Hi everybody,the administrator of the web site does not want to give editor access to anonymous to any database.
However, users are allowed to modify their profiling document.
How can i handle this situation?
thanx a lot
Subject: Author access Vs Editor on web
2 ways.
A) Use Author fields on the forms the users are allowed to modify. This is the best and most secure option.
B) Use the “Public Access User” settings in the form and ACL to allow users to create and read documents. You’ll need to add a field called $PublicAccess to make forms available to public access users.
Subject: RE: Author access Vs Editor on web
Users will be creating their profile documents.and they will need to be able to edit them.
A user must be able to edit only his document.
I still do not understand your answer.
Subject: RE: Author access Vs Editor on web
If users are anonymous and can edit their own profile document, they can edit EVERYONE’s profile document.
Subject: RE: Author access Vs Editor on web
This is what i did.but this is not what the DBs administrator wants.
no editor access to anonymous to any DB.
Subject: RE: Author access Vs Editor on web
Right – that’s the way it should be. That leaves “*” in an Authors field, which is EXACTLY the same complete lack of security that you would have with anonymous Editors. I don’t know whether you’ve noticed it or not, but there are a lot of people trying to talk you out of the idea, and for a reason.
Subject: Author access Vs Editor on web
You could give Anonymous users Author access, if the profile documents had an “Authors” fields with the user’s name.
Subject: RE: Author access Vs Editor on web
but what value will have the “authors” fields?in a notes DB, i know how to fix it, but on the web, all users are “anonymous”
Subject: RE: Author access Vs Editor on web
You replied before i posted my other answer … you said you wanted users to be able to edit their own documents … how are you going to do that if you don’t know who the user is? Having anonymous users is NOT an option if you want them to access and edit their own documents.
Subject: RE: Author access Vs Editor on web
I’m a bit confused on your statement that “all users are ‘anonymous’” - are you not able to require your web users to authenticate? Many of my databases require valid sign on for editor functions to be available. Perhaps this is an admin function in my installation that I have always taken for granted as a developer?
Subject: RE: Author access Vs Editor on web
it was not in my plan to do the authentifaication, but i guess this is the only solution.so can u tell me more about this issue please.
thanx a lot
Subject: RE: Author access Vs Editor on web
It’s optional. Both the server and individual databases may be set to prohibit anonymous access. Public-facing websites tend to allow anonymous access, and often allow anonymous users to have Author access (like most Domino-based 'blogs, for instance) for feedback, to “carry” a shopping cart, or to submit an order.
Subject: RE: Author access Vs Editor on web
Stan, is it possible for the server admin to allow anonymous access but prohibit Domino authentication? It seems like that’s what the original poster needs to employ in his database, but I may be missing something. Seems weird not to allow a web client to login to a Notes server.
Subject: RE: Author access Vs Editor on web
It’s not a matter of “not allowing”, but “not requiring”. Domino isn’t all about internal users; there is a huge number of public-facing websites built on the platform, many of which have very good reasons for allowing document creation by anonymous users.
What the original poster may be trying to avoid is licensing costs. As long as the user never has to supply a password for authentication, he/she can maintain persistent data in a database. (If there’s a password involved, the user is considered to be authenticated regardless of the actual method used, and requires a Domino access license.)
It would be possible to use a cookie to maintain a user name and profile in the database, but what is being proposed here is highly insecure and subject to malicious attack. Even if all the attack amounts to is screwing up other users’ preferences (stylesheets, default navigation options, that sort of thing), it would still result in a lot of user dissatisfaction and the eventual death of the site. It would be much better to cookie the preferences themselves, which would remove the possibility of one user playing with another user’s information.
Subject: RE: Author access Vs Editor on web
I do not think it is a matter of licence cost. but i will talk to them about this issue:)They may change their minds:)
however,if they want us to implement the authentification, can u tell me how to do this.
thanx a lot
Subject: RE: Author access Vs Editor on web
If they want to do authentication and the users are self-registering, then they’ll want to use a combination of a Domino Utility Server (the Express version if the organisation is under 1000 people – that saves a LOT of money) and one of the registration applications in the Sandbox:
Utility Server will allow unlimited authenticated access via the browser (applications only), so there is no cost for additional users beyong the server license.
On the other hand, you can cookie quite a bit of information (up to 4KB) and give the users a form to manipulate their own cookies (not everything needs to be saved to the database).
Subject: RE: Author access Vs Editor on web
Wow - I had no idea about the licensing issue. That’s amazing - I am too junior to be allowed to work on anything public-facing, so all my experience is with internal client applications. In my little universe, the answer was easy: make them authenticate! But I understand more now. Thank you so much for taking the time to explain it to me.
Subject: RE: Author access Vs Editor on web
Believe it or not, that’s what we do around here – we take the time to explain things to one another. Most of the time, at least.
Subject: Of course it is, but the whole point of the responses to this post are that you can’t store/retrieve user-specific profile data if you don’t know who the user is!