6.5 NFARM (OES File Access Rights Management)
OES File Access Rights Management (NFARM) is a shell (Windows) or finder (Mac) extension that enables eDirectory or Active Directory users on Windows and Mac workstation to perform Salvage and Purge operations. In addition,
-
On Windows workstation, enables Windows Active Directory or eDirectory administrators or users to manage the access rights and quotas of AD or eDirectory users or groups on Storage Services (NSS) resources.
-
On Mac workstation, enables Windows Active Directory administrators or users to manage the access rights and quotas of AD users or groups on Storage Services (NSS) resources.
-
In case of trusted domain or forest, ensure that the user belongs to AD supervisor group of the domain where OES server is joined.
NOTE:For OES 2018 SP2, NFARM on MAC supports only Single forest.
NFARM on Windows helps AD or eDirectory administrators or users with sufficient rights to manage the following:
-
Trustees explicit rights, inherited rights filter, and view effective rights. You can also view trustees with rights from the selected path and child or parent directories.
-
Owners, NSS attributes and directory quota
-
User quotas
-
All paths that a user is a trustee of
-
Salvage and Purge
NOTE:
-
To view, add, or modify User Quota:
-
For Active Directory, ensure that the user belongs to AD supervisor group of the domain where OES server is joined.
-
In case of trusted domain or forest, ensure that the user belongs to the AD supervisor group of the domain where OES server is joined.
-
For eDirectory, ensure that the user is an administrator or with administrator equivalent rights.
-
The term object referred to in this section, indicates a path, folder, or volume.
After performing any operation in NFARM, you can click the following:
-
to save changes to the NSS file system and remain in the same window.
-
to save changes to the NSS file system and exit.
-
to discard changes and exit.
All these operations are performed on a Windows mapped network drive that is mapped to an NSS volume, NSS Folder, or CIFS Share in the Windows client.
-
For Active Directory, these shares must be compatible with OES 2015 or later servers that have NSS AD set up and configured.
-
For eDirectory, these shares must be compatible with OES 2018 SP2 or later servers.
Similarly, NFARM on Mac helps AD administrators or users with sufficient rights to manage the following:
-
Trustees explicit rights, inherited rights filter, and view effective rights. You can also view trustees with rights from the selected path and child or parent directories.
-
Owners, NSS attributes and directory quota
-
User quotas
-
All paths that a user is a trustee of
-
Salvage and Purge (both AD or eDirectory users)
The term object referred to in this section, indicates a path, folder, or volume.
After performing any operation in NFARM, you can click the following:
-
to save changes to the NSS file system and remain in the same window.
-
to undo the changes and remain in the same window.
-
to save changes to the NSS file system and exit.
-
to discard changes and exit.
All these operations are performed on a OES mapped drive that is mapped to an NSS volume, NSS Folder, or CIFS Share in the Mac client. These shares must be compatible with OES 2018 SP1 Update 6 (JAN 2020 Patch) or later servers that have NSS AD set up and configured.
This section includes the following:
6.5.4 Managing the Trustee Rights in the NSS File System
On Windows
Using the Trustee Rights tab, you can do the following:
-
View, add, edit, search, and remove trustees and their explicit rights on a selected path. The path can be the root of a volume, a folder in the volume, a file or a CIFS share.
-
View both Active Directory and eDirectory trustees.
-
View and edit the Inherited Rights Filter (IRF) for the selected path.
-
View the effective rights trustees on the selected path.
-
View trustees with rights on the selected path and parent or child directories.
Managing the Explicit Rights of Trustees
Explicit rights are the rights defined for the trustee (user or group) on an object. The trustee names are displayed in FQDN (for eDirectory user or group) and it is preceded by the AD domain name (for AD user or group) along with the following eight NSS rights:
-
Supervisor: Grants all rights to the directory or file and any subordinate items. The Supervisor right can't be blocked by an Inherited Rights Filter. Users with this right can grant or deny other users rights to the directory or file.
-
Read: For a directory, grants the right to open files in the directory and read the contents or run the programs. For a file, grants the right to open and read the file.
-
Write: For a directory, grants the right to open and change the contents of files in the directory. For a file, grants the right to open and write to the file.
-
Erase: Grants the right to delete the directory or file.
-
Create: For a directory, grants the right to create new files and directories in the directory. For a file, grants the right to create a file and to salvage a file after it has been deleted.
-
Modify: Grants the right to change the attributes or name of the directory or file, but does not grant the right to change its contents (changing the contents requires the Write right).
-
File Scan: Grants the right to view directory and file names in the file system structure, including the directory structure from that file to the root directory.
-
Access Control: Grants the right to add and remove trustees for directories and files and modify their trustee assignments and Inherited Rights Filters.
This right does not allow the trustee to add or remove the Supervisor right for any user. Also, it does not allow to remove the trustee with the Supervisor right.
NOTE:These NSS rights are not related to the Microsoft Windows rights in any way.
This section explains the procedure to add, remove, or search trustees on an object, in addition to managing their explicit rights on the selected object:
-
To add trustees on a selected path:
-
When you map the volume as an AD user, click , search and select the AD users or groups, then select the rights. If you are entering multiple trustee names in the text box, separate each trustee with a semicolon.
-
When you map the volume as an eDirectory user, click . Specify the object name, search context, select the object type, and then click . In the User or Group Name list, select the eDirectory user or group and click .
-
-
To remove trustees, select the trustees that you want to remove, then click .
HINT:To delete multiple trustees, press and hold the Ctrl key while selecting multiple trustees.
-
To search for a specific trustee in the trustee list, specify the trustee name, and click . To revert to the original trustee list, clear the entry in the search box, and then click .
-
To edit or remove rights for the displayed trustees, select or clear the respective rights check boxes. Multiple trustee edit is possible.
-
To list the eDirectory and Active Directory trustees in the trustee list, select . After listing, you can continue to perform a search or remove trustees, edit or remove rights, but you cannot add any user to the trustee list.
After managing the explicit rights, ensure that you click in order for your changes take effect in the NSS file system.
Managing Inherited Rights Filter (IRF)
Subdirectories and files can inherit rights from their parent directory. The directory’s rights flow down through its structure to subdirectories and files, except for specific subdirectories or files with their own trustee assignments that supersede inherited rights. When granting a trustee assignment to a subdirectory or file, the trustee assignment takes precedence over the inherited rights of its parent directory.
The Inherited Rights Filter section displays the list of rights that are inherited from the parent object. To block inheritance of rights from the parent object to the selected object (file or directory), clear the respective NSS rights, then click for the changes to take effect in the NSS file system.
The supervisor rights cannot be blocked.
Viewing the Effective Rights
A user’s explicit rights on a directory are combined with the filtered rights inherited from its parent directory. Any rights through security equivalence are also applied.
A user’s explicit rights on a file override any rights that can be inherited from its parent directory. In this case, the user has only the rights granted, and the inherited rights are ignored. If the user is a member of another group or role that also has explicit rights to the file, the user’s effective rights on the file are a combination of the rights granted for the user and the rights granted for the group or role. If the rights of the group or role are more restrictive than the user’s explicit rights, it has no effect on rights granted to the user.
An object’s effective rights to a subdirectory are the set of distinct rights from the following:
-
Rights inherited for the user from the parent directory, with consideration of the inherited rights filter set for the subdirectory.
-
Rights set explicitly for the user on the directory.
-
Rights set explicitly for a security-equivalent object on the directory:
-
Explicit by assignment (Security Equal To property)
-
Automatic by membership in a group or role
-
Implied by its parent container and by the [Public] container
More restrictive security-equivalent rights do not override rights granted for the trustee on the directory or for the trustee’s filtered inherited rights.
-
An object’s effective rights to a file are determined by the following:
-
Rights inherited for the user from the parent directory, with consideration of the inherited rights filter set for the file.
If the user has rights set on the parent directory or is security equivalent to an object with explicit rights set there, those are the rights that flow down to the file for the user and are subject to the IRF.
Inherited rights for a file are ignored if rights are set explicitly for the object or for a security equivalent of the object. This behavior is different than for a directory.
-
Rights set explicitly for the user on the file.
Inherited rights are ignored. Explicit trustee rights for a security equivalent object are added. More restrictive security-equivalent rights do not override rights set for the trustee on the file.
-
Rights set explicitly for a security-equivalent object on the file:
-
Explicit by assignment (Security Equal To property)
-
Automatic by membership in a group or role
-
Implied by its parent container and by the [Public] container
Inherited rights are ignored. Explicit trustee rights are added.
-
For more information, see How Effective Rights Are Calculated in the NetIQ eDirectory Administration Guide.
To launch the Effective Rights screen, from the Trustee Rights tab, click . By default, for the selected object, the list of trustees along with their rights is displayed. You can use the button to view the rights of a specific trustee in the trustee list.
NOTE:To revert to the original trustee list, clear the entry in the search box, and then click .
To view the effective rights of some other trustee, click :
-
When you map the volume as an AD user, search or enter the trustee name.
-
When you map the volume as an eDirectory user, search the trustee name in the list, select the eDirectory user or group, and then click . You can select only one user at a time.
NOTE:If you enable the option on the Trustee Rights tab, you cannot view the effective rights of other trustees.
You must have adequate rights to view the effective rights of other trustees.
Managing Trustees for Directories
Using the Trustees for Directories tab, you can get the explicit rights of the trustees from the selected path to the root of the volume and trustees from the selected path to the child directories in the volume.
To launch the Trustees for Directories screen, from the Trustee Rights tab, click .
For example, assume that you have the following directory structure:
-
\vol1\media\audio
-
\vol1\org\country\us\ny\emp
-
\vol1\org\country\us\slc\emp
-
\vol1\org\country\uk\ln\emp
-
\vol1\org\country\uk\lpl\emp
If you click from the “country” folder, it will list the explicit list of trustees and their rights in the country, org and vol1. It does not consider the media and its sub directories.
If you click from the countries folder, it lists the explicit rights of all the trustees in the following directories:
-
\vol1\org\country\us\
-
\vol1\org\country\us\ny
-
\vol1\org\country\us\slc
-
\vol1\org\country\us\ny\emp
-
\vol1\org\country\us\slc\emp
-
\vol1\org\country\uk
-
\vol1\org\country\uk\ln
-
\vol1\org\country\uk\lpl
-
\vol1\org\country\uk\ln\emp
-
\vol1\org\country\uk\lpl\emp
From this tab, you can also modify the explicit rights of the trustees by clearing or selecting the NSS rights check boxes. You can also remove trustees by using the button. To search for a specific trustee in the trustee list, specify the trustee name, and click .
NOTE:To revert to the original trustee list, clear the entry in the search box, and then click .
On Mac
Using the Trustee Rights tab, you can do the following:
-
View, add, edit, search, and remove trustees and their explicit rights on a selected path. The path can be the root of a volume, a folder in the volume, a file or a CIFS share.
-
View and edit the Inherited Rights Filter (IRF) for the selected path.
-
View the effective rights trustees on the selected path.
-
View trustees with rights on the selected path and parent or child directories.
Managing the Explicit Rights of Trustees
Explicit rights are the rights defined for the trustee (user or group) on an object. The trustee names displayed here are always preceded by the AD domain name (for AD user or group) along with the eight NSS rights. For more information on these eight rights, see Managing the Explicit Rights of Trustees on Windows.
This section explains the procedure to add, remove, or search trustees on an object, in addition to managing their explicit rights on the selected object:
-
To add trustees on a selected path, click
, search and select the AD users or groups, then select the rights.
-
To remove trustees, select the trustees that you want to remove, then click
.
HINT:
-
To select all files: Select the first file, then press COMMAND+A.
-
To select multiple files: Press and hold the ALT key, then click the files of your choice..
-
To select a series of files: Select the first file, press and hold the SHIFT key, and then click the last file.
-
-
To search for a specific trustee in the trustee list, specify the trustee name in the search box.
-
To edit or remove rights for the displayed trustees, select or clear the respective rights check boxes. Multiple trustee edit is possible.
After managing the explicit rights, ensure that you click in order for your changes take effect in the NSS file system or click to undo the changes.
Managing Inherited Rights Filter (IRF)
Subdirectories and files can inherit rights from their parent directory. The directory’s rights flow down through its structure to subdirectories and files, except for specific subdirectories or files with their own trustee assignments that supersede inherited rights. When granting a trustee assignment to a subdirectory or file, the trustee assignment takes precedence over the inherited rights of its parent directory.
The Inherited Rights Filter section displays the list of rights that are inherited from the parent object. To block inheritance of rights from the parent object to the selected object (file or directory), clear the respective NSS rights, then click for the changes to take effect in the NSS file system or click to undo the changes.
The supervisor rights cannot be blocked.
Viewing the Effective Rights
A user’s explicit rights on a directory are combined with the filtered rights inherited from its parent directory. Any rights through security equivalence are also applied.
A user’s explicit rights on a file override any rights that can be inherited from its parent directory. In this case, the user has only the rights granted, and the inherited rights are ignored. If the user is a member of another group or role that also has explicit rights to the file, the user’s effective rights on the file are a combination of the rights granted for the user and the rights granted for the group or role. If the rights of the group or role are more restrictive than the user’s explicit rights, it has no effect on rights granted to the user. For more information on effective rights, see Viewing the Effective Rights on Windows.
By default, for the selected object, the list of trustees along with their rights is displayed. You can use the button to view the rights of a specific trustee in the trustee list.
To view the effective rights of some other trustee, click , then search or enter the trustee name.
You must have adequate rights to view the effective rights of other trustees.
Managing Trustees for Directories
Using the Trustee for Directories tab, you can get the explicit rights of the trustees from the selected path to the root of the volume and trustees from the selected path to the child directories in the volume.
For example, assume that you have the following directory structure:
-
\vol1\media\audio
-
\vol1\org\country\us\ny\emp
-
\vol1\org\country\us\slc\emp
-
\vol1\org\country\uk\ln\emp
-
\vol1\org\country\uk\lpl\emp
If you click from the “country” folder, it will list the explicit list of trustees and their rights in the country, org and vol1. It does not consider the media and its sub directories.
If you click from the countries folder, it lists the explicit rights of all the trustees in the following directories:
-
\vol1\org\country\us\
-
\vol1\org\country\us\ny
-
\vol1\org\country\us\slc
-
\vol1\org\country\us\ny\emp
-
\vol1\org\country\us\slc\emp
-
\vol1\org\country\uk
-
\vol1\org\country\uk\ln
-
\vol1\org\country\uk\lpl
-
\vol1\org\country\uk\ln\emp
-
\vol1\org\country\uk\lpl\emp
From this tab, you can also modify the explicit rights of the trustees by clearing or selecting the NSS rights check boxes. You can also remove trustees by using the button. To search for a specific trustee in the trustee list, specify the trustee name in the search box.
6.5.5 Information or Directory Quota
On Windows
Using the Information tab, you can view and modify:
-
The owner of a file
-
NSS attributes
-
Directory quotas
-
To change the owner of a file, click , then search for and select the new owner.
NOTE:If you enable the option on the Trustee Rights tab, you cannot change the owner of a file.
-
To set the NSS attributes for the selected path, select or clear the respective attributes. These attributes vary based on the object chosen (file or directory).
-
To change the directory quota of a selected path, click , then specify the quota limit and the memory unit (KB, MB, GB, TB, PB). After setting the quota, you will be able to view the quota limit set, the used quota and the available quota.
-
Click for the changes to take effect in the NSS file system.
On Mac
Using the Directory Quota tab, you can view and modify:
-
The owner of a file
-
NSS attributes
-
Directory quotas
-
To change the owner of a file, click
, then search for and select the new owner.
-
To set the NSS attributes for the selected path, select or clear the respective attributes. These attributes vary based on the object chosen (file or directory).
-
To change the directory quota of a selected path, click
, then specify the quota limit and the memory unit (MB, GB, TB, PB). After setting the quota, you will be able to view the quota limit set, the used quota and the available quota.
-
Click to undo the changes or click for the changes to take effect in the NSS file system.
6.5.6 User Quota
Using the User Quota tab, you can add, edit, or remove the user quota limit for a single or multiple users concurrently. For every user, it lists the quota limit, used, and remaining.
On Windows
To set the user quota:
-
For Active Directory users, you should either be an AD domain administrator or a user who has administrative privileges.
-
For eDirectory users, you should either be an eDirectory administrator or a user who has administrative privileges.
To search for a specific trustee in the trustee list, specify the trustee name, and click . To revert to the original trustee list, clear the entry in the search box, and then click .
-
To assign quotas for a single or multiple users, click ..., search and select users, then specify the quota limit.
NOTE:If you enable the option on the Trustee Rights tab, you cannot assign quotas for any user.
-
To edit the quota limit, select users, click ..., then modify the quota limit. Press and hold the Ctrl key while selecting multiple users.
-
To remove the quota set for users, select the users, then click .
NOTE:The user quota is always set at the volume level, regardless of the folder or share from where you have invoked the User Quota.
On Mac
To set the user quota, you should either be an AD domain administrator or a user who has administrative privileges.
-
To assign quotas for a single or multiple users, click
. A new window is displayed, click , search and select users, then specify the quota limit.
-
To edit the quota limit, select users, click
, then modify the quota limit and click . Press and hold the Alt key while selecting multiple users.
-
To remove the quota set for users, select the users, then click
.
-
Click to undo the changes or click for the changes to take effect in the NSS file system.
NOTE:The user quota is always set at the volume level, regardless of the folder or share from where you have invoked the User Quota.
6.5.7 File System Rights
On Windows
Using the File System Rights tab, you can do the following:
-
View all the objects that a user is a trustee of
-
Modify the explicit rights that the trustee has on an object
-
Add or remove the objects
-
View the rights of all groups to which the user is a member
-
To view the explicit rights of a trustee across objects at the volume level, click , then search and select a user or group.
NOTE:If you enable the option on the Trustee Rights tab, you cannot select any user or group name to view the explicit rights of a trustee.
-
To modify the explicit rights that the trustee has on an object, select or clear the respective NSS rights check boxes next to the object name.
-
To add an object and to assign rights to the trustee, click , then select the path.
-
To remove an object on which the trustee has rights, select the object, then click . Press and hold the Ctrl key while selecting multiple objects.
-
To view rights of all the groups to which the trustee belongs, click . Group Rights is disabled if a group is selected.
On Mac
Using the File System Rights tab, you can do the following:
-
View all the objects that a user is a trustee of
-
Modify the explicit rights that the trustee has on an object
-
Add or remove the objects
-
View the rights of all groups to which the user is a member
NOTE:To view or modify the File System Rights, you should either be an AD domain administrator or a user who has administrative privileges. Further, you should have logged in to the Mac workstation using the AD administrative credentials.
-
To view the explicit rights of a trustee across objects at the volume level, click
, then search and select an user or a group.
-
To modify the explicit rights that the trustee has on an object, select or clear the respective NSS rights check boxes next to the object name.
-
To add an object and to assign rights to the trustee, click
, select the object, then assign rights and click .
-
To remove an object on which the trustee has rights, select the object, then click
. Press and hold the Ctrl key while selecting multiple objects.
-
To view the rights of all the groups to which the trustee belongs, click . is disabled if a group is selected.
-
Click to undo the changes or click for the changes to take effect in the NSS file system.