IdeaJam(tm) : Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Domino Server / Security: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Fri, 25 Jun 2010 21:12:56 +0000

Author: David Hablewitz
Tags: create database
Idea:

Currently the security setting to allow creating databases on a server is an all-or-nothing option. I would like to give users limited ability to create databases on the server in a designated directory. This would allow them to replicate local databases like their archives to the server in a managed way.

Without this ability, the alternative is for the user to give a copy of the file to someone who can create replicas on the server or to set up a server that allows everyone to create replicas, knowing the admin will need to go in and move things around and clean them up.

Access to create databases in a directory should be managed by an ACL of sorts that permits the use of groups. User policies may come into play somewhere here too.

As an addendum based on comments, the user should be able to initiate the replica process and have it require approval in AdminP just like other processes require approval.

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Mon, 28 Jun 2010 09:15:28 +0000

Author: Bill Malchisky
Comment: Couldn't you just create a group for allowing people to make replicas, then apply that to the respective replicas?

So, <allow_create_archive_replica> add that to the Server doc, then apply group to the ACL on each replica and template used in respective directory. May not be the most direct way, but it should get the job done, if I am understanding your post correctly.

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Mon, 28 Jun 2010 17:13:29 +0000

Author: David Hablewitz
Comment: No, that won't get the job done.
If someone has the rights to create a new replica or Db on a server, that has no impact on where they put it. There is no way to restrict which folder they create the database in. They can even create new folders on the server as they create the database.

Inevitably they will put it in the wrong place. (then I would need this feature available: { Link } )

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Tue, 29 Jun 2010 11:10:00 +0000

Author: Vlad Sh
Comment: I am opposed because:
1. Starts the uncontrolled creation of databases / replicas on the server and free space in the server's disk subsystem, designed for the required databases, may be occupied by user.
2. This increases the vulnerability of the server, because might be possible to run the agents, who are currently (already) can not run.

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Tue, 29 Jun 2010 18:27:50 +0000

Author: David Hablewitz
Comment: Vlad, thanks for the comment. To clarify:

1. I am not sure how more granular restrictions on creating new replicas makes it LESS controlled. I'm talking about restricting where new replicas can be created.
But, to address that, I will adapt my suggestion to include the AdminP approval process. Actually, that should be a separate idea...

2. This has no effect on users' rights to run agents nor ACLs of databases.

Ultimately, the problem that needs solving is a more effective means to manage creation of new databases/replicas by end users onto servers. There are times when this is appropriate.

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Tue, 29 Jun 2010 19:49:58 +0000

Author: Vlad Sh
Comment: David

2. It happens that the user has remained a local replica of the old agents. It creates a replica on the server and agent (has the right, as signed by the server) starts to work - it can change the data from other databases, it can be adapted to the old model of the data, ie break the new data model. These errors are subtle, more difficult to correct them later...

re: Grant access to create databases/replicas on a server IN A DESIGNATED DIRECTORY

Fri, 09 Jul 2010 15:17:29 +0000

Author: Peter Presnell
Comment: I am for ANYTHING that will allow at least some Administrators to consider granting these rights to a server. We are killing off power-users by preventing them from a basic right - to have their databases hosted. For Notes to be successful we need more Notes databases not less.