Well I will try to make lemonade then...

HCL Notes/Domino 8.5 Forum (includes Notes Traveler)

Subject:

Phillipe,

First, I appreciate your response. Really.

I do not know which is worse right now: my anger at this situation or my amazement that it even exists. To know that IBM released XPages without supporting the existing security model/functionality already in Domino ranks right up there with Garnet to me.

Time for making lemonade from lemons...since it appears it is not settled yet, let me tell you how I think this should work.

Every single programmable element needs to have the option to run as the signer of the XPage.

They should all default to running with the Web user's rights but there should be a property (computed of course) that can be set so that the code in that element can run with signer's access.

If that is not possible then perhaps separate events where the code runs as the signer. For instance, on a button in addition to the Client and Server tabs for code, add a Signer Client and Signer Server tab for code.

If that is not possible then perhaps an added event on an XPage similar to the WebQuerySave/Open events we have today where you can either run code or specify an agent to run and that agent would run using the same security model we have today.

The bottom line is you cannot develop a secure Domino application without this functionality.

If you cannot use Domino security then the harsh reality is you might as well use something else to develop your web application.

Feedback response number WEBB7RMKN5 created by ~Wei Minluflar on 05/01/2009