Extended ACL - example 2

The Renovations Domino® Directory includes three groups of administrators:

• The Admins/Renovations group, responsible for managing documents throughout the directory.
• The Admins/West/Renovations group, responsible for managing documents that fall under OU=West and that have names ending in West/Renovations.
• The Admins/East/Renovations group, responsible for managing documents that fall under OU=East and that have names ending in East/Renovations.

To establish security, Renovations has these goals:

1. Allow members of the Admins/Renovations group to:
   • Have full access to all documents in the directory
   • Manage access at any target in the extended ACL
2. Allow members of the Admins/West/Renovations group to:
   • Read all fields in all documents in the directory
   • Create, modify, and delete only documents that fall under OU=West
   • Manage the extended ACL at the OU=West target
3. Allow members of the the Admins/East/Renovations group to
   • Read all fields in all documents in the directory
   • Create, modify, and delete only documents that fall under the OU=East
   • Manage the extended ACL for the OU=East target.
4. Allow authenticated users not in any of the administration groups to browse and read only Person, Group, and Resource documents throughout the database but not other documents, and prevent these users from creating, deleting, and modifying any documents
5. Prevent anonymous users from accessing the directory.

The following tables describe how Renovations sets up the Domino® Directory database ACL and the extended ACL to accomplish its security goals.