C API group/role/user listing

HCL Domino Domino Forum
1

Hello.

I’m developing an application that must interface with Domino 6 and 7.

Its purpose is to generate a list of all notes in a set of given databases, also showing for each note, all the users that have read permissions on it.

(This will afterward be fed to a totally unrelated to Notes system)

My test program currently:

1.- iterates over each database getting ACL information (NSFDbReadlACL, ACLEnumEntries, which gives users/roles and permissions associated to each).

2.- iterates over each document in each database (NSFSearch) getting its UNID (and create an URL to be able to reference the doc with the URL: [notes/http]:////0/)

3.- gets the $Readers field to calculate definitive permissions in addition to the ACL found in 1

4.- [unimplemented, but planned] gets the permission bits in each note and calculates definitive permissions in addition to the ACL.

As a total Notes/Domino newbie, I feel I’m not covering all cases with this approach, and I’d like some advice about how to complete this task. My doubts are:

a) Is the above approach enough to get all users with read access to all documents in all the given databases? Can I safely assume that when the -Default- user not mentioned in the above approach, no read access is to be given unless overridden by later users/groups/roles?

b) Won’t I be missing views with that NSFSearch approach in step 2? Or views are just Notes too?

c) I will miss some roles/groups/users, as they won’t all be listed in the given set of databases, is there a way to iterate over each role/group and its users (ie, go the other way around, from roles/groups towards users and databases and documents instead of from databases to documents to users)?

In short, when will this approach fail, and what workarounds do you see? (phew, it’s a lot, but any hint will be strongly appreciated, pointers to right documentation, better approaches, etc.)

Thanks a bunch,

V.

2

Subject: C API group/role/user listing

few things:1) of course, acl entry most probably is for a group not a single person, hence you need to resolve users belonging to any such group.

  1. you need to check not only for $Readers field. You may have any field containing “readers” or “authors” information; it is determined by the field type. For “read” access purposes “authors” fields act same as “readers”

  2. you may not be able to read all notes yourself. If there are “readers” fields on some notes and server is not referenced you may not be able to figure out who has access to it and who has not.

  3. I do not really understand your sentence about the “default” user. In any case the default rights get everybody who is not directly or indirectly refrenced in any other ACL entry.

  4. you may also have also “Anonymous” entry in ACL that may give reader’s access to anybody accessing the db say anonymously from Web.

  5. ACL entry can sometimes get combined with “public document” flag, so some documents may be read even if in general the ACL entry gives no read access rights.

3

Subject: RE: C API group/role/user listing

Thanks a lot for your response. It cleared lots of things up. Of course now I have further doubts :slight_smile:

Regarding point 1. I couldn’t find any C API function to get a listing of all users belonging to a group, does that function exist?

Regarding point 2. I’m now testing for the appropriate flags instead of the field name, and the results make much more sense, thanks. Does the field name have any meaning by itself? Or only the fields with those flags set actually make Domino enforce those privileges?

Regarding point 3. That’s probably a requirement for the app to run, it must be able to read all the notes. Is this an administrative pain?

New point. Are roles important for what I need? I see the ACL list roles, but no users/groups are associated to them.

I’ll work on checking the Anonymous and public document flags now. But all this gives me another higher level doubt…

Is there an easier way to get a listing like:

foreach database in :

print database.name

foreach note in database.notes:

print note.UNID

foreach user in note.users_with_read_access:

 print user.fullname

The problem here seems twofold

1.- how to get all users from a group (how are roles related to this here?)

and

2.- how to determine users_with_read_access per each note as there are many factors influencing that access.

I’m only doing it in the C API because it looked like a good choice, but if there’s an easier way I’m all for it. Only requirement is that it should generate a file with that information in regular intervals (cron job or the like).

Sorry if all these questions are too basic, but for me this forum has been the only resource to get useful information about Notes (For instance, in the 722 pages of the Lotus Security Handbook the word “role” appears one time, and in not the ACL role meaning). If I’m missing a basic document explaining this stuff, please share its location.

Thanks again,

V.

4

Subject: RE: C API group/role/user listing

  1. I do not think there is such a function. To resolve users you need to do a lookup in a view (say “$Groups” that contain all groups except mail-only)

  2. AFAIK, the field name has no meaning; some, such as $Readers may be “internal”, but still they need correct flags to be recognized.

  3. I imagined you are going to run your code as a servertask, hence it runs then from server name. If server has no access to documents it could cause other problems such as with replication, hence it usually makes sense to add server in a group or by name in reader fields. But it’s not always necessary. In any case – yes - it is an administrative thing which userid to run this code from; just there can always be applications that add reader’s fields without due respect to any rules :-/

Even worse – the documents may be encrypted; another issue of course, but limitation nevertheless. You may not be able to determine correctly access either because your id is not listed in reader’s field, or the doc is encrypted with a secret key or with public keys of other persons that your id.

  1. Roles. Right, once according ACL user has access to the db in general, roles can be used in reader fields to further limit the access. But roles are assigned to each ACL entry, so once you resolve some ACL group, each user has the role(s) defined for the group. And roles (IMO) add up if user appears in several ACL entries; so it’s does not add much to complexity.

  2. In general your task looks like this to me:

  1. get all users with read access according to ACL (includes resolution of groups – finding all users listed in group or in subgroups; there could be circular references – take care with recursion)

  2. go through all documents and check if their access is further limited using reader’s fields; again may include resolution of groups – and not necessary the groups in reader’s fields are the same as in ACL

I have no experience of running C applications on server – I’d think you always need enter the password so it’s not clear how you can run them in a batch mode; servertask would be a more regular way. You can schedule server tasks.

Or else – there is nothing you would not be able to do easier from Lotusscript than from C – you’ll only need the agent in some db. And with servertask you need to add your library on server, it’s not clear for me how’s one is better than other.