Syntax of ChangeACL commands

Using Tasks or Profiles, it is possible to specify an ACL modification for one or more local databases. As the application of Profiles is a recurrent operation, repeated modifications on database ACLs are a way of ensuring the integrity of a database ACL (e.g. the permanent consistency of the ACL). Modifying ACLs using a Task will more using consist of modifying its content (i.e. deleting entries).

The interface provided to modify ACLs allows specifying the name of the database whose ACL has to be modified, as well as the type of modification required (command):

The commands operate on the 3 editable areas of the ACLs (Special, Roles, Entries tabs):

Data on the ACL Special tab:

AdminServer = Server Name
AdminServerModifyField = True / False
ConsistentACL = True / False
InternetMaxAccess = Access level

	AdminServer		Sets an administration server for the database whose name is mentioned. If the server is intended to be deleted, just enter an empty value. It is possible to use the @UserName keyword to put the ID name used by the ChangeACL process.
	AdminServerModifyField		Authorizes or not the AdminP process to modify the Readers / Authors fields in the database. Possible values are: False Do not modify Names fields True Modify all Readers and Authors fields All Modify all Names fields
	ConsistentACL		Sets or unsets the Flag describing ACL consistency. Possible values are: True Consistent LCA False Not Consistent LCA
	InternetMaxAccess		Sets the access level for Web users. Possible values are: Manager Manager Designer Designer Editor Editor Author Author Reader Reader Depositor Depositor NoAccess No access to database

Roles:

AddRole = [Role Name]
RenameRole = [Old Role] , [New Role]
RemoveRole = [Role Name]

	AddRole		Adds a role into the ACL. If the role already exists, no processing is performed.
			Syntax:
			AddRole = [Name of new role]

	RenameRole		Renames a role in the ACL. If the role does not exist, no processing is performed.
			Syntax:
			RenameRole = [Name of old role], [Name of new role]


	RemoveRole		Removes a role from the ACL. If the role does not exist, no processing is performed..
			Syntax:
			RemoveRole = [Name of role to remove]

Note: role names must be framed by square brackets [ ]. Role name length is limited to 15 characters.

The following lines are related to the management of ACL entries :

AddEntry = Canonical name, Type, Access Level, +/- Flags, [Role 1], [Role 2], ...
RenameEntry = Old Name, New Name
RemoveEntry = Canonical name

AddEntry

Adds an entry into the ACL or modifies an already existing ACL.
Syntax:
AddEntry = Entry name, Entry type, Access level, Flags, Roles

Possible values are:
Type Accès Flags
Unspecified Manager C : Create documents
Person Designer D : Delete documents
Server Editor A : Create private Agents
MixedGroup Author V : Create personal Folders/Views
PersonGroup Reader S : Create shared Folders/Views
ServerGroup Depositor L : Create LotusScript/Java Agents
NoAccess R : Read Public documents
W : Write Public documents
O : Replicate or Copy documents

Notes:

Entry names must be entered in canonical format (ex : CN=Matt Lassiter/OU=Sales/O=Admin Software). If you do not specify the canonical format, the handling of these entries by the Notes client user interface will be disrupted (entry absent from the index...).
For entry names, it is possible to use the @UserName keyword that matches the name of the Notes ID used for processing.
If the roles specified on the line do not exist in the ACL, then they are created.
The different roles must be separated by a comma (ex : [SALES], [BUSINESS], [ADMIN])
It is possible to use the symbols + and - before Roles to specify whether they have to be added or removed (ex : -[SALES], +[ADMIN]) when modifying an existing entry.
Concatenating a group of Flags (ex : CARW) is an acceptable way to specify them.
It is possible to use the symbols + and - before Flags to specify whether they must be added or removed (ex : +C-D+W).
Flags can only be added or removed according to the access level of this entry :

	Access level		Editable Flags

	Manager		D : Delete documents
			O : Replicate or Copy documents

	Designer		D : Delete documents
			L : Create LotusScript/Java Agents
			O : Replicate or Copy documents

	Editor		D : Delete documents
			A : Create Private Agents
			V : Create personal Folders/Views
			S : Create shared Folders/Views
			L : Create LotusScript/Java Agents
			O : Replicate or Copy documents

	Author		C : Create documents
			D : Delete documents
			A : Create private Agentq
			V : Create personal Folders/Views
			L : Create LotusScript/Java Agents
			W : Write Public documents
			O : Replicate or Copy documents

	Reader		A : Create private Agents
			V : Create personal Folders/Views
			L : Create LotusScript/Java Agents
			R : Read Public documents
			O : Replicate or Copy documents

	Depositor		R : Read Public documents
			W : Write Public documents
			O : Replicate or Copy documents

	NoAccess		R : Read Public documents
			W : Write Public documents

	RenameEntry		Renames an entry in the ACL. If the entry does not exist, no processing is performed.
			Syntax:
			RenameEntry = Name of old entry, Name of new entry

	RemoveEntry		Removes an entry from the ACL. If the entry does not exist, no processing is performed.
			Syntax:
			RemoveEntry = Name of entry to remove

Examples :

ConsistentACL = False
RemoveEntry = CN=John HOUSTON/OU=Sales/O=Cooperteam
AdminServer = CN=SRV_853/O=Cooperteam
AddEntry = -Default-, Unspecified, Manager, +D,

Articles in this section

Data on the ACL Special tab:

Roles:

Comments