Delete Group Members Using The Administration Process

Recently, our company is evaluating a 3rd party mail archiving solution. This solution stores mails together with a snapshot of the ACL. (non-Notes) This is a clever solution, because you have Notes security on these archived documents ( client and web ). I do not want to dig too deep into this product, but we found out during evaluation that the â??ACL snapshotâ? feature will get you into trouble when you delegate your mail file.

Imagine a scenario, where User A delegates his mail file to user B. User B has author access (this necessarily includes reader access. ï? ) When the mail archive process starts, it will save the ACL together with the document. If user B retrieves a document from the archive, thereâ??ll be no problem at all.

Now user B quits the company and he /she is replaced by user C. User A modifies the delegation profile according to the new situation.

But what happens, when user C wants to access documents that have been archived, before he / she had access to the mail file?

To make a long story short, this will not work â?¦

To solve the issue, we decided to put a group into each mail file ACL which has the following format: #ARC-FirstNameLastName-READER.
As the name implies, the access level for this group is READER.

When we now send a mail document to the archive, this group is archived as well. (ACL)

Now we can put user C into this group and immediately this user has access to all archived mails of user A.
Keep in mind that regardless of which access level is given to a user by delegation, he needs at least reader access to access documents from within the archive.
Manually adding members to a group or deleting them is not a good idea, because YOU would have to do the work �.

One of the proposals from the vendor of the mail archiving system was to modify the delegation process in Lotus Notes. Not a good idea at all, because you would have to write a completely new CalendarProfile to achive the goal.

The smallest solution is to have the above mentioned group in the ACL (and names.nsf ) and add code to the CalendarProfile to add / remove members to / from the group. This would keep the code provided by IBM intact. In addition to that you can update to a higher version of Notes and Domino and easily add your modifications to the new template.

The basic algorithm is to add all mail delegates to the group and remove a name from this group when the mail file owner revokes access to his database.

HINT: This article is not ment to be a solution which can be copied and pasted. You will not find any source code here. I will only post a few code snippets.

AdminP is a server task for automating administrative tasks in the background on a schedule. The Domino administration process (AdminP) is a server-side mechanism for automating administrative tasks in the background on a specified schedule. Domino’s AdminP supports everything from user renames to file replications.

Starting with version 6 of Lotus Notes and Domino, you can use the NotesAdministrationProcess class to create AdminP request programmatically with Lotus Script.

One of the methods of the NotesAdministrationProcess class is â??AddGroupMembersâ?.
This method adds members (passed as a parameter in the method call) to an existing group or creates the group first when it does not exist and adds the members to the newly created group.

This is a great feature if you want to enable some users in your organization to maintain groups in the names.nsf without giving them any author or editor rights. Exactly what we need.

But, when doing so, how can they delete users from existing groups using AdminP ? You do not find any method like â??RemoveGroupMembersâ? in the NotesAdministrationProcess class.
Since IBM does not provide us with such a function, I had to create it on my own.

Bob Balfe of IBM published an article back in 2003 on developerworks ( LINK )

This is a great starting point to write your own AdminP request handlers using the Notes C API.
As described in the article, I created a new form in the admin4.nsf to contain all the fields needed for the new Administration Request.

I saved the compiled nadminplus.exe to the Domino executable directory and started it typing load nadminplus at the server console.

You can now create new RemoveGroupMembers request directly in the admin4.nsf or use the following code to create the requests programmatically with Lotus Script.

'/* Put the following code into the declaration section of an action */
'/* or create a new script library to contain the code */
Const DB_ADMIN4 = "admin4.nsf"
Const FLD_FORM = "CustomRequest"
Const FLD_PROXYACTION = "5005" ' RemoveGroupMembers | 5001

Class NotesAdministrationProcessPlus

	Private szServer As String

	Public Sub new (szServerName As String)
		Dim s As New NotesSession
		Dim nn As NotesName
		Set nn = s.CreateName (szServerName)
		szServer = nn.Canonical
	End Sub

	Public Function  RemoveGroupMembers (ListName As String, Members As Variant) As String
		RemoveGroupMembers = ""
		If  (Ubound (members) = 1 And members(0) ="") Or Trim(ListName) = ""  Then
			Exit Function
		Else
			Dim s As New NotesSession
			Dim db As New NotesDatabase( szServer, DB_ADMIN4 )
			Dim doc As NotesDocument

			If db.IsOpen Then
				Set doc = db.CreateDocument
				doc.Form = FLD_FORM
				doc.ProxyAction = FLD_PROXYACTION
				doc.ProxyServer = szServer
				doc.ListName = ListName
				doc.Members = Members
				Call doc.ComputeWithForm(False, False)
				Call doc.Sign
				Call doc.Save(False, True)
				RemoveGroupMembers = doc.NoteID
			Else

			End If
		End If

	End Function
End Class

To create the request documents, use the following code:

Sub Click(Source As Button)
	Dim noteid As Variant
	Dim members(1) As String
	members(0) = "Hein Bloed/Maus/de"
	' ...

	Dim AdminPP As New NotesAdministrationProcessPlus ("yourserver")
	noteid = AdminPP.RemoveGroupMembers ("yourgroup", members)
	' ...

End Sub

See the code in action: http://screencast.com/t/htEtry53BSk

If you find this function useful and like to try it by yourself, send me an email or leave a comment. I have also posted an idea on ideajam.net. Perhaps you can promote the idea if you like it.