br />

Order of evaluation for ACL entries<br />

ACL entries are evaluated in a specific order to determine the access level that<br />

will be granted to an authenticated user trying to access the database. If a user<br />

fails to authenticate with a server, and the server permits access anyway, access<br />

will be computed as though the user's name was “Anonymous.”<br />

► The ACL first checks the user name to see if it matches an explicit entry in the<br />

ACL. The ACL checks all matching user names. For example, Sandra E<br />

Smith/West/Acme would match the entries Sandra E Smith/West/Acme/US<br />

and Sandra E Smith. In the event that two different entries for an individual<br />

have different access levels (for example, applied at different times by<br />

different administrators), the user trying to access the database would be<br />

granted the highest access level, as well as the union of the access privileges<br />

of the two entries for that user in the ACL. This can also happen if the user<br />

has alternate names.<br />

Note: If you enter only the common name in the ACL (for example, Sandra<br />

E Smith), then that entry matches only if the user's name and the database<br />

server are in the same domain hierarchy. For example, if the user is Sandra<br />

E Smith, whose hierarchical name is Sandra E Smith/West/Acme, and the<br />

database server is Manufacturing/FactoryCo, then the entry Sandra E<br />

Smith will not get the correct level of access for ACLs on the server<br />

Manufacturing/FactoryCo. The name must be entered in full hierarchical<br />

format in order for the user to obtain the correct level of access to ACLs on<br />

servers in other domains.<br />

► If no match is made on the user name, the ACL then checks to see if there is<br />

a group name entry that can be matched. If an individual trying to access the<br />

database happens to match more than one group entry – for example, if the<br />

person is a member of Sales and there are two group entries for Sales, such

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!