I have enabled the xACL on my domino directory to restrict the members of our “notes developers” group from editing our “administrators” group. But I still want them to have edit rights for all other group documents so they need the “GroupModifier” role, and I have them set as “Designer” user type in the ACL.
When i setup the extended access for the “Administrators” subject and ALLOW READ but DENY WRITE, from the “Forms & Field access at: Administrators” dialog box for the “Group” form and all the fields within it, the “Notes Developer” group members are still able to change the members of the “Administrators” group.
Is there some sort of over night admin process that needs to run?
Subject: Extended ACL problem - create your own USERROLE
Create your Own ACL UserRole [DevelopersGroupModifier] – assign the “notes developers” ACL entry with this UserRole. Create a simple agent to set this userrole in the ‘LocalAdmin’ field (append to it).
Drop the “notes developers” group to Author with No Roles and No Rights. In this manner they will be able to only EDIT groups which you deem worthy - no create/delete/rename. You would have to remember to add this UserRole to new groups.
Another option is to create a simple database which would allow an approved person to access the group document – modify the contents and then submit the document. Have an agent which has the server side rights to run onhalf of and has rights to the server’s Address Book – reset the members of the groups in the submitted form. The signer of the agent would only have rights to modify the group form.
You could create a profile document of specific groups which the agent should not be able to modify or on the ‘group change form’ prevent the user from selecting specific groups.
Subject: RE: Extended ACL problem - create your own USERROLE
Hello!,I have almost the same requirement. However, it doesn’t work for me. I am a bit confused with the bit about appending the userrole to the local admin field. Is this simpy adding [xyz] into the administrators field of the group you want them to not have access to? Or by somehow appending it to the LocalAdmin field specified in the group doc in xACL?
Whatever I seem to try my eqivalent to “notes developers” gets the “you are not authorised” message when they try to edit the “administrators” group. What am I missing?