Hi,We have a user saying they are not authorised to ‘authorise’ a request in a very old database.
They are listed in two groups, the groups have different roles, for sake of argument, lets say ‘authoriser’ role is on one group and not on the other?
Which group will be honoured, each group has Person Group Editor Access, one group (the authorisor) has ‘delete documents’ additionally checked?
Any ideas? I saw one similar post, saying it may have changed for R6, but no-one had replied to it…
Subject: User listed in two groups with different roles; which is honoured by Notes?
the users’s access is a union of all entries (including roles). highest access level takes precedence. explicit username entries in the acl take precedence over group membership.
Subject: RE: User listed in two groups with different roles; which is honoured by Notes?
For me on Notes 6.5.3, the lowest entry seems to take precedence. The user listed in the two groups, has the access of the lower group (is unable to authorise the request)…
Subject: RE: User listed in two groups with different roles; which is honoured by Notes?
you can check it by selecting (but not opening) the database and clicking on the small area in the status bar on the bottom to the left of the instant messaging status.
Subject: User listed in two groups with different roles; which is honoured by Notes?
Generic,
The rules for this have changed a bit over the years/releases, but generally you get the best of all the roles/groups that you’re in. You can challenge the system by making radically different acl entries, such as
Group1: Editor w/out delete
Group2: Author w/ delete
and in a case like this, I suspect that you’ll get the Editor Access, even if that means w/out delete.
But in terms of roles, I think you’ll get them all. I’m sorry not to be more definitive, but I’ve seen changes to this behavior even within a major release, so you’ll really have to test it yourself. Be careful to shut down Notes between tests because it’s all too easy to cache something and then confuse yourself as to the test results.
regards,
raphael
Subject: It sure sounds like the users are being defined explicitly in the ACL
The ACL is really pretty straight forward and I have never had problems with a user being defined in two diferent Groups. The Highest ranking access wins. However, where this usually gets confused is when a person is listed in the ACL explicitely then none of the groups are checked and have none of the roles assigned by the groups. I have been working with ACLs since R3 and it has always worked this way. So I do not beieve that the version of Notes has anything to do with it.
Subject: User listed in two groups with different roles; which is honoured by Notes?
I agree that the higher authority and the merged roles will be used. For example, all of my dbs have an Administrators group in the ACL with Manager access and all roles. Some databases also have an IS Department group in the ACL with Editor (or less) and some roles. I am in both groups, and I always get the higher authority with all roles.
Are the databases local? Or on a server? Local dbs don’t recognize Roles unless Enforce Consistent ACL is used. If that is enabled, Notes takes a “snapshot” of the current user’s authority and group membership when the local replica is created. That snapshot does not get updated when the server ACL is changed - you must delete and recreate the local replica for it to see the new authority settings.