ID vault: Extract ID using user's password - Feedback requested

HCL Domino Domino Forum
1

Using the Notes Admin client, a user ID file can be extracted from the ID vault in two ways: (1) A user ID file can be extracted overtly with the user’s knowledge by using the user’s password or by resetting the user’s password to a new known value. (2) ID files can also be extracted secretly without the user’s knowledge by a vault administrator with the Auditor role.

A number of people have suggested removing the the first “Extract using user’s password” feature.

Do you use the “Extract using user’s password” feature? Would any of you NOT like that feature removed?

2

Subject: Extract ID’s

We were just discussing this as we are currently testing the ID Vaults. We would like a way to prevent a Reset Authority from extracting an ID file. We understand the need to be able to extract one, expecially for audit purposes. However, we do not want a “rogue” Reset Authority to reset the CEO’s password and then have the ability to extract it and impersonate him.