In our environment we require sign-on and authentication to hit the Intranet web server.
My custom web search query form allows public access, as does the search view, and the $$search template results.
When I set default access to reader - write public documents, they get a login screen when attempting to execute search. Not in place of the search form, that appears, but once they type in the criteria and hit the search button, the result is a login prompt.
In order to allow the query to run properly I must elevate the rights to author, create documents, which is NOT ok long term. I need to determine if this is a problem specific to our environment or if this is functioning as intended according to the product.
Everything I know about Notes security tells me that reader with write public documents, and public access allowed on all accounts (even though since they have already authenticated, this shouldn’t even be required…) should permit this query to execute without additional credentials being required. But it does not! It just works when the rights are upgraded to author.
All save options are set to zero and i have tested all thoroughly and hunted for docs created etc. to make sure the system doesnt think that its creating a document during this process. We are all clear there.
To make this query work I must use this ACL.
User/Group Name: Anonymous
Access Level: Reader
Role(s): [None Assigned]
CAN WRITE PUBLIC DOCS
*But anonymous doesnt really matter that much because we require auth to even see the server so theoretically nobody would ever even come over as anonymous on the web side…
The ACL on this DB is as follows:
User/Group Name: -Default-
Access Level: Author *************
Can Create Documents: Yes*********
Can Delete Documents: No
Role(s): [None Assigned]
*Which also doesnt matter that much since, they’ve already authenticated to the server and have an open session, and all our employees are in this group:
User/Group Name: #A. A. A. A. Notes Users-Restricted
Access Level: Author*******
Can Create Documents: Yes**********
Can Delete Documents: No
Role(s): [None Assigned]
User/Group Name: #DepartmentContacts
Access Level: Editor
Can Delete Documents: Yes
Role(s): [ListAdmins]
User/Group Name: Notes Server Admins
Access Level: Manager
Can Delete Documents: Yes
Role(s): [None Assigned]
User/Group Name: Notes Developers
Access Level: Designer
Can Delete Documents: Yes
Role(s): [None Assigned]
OK so the ******** Items are in question.
How can I make this search ability work without allowing author AND create documents… to everyone. We want everyone to search but not to have that level of rights because this is a hybrid app, that replicates and there are other issues with it. (I inherited it ok!).
Here is my $$Return Query Code which shoul display results on screen not requiring the rights to create documents right?
DBName := @Subset(@DbName; -1);
Q1 := “[/”+DBName+“/SearchData/?SearchView&Query=” +“field+fname+contains+”+query_first + “&SearchOrder=4&SearchFuzzy=True&SearchWV=True” + “]”;
Q2 := “[/”+DBName+“/SearchData/?SearchView&Query=” +“field+name+contains+”+query_last+“&SearchOrder=4&SearchFuzzy=True&SearchWV=True” + “]”;
Q3 := “[/”+DBName+“/SearchData/?SearchView&Query=” +“field+Department+contains+”+query_dept+“&SearchOrder=4&SearchFuzzy=True&SearchWV=True” + “]”;
@If(query_first !=“”;Q1;
@If(query_last !=“”;Q2;Q3))
*This database has always been a bit funked with security.
Since theoretically nobody can hit anything on the server without first authenticating, does there even need to be an anonymous entry?
There are no reader fields etc. on the documents being searched.
Prior to my time here the allow public access to the main form was not checked, I have since checked it. Again I dont even think that should even matter due to authentication already having been handled… but if it does matter more than I realize, would that mean I would need to ensure that a hidden public access field and set value on all documents?
Again this is an INTRANET inside, before they can reach any DB on this server they must be authenticated in notes or the web… it is not a “public” site…
This is just defying natural security protocols and I have looked at code and queries form other apps I have written in other environments and the ACL’s… but those were all public sites and default was author - create.
Any insight would be welcomed.