Recently, our company is evaluating a 3rd party mail archiving solution. This solution stores mails together with a snapshot of the ACL. (non-Notes) This is a clever solution, because you have Notes security on these archived documents ( client and web ). I do not want to dig too deep into this product, but we found out during evaluation that the â??ACL snapshotâ? feature will get you into trouble when you delegate your mail file.
Imagine a scenario, where User A delegates his mail file to user B. User B has author access (this necessarily includes reader access. ï? ) When the mail archive process starts, it will save the ACL together with the document. If user B retrieves a document from the archive, thereâ??ll be no problem at all.
Now user B quits the company and he /she is replaced by user C. User A modifies the delegation profile according to the new situation.
But what happens, when user C wants to access documents that have been archived, before he / she had access to the mail file?
To make a long story short, this will not work â?¦
To solve the issue, we decided to put a group into each mail file ACL which has the following format: #ARC-FirstNameLastName-READER.
As the name implies, the access level for this group is READER.
When we now send a mail document to the archive, this group is archived as well. (ACL)
Now we can put user C into this group and immediately this user has access to all archived mails of user A.
Keep in mind that regardless of which access level is given to a user by delegation, he needs at least reader access to access documents from within the archive.
Manually adding members to a group or deleting them is not a good idea, because YOU would have to do the work ï?.
One of the proposals from the vendor of the mail archiving system was to modify the delegation process in Lotus Notes. Not a good idea at all, because you would have to write a completely new CalendarProfile to achive the goal.
The smallest solution is to have the above mentioned group in the ACL (and names.nsf ) and add code to the CalendarProfile to add / remove members to / from the group. This would keep the code provided by IBM intact. In addition to that you can update to a higher version of Notes and Domino and easily add your modifications to the new template.
The basic algorithm is to add all mail delegates to the group and remove a name from this group when the mail file owner revokes access to his database.
HINT: This article is not ment to be a solution which can be copied and pasted. You will not find any source code here. I will only post a few code snippets.
AdminP is a server task for automating administrative tasks in the background on a schedule. The Domino administration process (AdminP) is a server-side mechanism for automating administrative tasks in the background on a specified schedule. Domino’s AdminP supports everything from user renames to file replications.
Starting with version 6 of Lotus Notes and Domino, you can use the NotesAdministrationProcess class to create AdminP request programmatically with Lotus Script.
One of the methods of the NotesAdministrationProcess class is â??AddGroupMembersâ?.
This method adds members (passed as a parameter in the method call) to an existing group or creates the group first when it does not exist and adds the members to the newly created group.
This is a great feature if you want to enable some users in your organization to maintain groups in the names.nsf without giving them any author or editor rights. Exactly what we need.
But, when doing so, how can they delete users from existing groups using AdminP ? You do not find any method like â??RemoveGroupMembersâ? in the NotesAdministrationProcess class.
Since IBM does not provide us with such a function, I had to create it on my own.
Bob Balfe of IBM published an article back in 2003 on developerworks ( LINK )
This is a great starting point to write your own AdminP request handlers using the Notes C API.
As described in the article, I created a new form in the admin4.nsf to contain all the fields needed for the new Administration Request.
I saved the compiled nadminplus.exe to the Domino executable directory and started it typing load nadminplus at the server console.
You can now create new RemoveGroupMembers request directly in the admin4.nsf or use the following code to create the requests programmatically with Lotus Script.
'/* Put the following code into the declaration section of an action */
'/* or create a new script library to contain the code */
Const DB_ADMIN4 = "admin4.nsf"
Const FLD_FORM = "CustomRequest"
Const FLD_PROXYACTION = "5005" ' RemoveGroupMembers | 5001
Class NotesAdministrationProcessPlus
Private szServer As String
Public Sub new (szServerName As String)
Dim s As New NotesSession
Dim nn As NotesName
Set nn = s.CreateName (szServerName)
szServer = nn.Canonical
End Sub
Public Function RemoveGroupMembers (ListName As String, Members As Variant) As String
RemoveGroupMembers = ""
If (Ubound (members) = 1 And members(0) ="") Or Trim(ListName) = "" Then
Exit Function
Else
Dim s As New NotesSession
Dim db As New NotesDatabase( szServer, DB_ADMIN4 )
Dim doc As NotesDocument
If db.IsOpen Then
Set doc = db.CreateDocument
doc.Form = FLD_FORM
doc.ProxyAction = FLD_PROXYACTION
doc.ProxyServer = szServer
doc.ListName = ListName
doc.Members = Members
Call doc.ComputeWithForm(False, False)
Call doc.Sign
Call doc.Save(False, True)
RemoveGroupMembers = doc.NoteID
Else
End If
End If
End Function
End Class
To create the request documents, use the following code:
Sub Click(Source As Button)
Dim noteid As Variant
Dim members(1) As String
members(0) = "Hein Bloed/Maus/de"
' ...
Dim AdminPP As New NotesAdministrationProcessPlus ("yourserver")
noteid = AdminPP.RemoveGroupMembers ("yourgroup", members)
' ...
End Sub
See the code in action: http://screencast.com/t/htEtry53BSk
If you find this function useful and like to try it by yourself, send me an email or leave a comment. I have also posted an idea on ideajam.net. Perhaps you can promote the idea if you like it.
