Setting up agent security using the Security tab

Run as Web user

Checking this causes the agent to run with the effective user name of the Web user.

Run on behalf of

Lets you specify on whose authority this agent can run. Note that restricted signers can run agents only under the same authority as their own (that is, the restricted signers enter only their own name or else the agent returns an error at run time). Unrestricted signers and signers with rights to run "On behalf of anyone" can run agents on behalf of anyone. Whoever you specify in this field has to be included in the ACL of any database being accessed.

If the agent is sending mail, the server name is used as the mail sender.

If the agent is creating documents, this name is used as the document author.

Allow remote debugging

Checking this enables the agent to be debugged through a remote debugger. This property applies only to LotusScript® agents.

Restricted operations

Lets users who have unrestricted rights specify whether the agent should run in restricted mode, unrestricted mode, or unrestricted with full administration rights mode. By default, the value is set to restricted mode because this is the safest setting. For users who have restricted rights, this option has no effect on the agent.

You have the following choices from the drop-down list:

• Do not allow restricted operations -- the agent is not allowed to perform restricted operations. Note that this is the most secure choice. The reason the agent cannot perform restricted operations is that the agent has rights that are restricted.
• Allow restricted operations -- the agent can perform restricted operations because it is has been granted unrestricted rights. Note that this is a less secure choice than the previous one and grants the agent more power.
• Allow restricted operations with full administration rights -- the agent can perform restricted operations and can do so with full administration rights. This choice grants even more power to the agent because the agent now has been granted unrestricted rights and given full administration rights. Use this choice with caution.

For more information on restricted operations, see the topic "Restricted LotusScript® and Java™ agent operations" later in this chapter.

Profile this agent

Check this box to monitor calls to Domino® Objects in agents and their elapsed times. For agents written in LotusScript® or Java™ only.

Compile Java™ code with debugging information

Checking this enables the Java™ code to be debugged through a remote debugger. This property applies only to Java™ agents.

Allow editor level user activation

Checking this box allows users with ACL editor access to enable this agent. Users with editor access normally cannot enable an agent. Enabling an agent modifies its signature. This check box allows a scheduled agent on the server to be enabled or disabled without resigning the agent if the signer is allowed to sign on behalf of others. The ability to sign agents on behalf of others is defined in the programmability security section of the server record, and should be given only to the most trusted users. For the agent to operate on behalf of a user with editor access, the "Run on behalf of" field must be populated. You can do this manually when you create the agent, or programmatically using ConfigureMailAgent in the LotusScript® NotesAdministrationProcess class or configureMailAgent in the Java™ AdministrationProcess class. If the enabling is done programmatically, the name in "Run on behalf of" field must match the name of the mail owner of this database.

Default access for viewing and running this agent

The default level for viewing and running the agent is "All readers and above." You can deselect this field and choose who you want to have default access for viewing and running the agent.

Allow public access users to view and run this agent

Lets users who have public access to documents in a database view and run the agent.