Hey NAS_user
The only way to grant access to a share is to give all the groups the user is a member of a minimum of read only access to that share.
if you look at the table below (from the document) : all roads lead to deny access, unless you give all groups the user is a member of a minimum of read/only access to the data.
Now who is to say that all members of those groups would require access to that share data, and how exclusive do you need to get to grant users to a share before it becomes an administrative nightmare?
In further investigation after my original post here’s what happens:
When you make a share. Every user and group is explicitly denied in the smb config file for each share under the ‘invalid users’. (not just ‘not granted’ access, but explicitly denied). As you grant users or groups access, they get moved to the “valid users”, “read users” and/or “write users” section of the share you are modifying in the config file.
Now (leveraging my above example), if Steve is in Groups A and B, not only do you have to grant steve the access he needs, but you also need to grant the groups he is a member of to a minimum of read only to get access to the share.
I guess if Marnie is not granted any access, even though her groups have access to the share she won’t be able to get to it, so my concern about access to a share that she shouldn’t have access to appears moot.
However, the administrative and nightmarish task of determining every group that a user is a member of to grant a minimum of read-only is a daunting task, especially if you are conforming to group based access roles for each folder (required by some standards). Not only that, but you also have to find all nested groups that the user could be a member of as well.
Again, as this is going in my homelab, not a big deal. But I’ve worked for organizations where user group memberships are in the dozens.
In the code, I found the section where it builds the SMB config file, it says that that part is there to support legacy environments. I am curious as to what legacy environment would require such an overarching deny first ask questions later type of access that would cause this much administrative overhead
Even though it’s not QUITE as bad as I perceived at the time I wrote my original post, the concept of how these permissions are managed STILL needs to be overhauled.
I mean, even just the UI kinda ■■■■■, I can’t even see the first couple of characters of my domain group names because of how tiny the area is where i select my groups, I have to hover just to see it. Users are the same way. The reality is the whole SMB/Share experience needs to be overhauled
Also, while I’m ranting. WHY IS THERE A SHARE I CAN’T DELETE?!?!
Thanks
/rant
