Access Control List Problem

HCL Domino Domino Forum
1

Hi,

I have the following situation-- I created a group in the Public Address Book and had it designated as Access Control List only. In my application, I had a role called “[Decline]” which I assigned to this group. The reason for this is after a document has been marked as “approved”, I don’t want this group to be able edit the form. However this is not the case. They are still able to edit the form after it has been marked as “approved”. When I add these people in the access control list as individuals (not part of the group) and assign them the same role “[decline]” the code works and they are not able to edit after approval.

Because I work for a big company with a lot of people I was trying to avoid having to individually add their names to the access control list…that is why the “group” was created.

Am i doing something wrong? Any assistance would be greatly appreciated!

Thanks,

M.

2

Subject: Access Control List Problem

In the ACL individuals explicitly entered are granted that access, if they are in multiple groups, then the highest level of access wins. Document level access will have to be adjusted by using a Authors field, with access via the roles set there.

3

Subject: Access Control List Problem

are they member of another group in your acl ?if people are member of 2 groups, the users have the highest level of acl (and also the of roles of that group) …

if users are stored individual in the acl, at that moment they receive their own acl.

4

Subject: RE: Access Control List Problem

no the users only belong to one group in the acl. The users belong to the “Developers” group and I have assigned them a “[Decline]” role.

5

Subject: Access Control List Problem

I presume, you have written some lotusscript code to check the role and to deny the edit mode. Correct?If you do, do you use the getentry method of the NotesACL class?

This method does not resolve groups, if you ask it for an user.

Andreas Hoster

mailto:andreas.hoster@herma.de

6

Subject: RE: Access Control List Problem

Yes, there is some code in the querymodechange event and it does use the getentry method. Which method can I use to resolve groups?Sub Querymodechange(Source As Notesuidocument, Continue As Variant)

Dim session As New notesSession

Dim db As notesDatabase

Dim doc As notesDocument

Dim acl As notesACL

Dim entry As notesACLEntry

Dim allowAccess As String



Set db = session.currentDatabase

Set doc = source.document

Set acl = db.ACL

Set entry = acl.GetEntry(session.UserName)

allowAccess = "No"

dpAccess = "YES"



Forall r In entry.Roles

	If r = "[PSCH1]" Then

		allowAccess = "Yes"

		dpAccess = "No"

		Exit Forall

	End If

End Forall





If (dpAccess = "No") And (doc.status(0) = "DP PENDING") Then

	Msgbox "Form has NOT been submitted to Production Scheduling and cannot be accessed! DP IS STILL WORKING ON IT! ", 0+16+0, "Denied"

	continue = False

End If



If (allowAccess = "No") And (doc.status(0) = "APPROVED") Then

	Msgbox "Form has been APPROVED by Production Scheduling and cannot be accessed!", 0+16+0, "Denied"

	continue = False

End If

End Sub

Thanks,

M.

7

Subject: RE: Access Control List Problem

Jeez, I’d think that Author access an Authors field that doesn’t contain the current user’s role or name would be easier and more effective. But that’s just me, eh?

8

Subject: RE: Access Control List Problem

Sounds like it would work …however I’m still a rookie so I’m reading up on Authors fields…do you have an example that you can proivde to me? it would be much appreciated!

9

Subject: RE: Access Control List Problem

If you want to use LS code in future, try the QueryAccessRoles in the NotesDatabase Object.But using author fields is much better.

Andreas Hoster

mailto:andreas.hoster@herma.de