I am seeing an intermittent issue with local replica access in 7.0.1 (client and server) that isn’t happening in my test 6.54 environment (client and server). I haven’t reported it yet as I can’t believe that I am the only one seeing this. Am I?
Some info: we are a fully “replicated” environment - almost no direct access to the server at all (all users are remote and off-site).
Database1 has 2 groups, call them #Editors and #Readers. User X is a member of both groups and creates a local replica. They now have editor access to the local replica. Later down the line, User X is removed from the #Editors group but after replicating continues to enjoy editor access to the local replica. In 6.54 they [correctly] drop down to Author. I am talking about users exiting and entering and replicating Notes again and again over several days so this isn’t a caching issue.
Interestingly, clearing the replication history does the trick - the user drops down to Author upon the next replication.
This is intermittent. Try it with one of your databases and see - 20-30% of the time this is happening to me. Any ideas?
Subject: RE: Possible MAJOR security issue, local replica & group changes
I don’t really see this as a security issue since it only affects their local replica; they can’t replicate these changes to the server. It’s really more of a usability issue since the user thinks they’re making changes that end up going nowhere. It does sound like something that should be fixed, and I’d appreciate it if you’d follow up with Lotus support.
(I could look for an SPR and create it if it didn’t exist, but it will have more weight in triage if it has a customer support incident attached).
Subject: RE: Possible MAJOR security issue, local replica & group changes
Hi Andre! (I am honored)
Security risk depends on the beholder, but I am willing to accept that perhaps I am guilty of hyperbole [somewhat]. Credit me for prefixing with “possible!” I was pretty frustrated after dealing with this issue for several days.
I probably should have added that this is affecting all group changes, not just editor down to author. Thus, it is affecting both downgrades to access, and upgrades to access.
The real security issue on my end is organizational risk - we are niftily pulling db access to local replicas at will using a combo of groups and roles, and the whole mechanism is shot to hades as a result of this! (Before anyone asks, I do know that role access or lack thereof is not true “security.”) Additionally, given a 100% replicating org, not being able to count on controlling access to who sees what is pretty disturbing.
I would be happy to follow-up with Lotus support. I am more amazed that I seem to be the first to be seeing this, given that Lotus is up to 7.0.2!!!
Subject: RE: Possible MAJOR security issue, local replica & group changes
Aparently i have the same problem as you are. But my case is with upgrading. We upgraded a persons security from readers access to editors access ( by assigning him to editors group in NAB ). When he access server copy he is able to get editor access. But when he opens his local replica he has still readers access. I am going to try removing the “Replication History” and see if that solves the problem.
Else will have to report it to Lotus Support. If you have an answer before, please do post it here.
Can deleting and Re-creating the replica solve the problem now ?
Subject: RE: Removing the Old “Replication History” solved the problem for me now.
Sorry Rajesh - I did not notice your post. You are correct - clearing the replication history does force the replica to rebuild its security info and fixes the problem.
I have reported this issue to IBM and they are working on an SPR for the issue.
In the interim, I am using script to programmatically clear a database’s replication history whenever the user opens the database, to ensure that they always have the right security.