A customer of mine has me writing code to extract data and put it into M$-Excel spreadsheets, then mailing it to recipients. I’m doing this with the org.apache.poi.hssf Java library in a scheduled Notes Agent. In order for us to support the goals of IT Security, we want to be able to ascertain whether the user receiving the information actually also has proper access to the database that the data is being extracted from.
This topic is already important since SOX compliance has forced the issue. It is becoming even more crucial with the event of IBM/Lotus supporting ODF with Notes. Please don’t underestimate the importance of security ramifications of creating and extracting data in ODF format and using it elsewhere!
Those of us who have been working with Notes for many years have almost taken Notes security for granted. This is becoming even more evident while I offer my humble services to create this fine reporting engine.
At this time, there is no way for a Notes Programmer to select a Name from the NAB in formula language, LotusScript or Java and, using parameters with a simple method or property to ascertain that person’s aclEntry or access level to databases, forms, views, fields, etc. It’s not difficult if the user is the one running the code. If we have a scheduled agent running code to extract data during the night then email it, there is no simple way that the agent can ascertain whether the recipient is actually authorized in the ACL to view that data.
I have written a few lines of code for clarity. Strange, my compiler didn’t like my method names!
Class ACLPeek
Private userRoles() As String
Private userAccessLevel As String
Private userACLEntry As NotesACLEntry
Public Function getUserRoles() As Variant
getUserRoles = userRoles
End Function
Sub new( myUser As NotesName )
Dim s As New NotesSession
Dim db As NotesDatabase
Dim acl As NotesACL
Set db = s.GetDatabase( "MyServer", "MyDatabase" )
Set acl = db.ACL
'This should work, regardless of whether the user is explicitly names in the ACL
Me.userACLEntry = acl.GetEntry( myUser.Canonical )
Me.userRoles = myUser.UserRoles( db )
Me.userAccessLevel = myUser.AccessLevel( Db)
If db.userHasRole( myUser.Canonical , "myRole" ) Then
' Export some data and send it to them in an email
End If
If db.minimumAccessLevel( myUser.Canonical , ACLLEVEL_READER ) Then
' Export some data and send it to them in an email
End If
End Sub
End Class
I’m hoping that IBM / Lotus sees that security need for this type of functionality inside of the programming languages used in the Notes / Domino product line.
Kind regards,
Marcus Laubli