USER AND SERVER CONFIGURATION

Setting up a database ACL for server-to-server replication
You add the names of servers to a database ACL in the same way that you add the names of people. The access level given to a server in an ACL determines what, if any, changes that server can replicate to the replica.

Default server groups in an ACL

By default, every database ACL includes the server groups LocalDomainServers and OtherDomainServers.

LocalDomainServers
This group represents servers that are in the same IBM® Lotus® Domino® domain as the server that stores the replica. Typically you assign this group a higher access level in the database ACL than the OtherDomainServers group.

OtherDomainServers
This group represents servers that are not included in the Domino domain of the server that stores the replica. Typically you assign this group a lower access level in the database ACL than LocalDomainServers. For example, assigning this group Reader access in the ACL ensures that the local Domino domain retains control over the database.

Note Do not add the names of servers from outside companies to LocalDomainServers or to OtherDomainServers. Both these groups are included in all databases by default and may have a high access level in some cases. Instead, create a group specifically for the external servers with which your company communicates; for example, create a group called "External Servers." Then add this group to database ACLs as needed.

Access level privileges

For each access level, you can select or deselect these privileges:


In general, for servers, enable all the privileges that the selected access level allows. This ensures that the server has access that is as high as users might have and can replicate all user changes. However, to prevent certain changes from replicating without deselecting privileges for each user, you can deselect a particular privilege for a server entry in the ACL. For example, to prevent all document deletions made in a database on a particular server from replicating, deselect "Delete documents" in the ACL entry for the server. Then when users who have "Delete documents" access in the ACL delete documents, the deletions don't replicate.

Server access levels

This table describes access levels in terms of server access, from the highest access to the lowest.
Access levelAllows a server to push these changesAssign to
ManagerACL settings

Database encryption settings

Replication settings

All elements allowed by lower access levels

Servers you want to use as a source for ACL changes. For tight database security, give this access to as few servers as possible. In a hub-and-spoke server configuration, you typically give the hub server Manager access.
DesignerDesign elements

All elements allowed by lower access levels

Servers you want to use as the source for design changes. Use Manager access instead if you want one server to control ACL and design changes.
EditorAll new documents

All changes to documents

Servers that users use only to add and modify documents. In a hub-and-spoke configuration, you typically give the spoke servers Editor access.
AuthorNew documentsNo servers. You don't typically use this access for servers.
ReaderNo changes; server can only pull changesServers that should never make changes. Servers in the OtherDomainServers group are often given Reader access.
DepositorNew documents. Also prevents the server from pulling changes.No servers. You don't typically use this access for servers.
No AccessNo changes. Also prevents the server from pulling changes.Servers to which you want to deny access. Servers in the OtherDomainServers group are sometimes given No Access.


Note A database that doesn't replicate should have at least one server in its ACL to serve as the administration server for the database. This allows the Administration Process on a server to update names in the ACL when names in the organization change.

Related topics