xPage NotesContext getDatabase ACL issues

1
votes

Domino version: 9.0.1

Use Case
I have a main database(DB0.nsf) on which the user has the reader access right and N databases on which the currently logged user has different levels of access (example DB1 - default user is reader; DB2 - User no access, DB3 - user's group is author)

User opens xpage from the main database. XPage contains a view panel that should display the list of databases over whom currently logged user has minimum reader access.

This view is acting strange, ie. sometimes it works as expected and all the database over which the user has minimum reader access are displayed, and sometimes it does not display all databases.(In my example user should see DB1 and DB3, but sometimes he sees only one DB3, he does not see the database which has default access in ACL set to Reader)

xpage
xsp contains a view panel where the source is list of objects, defined in Managed Bean as attribute

managed bean session scope

Snippet of my code

String path=paths.get(0).replace("\\","\\\\"); String srv=srvss.get(0); dbSearch=NotesContext.getCurrent().getCurrentSession().getDatabase(srv,path,false);

The problem
On db1.nsf.ACL entry Default access is set to reader. With the same user logged in, I have different results of above code. User just refreshes the page constantly and sometimes the exception is thrown in the getDatabase line.
NotesException: User user cannot open database TEST\\test\\db1.nsf at lotus.domino.local.Session.NgetDatabase(Native Method) at lotus.domino.local.Session.getDatabase(Unknown Source)

Extra debug
I added a few lines for debug - and when exception is thrown I get same database as session signer and print access level for every ACL entry in that database. in my example I open DB1.nsf as sessionAsSigner and in console I see that default ACL level for DB1.nsf is Reader.

Any suggestions would be appreciated.

1
javasessionxpageslotus-dominomanaged-bean
What happens if you use a global group (like "allUsers") or all domain members (as in */yourDomain if your users are registered as CN=user name/O=yourdomain) instead of referencing DEFAULT? Most probably it SHOULD be working your way, but in all the years of Domino development I made it a habot to always set DEFAULT to NO ACCESS and instead use specific groups... – Lothar Mueller
When I'm using global group it's working fine. But I can not understand why it's not working with DEFAULT? – Icca
Me neither. But since you write that is sometimes working but sometimes it isn't I could imagine that this might be some kind of caching problem. Maybe DEFAULT is just toongeneric here... I'll Post my Suggestion as an answer so that can acceptnit if it's fine for you. – Lothar Mueller
That bean is of what scope? – Frantisek Kossuth
Sorry the bean is request scope – Icca

1 Answers

0
votes

As I wrote in my last comment I could only guess why DEFAULT sometimes isn't working. As a workaround you can use global groups (my personal preference) or placeholder entries like "*/yourDomain"

Using groups (in combination with ACL roles) also has many advantages when maintaining the access rights of your databases. That simply is the way Notes security has been designed