a) Make sure the buttons/links to the admin xpage only display for the admin role.

b) On the admin xpage, put a header with a redirect back to the home page if not the admin role.

c) Enclose the rest of the admin page in a panel that will only render if using the correct role.

Hi Fredrik,

 

/you can set an ACL on the XPage itself. See here (http://xpagesblog.com/xpages.../controlling-access-to-an-xpage-with-the-xpages-acl.html) for an explanation.

 

An example of an ACL to check for an [admin] role is:

    <xp:this.acl>
        <xp:acl>
            <xp:this.entries>
                <xp:aclEntry right="EDITOR" type="ROLE">
                    <xp:this.name><![CDATA[[admin]]]></xp:this.name>
                </xp:aclEntry>
            </xp:this.entries></xp:acl>
    </xp:this.acl>

 

Mark