How to set all Roles for a server entry?

HCL Domino Domino Forum
1

Hi,

I have set an Administration server for all databases on the server. Now I want to set (activate) all roles for this server in all databases, because otherwise the server might not be able to “see” all documents when it has to update Reader and Author fields.

I want to write an agent that opens every DB-ACL, finds out what roles are defined, and activates all the roles for a certain ACL entry.

How can I find out what roles exist in a database? All the examples I have seen so far assume that I already know the role name, and start from there. So this does not help me.

Thanks a lot for any ideas!

Oliver

2

Subject: How to set all Roles for a server entry?

You get the role names by using Lotusscript and this property:

notesACL.Roles

This return an array of all roles-names. Short example taken from help database:

Dim session As New NotesSession

Dim db As NotesDatabase

Dim acl As NotesACL

Set db = session.CurrentDatabase

Set acl = db.ACL

Forall r In acl.Roles

Messagebox( r )

End Forall

If you need further help, let me know.

Regards,

Rune Carlsen

http://www.dominozone.net

3

Subject: How to set all Roles for a server entry?

Hi Oliver,

Firstly are you sure the server needs the roles in order to update the documents? I’m not saying to doesn’t but it’s best to test these things before assuming one way or another (some times low level server processes ignore access controls - otherwise, for example, how could the server index a view containing documents to which it doesn’t have access).

If the server does need all roles setting to get the list of roles for each database the NotesACL class has a .Roles property which returns an array of roles available within the ACL.

HTH,

Phil

4

Subject: How to set all Roles for a server entry?

Looping through all the roles in the ACL and granting them to the server may be a kludgey way to patch the problem (although, depending on the design, it might not work anyway), but it doesn’t get at the issue here, which is that some of your dbs are incorrectly designed. (Not just poorly, but flat-out slap-on-the-wrist-and-send-you-to-your-room-with-no-dinner wrong.) And the bad design should be fixed.

AUTHORS: The server shouldn’t need to be in Authors fields at all, since those have no effect on Editor and above, and one assumes the server is at least an Editor.

READERS: In a correctly-designed db, all servers should already be referred to in some Readers field in any document which uses them. This ensures that not only can the server update Authors fields during a name change, but that the server can see the document so that it will actually replicate. How to fix? Depends on the individual form and how it uses Readers fields. Is it using $Readers? One or more Readers fields in the form? Computed or Editable? Roles or not? If Roles, which Role?

Yes, you wanted to avoid the need to go into the design of each db and look at Role names, but the right way to fix this is to do just that.

For example, a form with an Editable Readers field can have a computed Readers field added to it: @if(EditableReadersField = “”; “”; “LocalDomainServers”). (And I’m taking it as a given that you understand that once you fix the form, this will in no way affect any existing docs, only new ones, and you’ll need to run an agent to update existing docs to contain the correct data.)

If one assumes that granting the server every role in every db will indeed work, then something like

set db = …

set acl = db.acl

set serverentry = acl.getentry(…)

forall r in acl.roles

serverentry.enablerole(r)

end forall

acl.save

will certainly do that – if you can work out whether you want to work with an existing individual server entry or the localdomainservers group entry or create a new individual server entry.

But I wouldn’t do it that way.

5

Subject: Thanks to everyone who posted comments/ideas!

Thanks to everyone who posted comments/ideas!

Oliver