Lotus Domino Administrator 8 Help - Setting up a database ACL for server-to-server replication

USER AND SERVER CONFIGURATION

Setting up a database ACL for server-to-server replication
You add the names of servers to a database ACL in the same way that you add the names of people. The access level given to a server in an ACL determines what, if any, changes that server can replicate to the replica.

For more information on setting up a database ACL, see Configuring a database ACL.

Default server groups in an ACL

By default, every database ACL includes the server groups LocalDomainServers and OtherDomainServers.

LocalDomainServers
This group represents servers that are in the same IBM® Lotus® Domino™ domain as the server that stores the replica. Typically you assign this group a higher access level in the database ACL than the OtherDomainServers group.

OtherDomainServers
This group represents servers that are not included in the Domino domain of the server that stores the replica. Typically you assign this group a lower access level in the database ACL than LocalDomainServers. For example, assigning this group Reader access in the ACL ensures that the local Domino domain retains control over the database.

Note Do not add the names of servers from outside companies to LocalDomainServers or to OtherDomainServers. Both these groups are included in all databases by default and may have a high access level in some cases. Instead, create a group specifically for the external servers with which your company communicates; for example, create a group called "External Servers." Then add this group to database ACLs as needed.

For more information on setting up groups, see Creating and modifying groups.

Access level privileges

For each access level, you can select or deselect these privileges:

Create documents
Delete documents
Create personal agents
Create personal folders/views
Create shared folders/views
Create LotusScript/Java™ agents
Read public documents
Write public documents

In general, for servers, enable all the privileges that the selected access level allows. This ensures that the server has access that is as high as users might have and can replicate all user changes. However, to prevent certain changes from replicating without deselecting privileges for each user, you can deselect a particular privilege for a server entry in the ACL. For example, to prevent all document deletions made in a database on a particular server from replicating, deselect "Delete documents" in the ACL entry for the server. Then when users who have "Delete documents" access in the ACL delete documents, the deletions don't replicate.

For more information on setting up database ACLs, see Configuring a database ACL.

Server access levels

This table describes access levels in terms of server access, from the highest access to the lowest.

Access level Allows a server to push these changes Assign to

Manager ACL settings
Database encryption settings
Replication settings
All elements allowed by lower access levels
Servers you want to use as a source for ACL changes. For tight database security, give this access to as few servers as possible. In a hub-and-spoke server configuration, you typically give the hub server Manager access.

Designer Design elements
All elements allowed by lower access levels
Servers you want to use as the source for design changes. Use Manager access instead if you want one server to control ACL and design changes.

Editor All new documents
All changes to documents
Servers that users use only to add and modify documents. In a hub-and-spoke configuration, you typically give the spoke servers Editor access.

Author New documents No servers. You don't typically use this access for servers.

Reader No changes; server can only pull changes Servers that should never make changes. Servers in the OtherDomainServers group are often given Reader access.

Depositor New documents. Also prevents the server from pulling changes. No servers. You don't typically use this access for servers.

No Access No changes. Also prevents the server from pulling changes. Servers to which you want to deny access. Servers in the OtherDomainServers group are sometimes given No Access.

Note A database that doesn't replicate should have at least one server in its ACL to serve as the administration server for the database. This allows the Administration Process on a server to update names in the ACL when names in the organization change.

For more information on the administration server, see Administration servers.

Configuring a database ACL

Glossary

Feedback on Help or Product Usability?

Help on Help

All Help Contents

Glossary

Access level	Allows a server to push these changes	Assign to
Manager	ACL settings Database encryption settings Replication settings All elements allowed by lower access levels	Servers you want to use as a source for ACL changes. For tight database security, give this access to as few servers as possible. In a hub-and-spoke server configuration, you typically give the hub server Manager access.
Designer	Design elements All elements allowed by lower access levels	Servers you want to use as the source for design changes. Use Manager access instead if you want one server to control ACL and design changes.
Editor	All new documents All changes to documents	Servers that users use only to add and modify documents. In a hub-and-spoke configuration, you typically give the spoke servers Editor access.
Author	New documents	No servers. You don't typically use this access for servers.
Reader	No changes; server can only pull changes	Servers that should never make changes. Servers in the OtherDomainServers group are often given Reader access.
Depositor	New documents. Also prevents the server from pulling changes.	No servers. You don't typically use this access for servers.
No Access	No changes. Also prevents the server from pulling changes.	Servers to which you want to deny access. Servers in the OtherDomainServers group are sometimes given No Access.