URGENT ! After migration R6->R7, rights of "run as web user" agents are modified!

HCL Domino Domino Forum
1

Hi everybody,

we have just update our domino server from R6.5.5 to R7.0.3FP1

Then we realise that agents with “run as web user” and “3. Allow Restricted operations with full administration rights” or “2. Allow restricted operations” don’t work. It seems that the agent takes web user rights and not unrestricted rights.

Previously, on the R6.5.5 environnement, that works correctly.

This is a big problem because many agents are concerned.

We checks Security in the server document, but everything look fine…

Any Ideas ? pleaaaaaaase !

thanks,

Nico

2

Subject: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

how would you like someone in this forum to fix your problem? I think you need to call IBM support.

3

Subject: RE: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

Does anyone have this problem before ?

Is there somewhere a new security configuration for agents with the domino R7 ?

For me, an agent with “run as web user” property and “3. full administration rights” works like this :

  • the Session.effectiveUserName is the web user

  • the agent runs with the agent signer rights

  • the signer have to be in the server document in the field “Run restricted LotusScript/Java agents”

Is that incorrect ?

Thanks for advance,

Nico

4

Subject: RE: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

Check that the agent is using the Full name of the signer…

Have you updated the WEB SERVER to us the New HTTP documents?

If I was you - you need to think about rolling back the Upgrade to your fallback servers. Just incase this is something to do with the CODE of the agent. There were allot of changes within the code and I am guessing this wasn’t tested before hand?

5

Subject: RE: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

thanks for your answer.

Excuse me but you wrote

  • “Check that the agent is using the Full name of the signer…”, how do you do that ?

In designer I see that the signer is my admin user…

-“Have you updated the WEB SERVER to use the New HTTP documents?” Sorry, I don’t know what you mean by HTTP documents…

I did run the following test :

I run a agent with “run as web user” and “3.full administrition rights” to modify a document where the web user has no rigths (just reader). This agent is signed by the admin user

  • On R6.4 server, the document is modified

  • On R7.0.3 FP1 Server, I got the error : Notes error: You cannot update or delete the document(s) since you are not listed as an allowable Author for this document 4000

Any idea ?

thanks a lot

6

Subject: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

Put user person document into Full Administrator Field on Security TAB of server document.

7

Subject: RE: URGENT !! After migration R6->R7, rights of “run as web user” agents are modified !!

I set the * in this field…

other idea ?

thanks