avoid using a page ACL on servers that use Directory Assistance
Category xpages
XPages support definition of a page-specific ACL, allowing you to refine permissions for specific portions of an application, as described in this article. As Paul mentions in the comments, you can also set an ACL on a specific panel component; this allows you to define entirely different permissions for distinct portions of the same page. For example, if you were to create an "in-view editing" interface using a repeat control, you would typically create a panel inside the repeat, with a panel-specific data source bound to each document that is being iterated. In this scenario, you can define an ACL specific to that panel, which would allow you to block editing of information associated with records the user should not modify. This is a very useful feature.
There's a problem, however: the Directory API, in general, is rather buggy. While I haven't personally repeated my previous testing of the API within 8.5.3, there were serious issues with it in all prior 8.5.x releases. In fact, simple username queries could even cause server crashes. At the time, IBM told me they were able to reproduce the behavior, so I'm assuming the problem has already been resolved or is, at least, on their radar. But, again, I haven't yet confirmed that 8.5.3 fixes the problem.
As such, it is inadvisable to define a page- or panel-specific ACL if the application will be accessed on servers that support Directory Assistance. Keith and I have both gotten burned by this: specifically, if a user authenticated against an account in the primary Domino Directory accesses a page with an ACL, the page functions as expected... if, on the other hand, the same page is accessed by a user authenticated against an account in a directory registered with Directory Assistance (whether LDAP or a secondary Domino Directory), a 500 is often thrown. Replacing the ACL with an alternative approach to managing security and visibility of data resolves the problem.
XPages support definition of a page-specific ACL, allowing you to refine permissions for specific portions of an application, as described in this article. As Paul mentions in the comments, you can also set an ACL on a specific panel component; this allows you to define entirely different permissions for distinct portions of the same page. For example, if you were to create an "in-view editing" interface using a repeat control, you would typically create a panel inside the repeat, with a panel-specific data source bound to each document that is being iterated. In this scenario, you can define an ACL specific to that panel, which would allow you to block editing of information associated with records the user should not modify. This is a very useful feature.
There's a problem, however: the Directory API, in general, is rather buggy. While I haven't personally repeated my previous testing of the API within 8.5.3, there were serious issues with it in all prior 8.5.x releases. In fact, simple username queries could even cause server crashes. At the time, IBM told me they were able to reproduce the behavior, so I'm assuming the problem has already been resolved or is, at least, on their radar. But, again, I haven't yet confirmed that 8.5.3 fixes the problem.
As such, it is inadvisable to define a page- or panel-specific ACL if the application will be accessed on servers that support Directory Assistance. Keith and I have both gotten burned by this: specifically, if a user authenticated against an account in the primary Domino Directory accesses a page with an ACL, the page functions as expected... if, on the other hand, the same page is accessed by a user authenticated against an account in a directory registered with Directory Assistance (whether LDAP or a secondary Domino Directory), a 500 is often thrown. Replacing the ACL with an alternative approach to managing security and visibility of data resolves the problem.
In our