Front cover - IBM Redbooks

New for
Domino 6
To determine the effective access that a person, group, or server has to a
database, highlight the appropriate entry in the database ACL and click “Effective
Access. This opens a dialog box that shows:
► The selected name's effective database access level as determined by the
database ACL.
► The access rights for the selected name.
► All the individual and group name entries and roles that could potentially
control the selected name's access to the documents in the database.
► “Full Access Administrator” is checked if the person, server, or group has full
administrator rights to the database.
From this point, you can determine other users’ access by selecting a new name
in the Names box and clicking “Calculate Access.”
Important: A user may still have access to a database by running an agent
with the “Unrestricted with Full Access” privilege, even if his or her name is not
listed in the database's ACL. This privilege exists, but is not reflected in
Effective Access because this privilege bypasses the ACL and reader lists. For
example, an administrator may want to run this type of agent on a database he
or she does not have access to in order to update a full-text index on that
database.
“Enforce consistent ACL” and local replication
Prior to Domino 6, users who locally replicated databases that did not have
“enforce consistent ACL” enabled were given full access to the database, with no
roles assigned. As a result, the user might change things which ultimately would
not replicate. In R6, when a user replicates a database locally, Domino
propagates the user's access as it is known on the server, and enforces it when
available. This happens automatically for local replication, regardless of whether
“Enforce a consistent Access Control List” is enabled. The behavior relies on the
nameslist which is propagated during replication. It will not take effect until after
the first time the user replicates and the database acquires the user’s access
from the server.
It should be noted that local replicas with “Enforce a consistent access control
list” enabled attempt to honor the information in the ACL and determine who can
do what accordingly. However, they have some limitations. One limitation is that
group information is generated on the server, not at the local replica. When a
database is replicated locally, information about the group membership of the
person doing the replication is stored in the database for use in ACL checking. If
a person/identity other than the one doing the replication accesses the local
replica, there will be no group membership information available for that person,
Chapter 11. Domino/Notes 6 security features 509