Enable Windows permission support for CSG - Cloud Storage Gateway

You can enable Windows permission support for Cloud Storage Gateway (CSG). When this feature is enabled for an SMB file share, you can use access-based enumeration (ABE) to control which files and folders are visible to users. This topic describes how to enable the Windows permission support feature.

Prerequisites

A file gateway is created, and a cache disk is attached to it. For more information, see Manage file gateways and Add a cache.
An OSS bucket is created. For more information, see Get started by using the OSS console.
You have configured AD/DNS.

Background information

In a Windows file system, files and folders are visible to users by default, even if the users do not have permissions to access them. After you enable Windows permission support for CSG, you can enable access-based enumeration (ABE) for shared directories that are mounted to clients. ABE ensures that users can view only the files and folders for which they have access permissions.

Usage notes

Note the following when using the Windows permission support feature:

When Windows permission support is enabled, file and folder permissions are stored in the metadata of their corresponding OSS objects.
OSS object metadata has a size limit. Setting too many access control entries can cause errors.
Configure no more than 10 access control entries for each file or folder.
By default, the root directory of an SMB file share grants full access to everyone. Do not change the permissions of the root directory. Instead, set permissions on the top-level folders within the root directory. Permissions for the root directory are stored only on the local file gateway and are not saved to the metadata of OSS objects.

Procedure

Note

You can enable Windows permission support only when you create a share.

In the CSG console, go to the gateways page and click the target file gateway. Then, on the Shares.
On the Create Share page, configure the share settings.

In the Basic Information section, complete the basic information settings, select SMB as the protocol, and then configure the following parameters.

Parameter	Description
Windows Permission Support	Select Yes to enable Windows permission support. Note This parameter is available only when the protocol is set to SMB. To enable Windows permission support, the file gateway must be joined to an AD domain.
Access-based Enumeration	Select Yes to enable access-based enumeration. When enabled, users can only see the files and folders for which they have access permissions. Note This parameter is available only if Windows Permission Support is enabled.

After you create the share, you can click the + icon to the left of the share name on the shares tab to check whether Windows Permission Support and Access-based Enumeration are enabled.

Use Windows permission support to implement access-based enumeration (ABE).