Do scheduled agents run based on the access level of the user who created them? Or last edited them? Or do they run regardless of access?I have a few DBs that are on running on schedule and they were created by a user who’s ID is going to be removed and who will no longer be able to access the server. Will these agents still run as they do now?
Sorry if this question has been asked before, I’ve read a lot and searched but haven’t found the answer to this.
Thank you for any input!
Subject: Does a scheduled agent run based on the access level of the user who created it?
Scheduled agents are run with the privileges of the person (ID) that most recently saved (or signed) it.Although, in R6 that may not even always be true.
read the Agent FAQ in Forum faqs section for further details.
Subject: RE: Does a scheduled agent run based on the access level of the user who created it?
And it is the same for manual agents, correct?
Subject: Nope! Manually triggered agents run with invoker privileges
Manually activated agents run with the privileges of the person (ID) invoking the agent.
Again there are exceptions to this rule, e.g. when agents are triggered via NotesAgent.runOnServer() in which case they run with signer privileges.
More info in the Agent FAQ
Subject: RE: Does a scheduled agent run based on the access level of the user who created it?
There are a number of option that determine the answer to your question. The best way to see how it works in any given situation is to look at the security table in Agent FAQ’s article called “Troubleshooting agents in R5 and R6”. The rules for client (manual) and server are different. The person who signed the agent is typically the effective user, but in R6 there are new special options where this may not be true. The table is the easiest way to see what situation applies to your agents. It also has a detailed explanation.
See agent FAQ under resources on the right hand side.
Subject: Does a scheduled agent run based on the access level of the user who created it?
at work my personal id is used to create and sign all the agents, at some stage i will eventually leave so i have set the “run on behalf of” (agent properties > security tab) to the generic postmaster id so that the agents will always run no matter who comes along and saves/signs them.
Subject: RE: Does a scheduled agent run based on the access level of the user who created it?
The “preferred” way of signing agents, is to create a “trusted” ID, such as “Template Development/YourOrg” for the sole purpose of signing databases.
This also prevents the annoying ECL (Execution Control List) alerts, forcing users to “Trust” each action as it is performed.
Subject: RE: Does a scheduled agent run based on the access level of the user who created it?
The people who “come along” have to have very high level of access. I would be very careful giving it out to everyone. Please read Agent FAQ article on what people who have rights to sign agents running on behalf of others can do.
It is a great powerful feature, but has to be used with care and only when it is appropriate.