Finder ignoring OD permissions

Hi all,
I am having weird permissions anomalies where the Finder reports one thing but allows another.  This is limited to our xSan volume, which has been rebuilt twice but the problem remains.
If we take a folder, called 'boris' for example, and set its permissions in WGM to;
Owner - Diradmin R&W
Group - project R&W
Everyone - NA
A user who is a member of the 'project' group should have full R&W to the folder 'boris', and in the finder you can open the folder and write files to within.  However if you try to set this folder as a FCP scratch disk, you are informed that this folder is write protected, as FCP checks the POSIX permissions when setting scratch disks.  'Get Info' confirms that "You Have - No Access" even though it reports the correct owner and group permissions.  Yet as mentioned previously I could copy a file into it or rename something within the Finder as if I had full R&W.
The only way to get it to work is to either set the ownership of the folder to the user, or set 'Everyone - R&W', neither of which is ideal.  The really strange thing is that sometimes it is a problem, sometimes not.  I could create 2 new folders (each with thier own group) at the same time, one might work the other might not!
So far I have tried:
• Rebuilding xsan volume
• Upgrading OS version
• Rebinding clients
• Rebuilding clients
• Rebuilding users / groups / folders
• Problems is constant accross intel and PPC clients
• Promoted the ODM to a MDC (temporarily as a test) to test if there was a problem with MDC binding.
Any ideas?
Tim

Leif Carlsson wrote:
Users are using OD network accounts/portable accounts (to get unique "local" UIDs) - it's automatic when "bound"?
All users are from OD, no local users.
"FCP checks the POSIX permissions when setting scratch disks"
I guess this is correct (it's a "local volume" to all Xsan participating computers). The "use ACLs" on the Xsan volume when setting it up - could it matter here?
No ACLs activated on volume.
When sharing a volume over a network (AFP/SMB) you either use the default "use ACL's on this volume" or use the "Panther" "inherit permissions".
(Thinking aloud here: The WGM is used to set "local" permissions for Xsan participants on the Xsan volume. The OD user/group membership and the OD master is involved how? The metadata controller and the OD master should be running on different machines: which computer/service is allowing access to files/folders?)
Metadata controller bound to the ODM. So during a read/write to the xsan the cleint sends the request to the MDC along with the UID, as the MDC is bound it is aware of the permissions structure.

Similar Messages

  • Finder ignores CIFS/SMB permissions if under 777.

    I've seen alot of talk of this over the last year, but no real solutions.
    In finder, if I do  go->Connect to server   do:  CIFS://server/home/user/  it prompts me for a username/password which is readily accepts and then connects to the share.  However when finder comes up it gives me 'The folder "user" can't be opened because you don't have permission to see its contents."
    If I pull open terminal.app I can do a cd /Volumes/server/home/user/  and a directory listing just fine.  The default permissions (in the unix world) is 711.   If I change it to 777 finder becomes happy.  However, this really isn't a valid solution as it breaks other things.
    The NAS in question is an EMC VNX, and as far as one can tell we're patched up beyond the "July" issue where Lion crashes the data movers.
    This is seriously feeling like a failure of Finder to handle permissions right.  What else can I verify to ensure it isn't a finder issue?

    I think it's a bigger problem than you suggest. I have 2 buffalo NAS boxes here, a NetGEAR ReadyNAS NV+ and a Windows 2008 server. I can connect to everything - except the 2k8 machine's share. It shows up in the shared places list, it attempts to connect: I've turned off the Group Policy requirement for encrypted passwords on the 2k8 server, which is what allowed Leopard to connect to it, originally - but SL won't complete the connection.
    This is especially weird, since the Buffalos and the ReadyNAS all use Active Directory user authentication for the connections made to them by the SL machine... I'm amazed nobody is reporting this yet (that I can find in the forum, at least).
    Anyone with any idea what's gotta be hacked, please post here!

  • AD ignoring PoSiXGroup Permissions set on 10.4.11 Server

    I have an Xserve running 10.4.11 which is joined to AD and uses the AD's kerberos for authentication / single sign-on. The file shares are hosted on a RAID volume connected to the Xserve. Groups are created in OD and populated with the AD users.
    Problem i have is as follows. Around a week ago, AFP seemed to screw up and freeze the Xserve. End result was an attempted restart which locked, forced shut down and cold boot.
    Since then, kerberos just seems to ignore any Group permissions that are set. Tried unbinding / rebinding server, deleting group, creating groups and shares from scratch, overwriting Kerberos config, checked that services are pointed to the right place etc.
    Any suggestions?

    Oops, wrong place - can a moderator please move? Ta

  • Windows 7 ignores file permissions for shared 10.5.8 folder

    I set up a shared folder on my Mac using SMB. I also set up an account with limited privileges (read only) for accessing it. The problem is that, while the Windows 7 computer needs the account password to access the folder, once it's accessed the file permissions are completely ignored, permitting to user to change and delete files at will.
    Any ideas on how to keep the folder Read-Only?

    When you enter the account's password, you are logging in to the Mac as that user, which is why everything is coming up as read + write.
    This article indicates that you have to provide the account name and password for SMB sharing:
    http://docs.info.apple.com/article.html?path=Mac/10.5/en/8201.html
    There's a special forum for Windows compatibility; you might want to search and/or post in there:
    http://discussions.apple.com/forum.jspa?forumID=687

  • Finding Permutations using perms in MathScript throws Memory is full error

    I'm using the perms Mathscript function to find possible permutations of single digit numbers in an array.  According to the perms function help it will accept 15 elements or fewer.  I can feed this function up to 9 elements but when I try 10 I get the error - LabVIEW:  Memory is full.  I've increased the Virtual Memory per the suggestion in the Why do I get "Memory is Full" Error KB. 
    The error occurs when Windows Task manager reaches 628 M no matter what I change my Virtual Memory to.  I do have 2 GB of RAM in my computer.  Any suggestions?
    Thanks,
    Message Edited by CactusCoder on 11-14-2008 11:02 PM
    Message Edited by CactusCoder on 11-14-2008 11:04 PM
    Solved!
    Go to Solution.
    Attachments:
    pirm.vi ‏16 KB

    This is expected. With N=10, the final matrix will be 10!x10, or about 36Million elements of DBL. Each contains 8 bytes, bringing the footprint to ~290MB for a single copy of the expected output matrix.
    Looking at the memory use of the VI for N=9, it is already 100MB, so it looks like there are about 4 copies of the final array in memory. No wonder N=10 is impossible.
    I would recommend to implements this in plain LabVIEW (wires and loops) with a U8 datatype, you'll probably be able to go higher than 9.
    Don't forget that 15 is unrealistic, because the array dimensions are I32, but the array size will be N!. This means you don't have enough rows for e.g. N>12 anyway.
    Do you have a good reason that you need such huge arrays?
    LabVIEW Champion . Do more with less code and in less time .

  • Easier way to find shared mailbox permissions

    I'm wondering if there's a way to query for what I will call the reverse record for auto-mapping. Outlook dynamically adds shared mailboxes that the user has permission to. Is Outlook brute force searching though all objects looking for permission, or is
    there a PowerShell command that I can use to find them quickly.
    Something like:
    get-AutoMappedMailboxes -user [email protected]
    and it would return the list of mailboxes the user has permissions to:
    sales
    accounting
    etc
    This would be a cool feature, if not already there!

    Hi,
    In addition to Ed's suggestion, I would like to clarify the following thing:
    If you want to prevent auto-mapping, you need to add -AutoMapping:$false to the Add-MailboxPermission command. If access has already been granted you should first remove it. Then run Add-MailboxPermission again with auto-mapping disabled.
    Hope this can be helpful to you.
    Best regards,
    If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Amy Wang
    TechNet Community Support

  • Can't see external HD partition on finder, changed Ownership & Permissions

    Hi all, a friend has a particular issue with his external HD. He clicked one of the partitions on his external HD and started restricting the options under Ownership & Permissions, until he got ALL permissions set to "no access". Now the HD appears, but the partition he modified does not appear on his desktop or finder, also when he runs Disk Utility he sees both partitions, but the one he changed the permissions/access of, appears as a blank document icon, like when the OS doesn't know with what to open it with, therefore, he can't select it again and click get info/change access again. Any help, tips please? Thanks in advance mates.
    MacBook Pro 15", 1.83 GHz, 1.5 GB, 80 GB iPod 5G 30GB White   Mac OS X (10.4.6)  

    Use the instructions in this FAQ to restore access to that partition.
    (12892)

  • Ignoring Disk Permissions (Back Up Internal)

    I just did a re-install of my entire system, however I can't really do anything with my files because they are all using old permissions. Isn't there a way to change all the permissions real easy, or ignore the entire disk's permissions?

    You can't just ignore the entire disk's permissions.
    And changing your permissions wholesale is not a good idea.
    The question is, what method did you backup before you reinstalled your system?
    What Mac model did you reinstall on?
    http://www.macmaps.com/backup.html
    shows that had you backed up via a clone, and have a Firewire bootable Mac, you could have simply used the migration assistant after erase and install to reimport your data without having to worry about permissions. If that's not what you did, you may want to look over this article:
    http://docs.info.apple.com/article.html?artnum=106712

  • Finder Airport Flaw & Permissions

    Files that are locked and permissions to only read changed, can be edited if the files is sent to another machine via finder's airport.
    Also I can then out of some wierd reason edi a file, to which I only have "read" permissions.
    Anyone know why?

    so why are all permissions the same if it's a copy made with external hard drive, but not via airport?
    I think you mean AirDrop. I would just be making up an answer, but since AirDrop is intended to make it easy to transfer files from one person's Mac to another's, it would make sense for the permissions of the copied files to be what the recipient expects.
    when I for example use BatChmode the permissions are all set to read, yet i can still edit them with no password required.
    Please create a test file on your Desktop using TextEdit. Close the file, then open the Finder Info window and set your permissions to "Read only." Can you still edit the file in TextEdit?

  • Finder ignores Resume turn-off options?

    Even disabling Resume in Prefs > General and unchecking the 'Reopen windows' option in the Login window, Lion still starts up with any Finder windows left open at shutdown reopened. Two questions:
    Are others finding this?
    Is there a 'write defaults' type command or other I can slip into Terminal to ensure nothing at all opens on startup?
    For the life of me, I can't imagine what Apple were thinking with this OS.

    Thanks for your suggestions. Those two articles suggest, respectively, using the following commands in Terminal:
    From OS X Daily:
    defaults write com.apple.finder NSQuitAlwaysKeepWindows -bool false
    and
    From MacWorld:
    defaults write com.apple.finder ApplePersistenceIgnoreState Yes
    I can confirm the first one categorically does not work. I tried it earlier, twice. I'm currently in Snow Leopard so can't test the second one right now. However, I'm pretty sure I played around with ApplePersistenceIgnoreState command a few weeks ago and found that it didn't work either.
    In any case, I'll test it again when I boot back into Lion later today and report back.

  • Coldfusion ignoring NTFS permissions

    I have seen a few older posts that have presented this same issue, but there was no resolution in the thread.  I have posted on those threads asking if they found a solution, however thought I would present the issue myself and hopefully someone has a fix/workaround.
    CF10, W2008R2, IIS 7.5. Using a group with NTFS permissions and trying to limit the access to the pages.  Anyone can view the page if putting in a username and password in the Windows security popup, click ok and immediately prompted again, click cancel and you can see the page contents.  Tested with an html page and html page is blocked properly.  It is my understanding that IIS passes the control to cf, cf diplays the cfm page. 
    Since this is IIS 7.5, the checkbox for check if file exists that was working in IIS6 isn't there any longer, it is now items under Handler Mappings.  I saw in one thread dscussion about editing a wildcard mapping, but it was vague, and didn't have the settings I need to fix this, or I did not understand based on what I see on our server.  I have set the .cfmHandler to "file" , and that did not work. I do not see a wildcard handler in the name column, however there are * in the path column, so it wasn't clear what really is the magic wildcard mapping I am looking for.
    I cannot believe this issue has existed since IIS7, and there is no clear guidance on the topic. Someone has to have figured it out... bypassing NTFS permissions and not being able to restrict access to a group is not a small issue, in my opinion anyway. I have searched all over the place, hopefully someone here knows what the magic answer is...
    Thanks!
    Tanya

    Tanya,
    This may not be what you want to hear, but I don't think you can get CF to play by NTFS rules with IIS 7+.  Since IIS hands off processing to .cfm/.cfc files to ColdFusion, it can't enforce NTFS permissions.  I think CF developers typically rely on a security system within their ColdFusion application to determine who can access which .cfm files or folders.  So programatically you check the credentials of the user and determine if they are supposed to be able to access a particular .cfm file, and redirect them if they are not.  Some use the <cflogin> features of ColdFusion; others roll their own.
    I could be completely off about this, though.  Do you use Application.cfc in your apps, or Application.cfm?  That may have a bearing as well.
    -Carl V.

  • [4.0]Find ignores leading space

    How to reproduce:
    Open a package
    Ctrl/F
    type " ack" (note leading space)
    Result: the word package is highlighted.
    OS X 10.9.1
    SQLDev 4.0.0.13.80
    Java 1.7.0_45
    Regards.
    Alessandro

    Seems fixed in 4.0.1.
    Thanks.
    Alessandro

  • Repair permissions keeps finding problems

    2007 MacBook 2.16
    OS 10.6.8
    New Hard drive
    Just replaced my hard drive b/c my old one was having serious problems (spinning beachball with every move or click) and it was failing SMART.  My Admin user on the failing HD worked fine, but my primary user account was unusable. 
    After swapping HDs, I installed a fresh copy of 10.6 then moved my user and applications from the failing drive to my new drive.  All is working much better but there still seem to be some quirks, so I thought I'd repair permissions as a first step.  Seemed like a reasonable thing to do given the problems I was experiencing.  But when I run it, I keep getting something like 18 or 20 problems that are, in theory, "repaired."  I've copied and pasted into TextEdit to look through for duplicate issues (i.e. repair permissions finding and repairing the same mistake each time) and for a while found no duplicate entries.  Now it's finding the same issues each pass.
    I've run repair permissions at least 10 times now, probably closer to 20, with issues found each time.  Is this normal, and should I ever hope to see the issues repaired with only one or two warnings or issues?  It used to have to modify a few permissions just to run so it would never run without at least one or two problems, but I never get to that stage.
    Again, what might be going on here, and can/should I at some point give up and hope all is well?
    Thanks!

    For a little more on this:
    I've read this:  http://support.apple.com/kb/ts1448
    Seems like I may now be getting similar permissions problems that can perhaps be ignored, but mine are all related to System/Library/CoreServices/RemoteManagement.  My specific permissions issues aren't in the list in this link. 
    Here's an example:
    Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .
    Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib".
    I also am getting one SUID warning related to System/Library/CoreServices/RemoteManagement/ each time I run it.
    As I said above, it now seems to be finding the same permissions problems each pass.
    Thanks again!

  • Firefox's pdf.js completely ignores PDF document permissions.

    Firefox's new JavaScript PDF Viewer pdf.js is really a disaster.
    It completely ignores PDF document permissions set by Acrobat Professional and so on.
    With Firefox's pdf.js people can freely print any PDF and copy the texts and images.
    This was reported as a bug in bugzilla@mozilla but it seems that it is going to be fixed soon.
    Bug 792816 - pdf.js doesn't respect document permissions
    https://bugzilla.mozilla.org/show_bug.cgi?id=792816
    Bug 845302 - Firefox 19.0 pdf viewer ignores pdf encryption
    https://bugzilla.mozilla.org/show_bug.cgi?id=845302
    Does nobody in Adobe voice one's disagreement about this?

    This isn't a new issue - most of the third-party PDF reading applications have been ignoring the permissions headers in a PDF for years, and some claim it's perfectly valid for a user to be able to override password-based restrictions on copying/printing under 'fair use'. Adobe disagrees, as do I, but the nature of the PDF document structure means that it's trivial for any application to ignore those restrictions. You certainly don't need the password. Acrobat warns you the first time you use the Protection tools that  Adobe always respects the permissions you set even if other vendors choose not to.
    As has been said many times; the only way to truly secure the content of a PDF file against printing or copying is to use LiveCycle digital rights management, as that forces the PDF to be opened in Adobe software and nothing else. If you cannot afford LCDRM, you have to accept that your 'secured' PDFs are anything but.

  • Permissions Repair keeps finding the same problems

    I am finding that the Permissions Repair, while it informs me that it has repaired permissions on my Intel-powered 24-inch iMac, is not in fact doing so. It keeps finding the same errors. What is going on?

    "In general", we shouldn't worry too much about what repair permissions finds. But, your case is a little odd, in that it finds the same thing each time. Yes, subsequent repair permissions "should" be nada...nothing found. Try running Repair Disk and see if that helps. (run Repair Disk from an OS Install or recovery disk; or from another volume containing OS X)
    HTH

Maybe you are looking for