I’ve send a collegue who has no access to a broadband network a CD with a big database. The idea was, that he would copy it into his notes/data folder, open it and would need to replicate only the recent changes via a telephone line.
We did this before with success, but used Notes Version 4.6 at that time.
Now we have Notes 6.5.1. And the collegue get the error message “You are not authorized to access that database” when he tries to open it.
The database (and its copy) is not locally encrypted.
Any glue?
Thanks in advance, Kurt.
Subject: The ACL settings are verified, of course!
Before someone asks: Of course I checked the ACL and the collegues membership in the person group.
Subject: RE: The ACL settings are verified, of course!
When checking the ACL, did you ensure that the Enforce Consistant ACL isn’t checked as if it is and your collegue is using the database locally, they will need to be specifically named in the ACL as the fact that they are a member of a valid group doesn’t matter when acting upon a Consistently Enforced ACL.
Subject: Enforce Consistant ACL is checked
Enforce Consistant ACL is checked. I asked the collegue to create a group in his personal addressbook to trick this, but I do not have much hope. Indeed, after reading the responses here and the notes help regarding Consistant ACL, I think I will resend a copy of the db with the user listed in the ACL and not only as a member of the group.Thank you Bruce, Geoff, and Doug.
At least something learned again.
Kurt.
Subject: RE: Enforce Consistant ACL is checked
The Personal Address Book on the users local machine is un protected (by default databases without Enforce Consistant ACL afford the local user Manager access to the database) and therefore to allow a user to create a valid group for an application on the local address book would violate security protection, as a person wanting to access the data illegally could just create an apropriate group locally and have full access.
The only viable solutions to this is to explicitally name the user i.e. Fred X. Bloggs on the ACL or remove the Enforce Consistant ACL for the database, which opens up the database and data to provide the user Manager access.
Subject: RE: The ACL settings are verified, of course!
Then that sounds like the problem to me. It sounds like the default access is No Access and the user is supposed to get access by being in a group, but they’re disconnected and therefore don’t get their group membership from the server NAB.
In R5 this would only happen if the ACL had its Enforce a Consistent ACL setting enabled, and could be solved by simply adding the necessary group (containing the user) into the personal address book (which is why the Consistent ACL setting should not be considered security), but in R6 local security appears to be based not on groups in the personal nab, but instead on a group list that’s built by the client when the local replica is created and stored in that replica – so I’d guess that in the case of a db copied off CD, there’d be no such list.
You can try the local group in the personal address book trick and see if it works, but frankly, the way local db security works in R6 is one of the things I have been unable to nail down, and would love it if someone would.
Subject: Not authorized to access the database after copying
If you have copied the database from CD, have you check that the read-only attribute has been removed from the file copied to the local hard-drive.
–
J
Subject: Check that the database is not read only
You should get your colleague to go to the data base in windows explorer, right click on the file and open properties, if read only is checked, uncheck it. Datbases copied on to CD become read only in my experience and stay readonly when copied on to another machineNotes needs to be able to write to a database and that may be causing the problem.
Subject: good point, but…
Good point!I tested this with another db. But the error message is “Cannot write or create file (file or disk is read-only).” But it might be different with a database that the user did not open before. I advised my collegue by mail to check, but I don not expect response before Monday.
Thank,
Kurt.
Subject: RE: good point, but…
I think you have two options.1) The user’s name must be explicitly in the ACL, “Joe User/Lotus”. Create a new replica.
-or-
- You must enable the setting “Enforce a consistent Access Control List across all replicas”, and create the replica with the user’s notes id.
I think the problem you have is that the -Default- access is “no access”, and the user’s access is defined in the ACL by some group. These group name are not valid on local replicas, expect in “2” above.