Is it possible in Domino 6.5 to create an account whose responsibility is to manage user accounts only? In other words, this “Accounts Operator” will be responsible for creating new users, deleting or renaming existing ones, locking out users, etc. I was thinking of changing the ACL of the Domino Directory and the Certification Log to include that person with the appropriate permissions and roles. However, I am not sure what are the exact permissions/roles I need to assign to that person, in order to avoid giving him too much or too little.
Have you looked at what is involved with creating new users or removing existing users?
You have 2 databases included, but you need to include the administrative request as well (to see if the changes are going through). You know you can always start by testing. Create an account, give it some access and see if you can do the functions you want to “Accounts Operator” to have.
I can start to suggest a few things: Editor access to the domino director. You may want to only give him [UserCreator] and [UserModifier]. I can not suggest much more because I don’t know if you want this account to assign people to groups, etc.
Thank you Joe for your reply. My problem is that I need to give that Account Operator the right to delete documents in the directory if I want him to be able to delete user accounts. Well, if I do that, he will also be able to delete other entries in the directories (server documents, connection documents, etc.). Is there an alternative or workaround?
You would have to make a “Middle Layer”. Make like a soft delete. Otherwise, you are going to have to back up the data and rely.
The big issue here is “trust”. You have to trust someone to do the functinos of the job.
This company I work at had tried it and it did not work to their liking.
An alternative may be to create an automated scripts functions which the new account would have done. I think there is something in the sandbox for id creation.
I actually figured out the solution, which is only available in ND6 and later versions. The secret is to use the Extended ACL. You give the user Author access to the directory ACL, and enable the delete documents permissions, along with the [UserCreator], [UserModifier], [GroupCreator], and [GroupModifier] roles. Then, you will need to enable the Extended ACL, and assign the appropriate rights on the various forms and fields to this person (or group).