ACL - Inheritance of settings

Hello
I'm trying to configure my acl on a directory. I set it up for a group to have rwx settings. Then with user 1 I make a folder. the owner is the user the group is inheritted of the parent folder. On the parent folder acl is set.
How can I stop having to execute setfacl on the new directory?

u can use umask to set settings for user permission, also, the execute permission for a directory means that it is traversable, without it you wont be able to enter the directory.

Similar Messages

ACL Inheritance Problem

Hi all,
I want to assign permissions to a folder/document programatically after creating it.But i don't want to inherit the permission from the parent.
For example, take the hierarchy:-
Folder_1
    Folder_11
    Folder_12
    Folder_13
If Folder_11 is first sub-folder to be created programatically, then the permission for Folder_11 share the same ACL for the Folder_1 i.e. parent folder. The permisssion inheritance is not broken even if child folder(Folder_11) ACL are modified.
My code is somewhat like this.
ResourceContext context = null;
context = new ResourceContext(loggedOnUser);
RID aRid = RID.getRID(folderName);
IResource resource =
          ResourceFactory.getInstance().getResource(aRid, context);
ISecurityManager sm =
     resource.getRepositoryManager().getSecurityManager(resource);
IResourceAcl ra;
if (sm != null && sm instanceof IAclSecurityManager) {
     IAclSecurityManager asm = (IAclSecurityManager) sm;
     IResourceAclManager ram = asm.getAclManager();
ram.removeAcl(resource);
     ra = ram.getAcl(resource);
     if (ra == null) {
          ra = ram.createAcl(resource);
IUMPrincipal user =WPUMFactory.getUserFactory().getUser("testuser");
IResourceAclEntry readUsr =ram.createAclEntry(user,false,ram.getPermission(IAclPermission.ACL_PERMISSION_READ),0);
flag = ra.addEntry(readUsr);

Even if I was sceptic about this kind of solution, I gave it a chance on yesterday evening, but the final result is still the same. First two attempts (unbind ports from ACL, add a MAC to ACL, bind ports back to ACL) were fine, but on the third one (bind ports back to ACL a save settings) I got the same error message as before. There's no chance to bind ports back to ACL now, so I have to reset the switch again in the evening.

ACL Inheritance in DMS

Hello DMS experts,
Scenario:
Folder 1(Created by ABC user)---XYZ user is not authorized (by creating ACL in folder with NoAutho as activity for XYZ )
Document 1(Created by ABC user)--A new document checked into this Folder1.
Issue:
According to inheritance, this document is suppose to carry the ACL authorization from Folder 1, but currently unless we create the ACL manually (By navigating to Authorization tab in the document properties, and clicking on "Create Admin Authorization")these inheritance is not copied to the document automatically. If this is standard SAP behavior, then what is the use of Inheritance?. (Registry key AutoInheritedAuth=1 maintained)
It is practically not possible to manually create these ACL for all sub folders and documents when they are created.
Need your suggestion/clarification on this....

Hello Deepak,
Option 1:
My question is related only to Inheritance of ACL authorization and lets assume that PFCG objects are in line with it.
Option 2:
Lets say, I have Folder1 with 10 documents inside, I have not assigned ACO_SUPER for ABCD user and ACL is created for Folder1 with "NoAutho" to ABCD user to this folder. ABCD user is authorized to access this Folder1 and its documents as per the PFCG objects.(Hence, my requirement is, according to PFCG roles the user is authorized for relevant document types and objects but i want to restrict the user only to certain folder and its documents using ACL)
1. What is the need of assigning superior document, when the definition of inheritance itself says that properties of superior folder is copied to child items?
2. Those 10 documents are visible to ABCD user or not?.
*Currently only the folder is not displayed to user, wherein if the user searches the documents, it is visible. If we manually create ACL in the properties of each of these documents, then it copies the ACL (from inheritance) and stops displaying to user even in search (which is desired). Hence, the only issue here is, copying of inheritance ACL automatically.

DFS ACL Inheritance issue

We have an interesting problem for the forums. We have implemented Distributed File Services for managing our shares.
SecurityGroupA has similar ACL assignments to FolderA and FolderB.
SecurityGroupB has limited ACL assignments to FolderB.
When a member of SecurityGroupA moves a file from FolderA to FolderB, the file does not not inherit from FolderB. We believe the issue is the DFS link gets redirected, but since the file's physical location doesn't actually move so no ACL changes happen
and SecurityGroupB cannot see the file.
If we break folder inheritance, then reapply inheritance to all child objects, this "fixes" ACL assignments and SecurityGroupB can see the file.
One process I am considering is enabling file auditing and using event log "file creation" to trigger an ACL refresh script. That's about as far as I have got to developing the process, though.
Has anybody with DFS implementations run into this? If so, how did you address the ACL refresh?
Thanks,
CS

Hi,
I'm a little unclear about the structure but it should be the default behaviour of NTFS permission. Please see this article:
http://support.microsoft.com/kb/310316
Also it provided steps to change the NTFS permission behaviour.
Meanwhile if both folders are located in same volume, maybe you can workaround this with putting one of them to another volume so permission will be refreshed by a move.
If you have any feedback on our support, please send to [email protected]

ZFS ACL Inheritance

Hi All,
On our proxy server, I would like to have access granted to our monitoring software userid to any log file created. The proxy server rotates its logs once per day, by appending the date and time to the rotated log file.
It appears, from the ZFS Administration guide, that I can do this by setting an ACE in the ACL of the log directory using the file_inherit inheritance flag. However, I cannot seem to make this function correctly.
For my logs directory, I did the following:
chmod A+user:patrold:read_data/execute:file_inherit:allow logs
This results in the following ACL for the logs directory:
root@testpxyt1# ls -ldv logs
drwxr-xr-x+ 2 webservd webservd 29 Mar 29 02:00 logs
0:user:patrold:read_data/execute:file_inherit:allow
1:owner@::deny
2:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
/append_data/write_xattr/execute/write_attributes/write_acl
/write_owner:allow
3:group@:add_file/write_data/add_subdirectory/append_data:deny
4:group@:list_directory/read_data/execute:allow
5:everyone@:add_file/write_data/add_subdirectory/append_data/write_xattr
/write_attributes/write_acl/write_owner:deny
6:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
/read_acl/synchronize:allow
However, when I look at the ACL for a newly created log file, I see this ACL:
root@testpxyt1# ls -lv access.201003290000
-rw-------+ 1 webservd webservd 396686 Mar 29 00:00 access.201003290000
0:user:patrold:read_data/execute:deny
1:user:patrold:read_data/execute:allow
2:owner@:execute:deny
3:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
4:group@:read_data/write_data/append_data/execute:deny
5:group@::allow
6:everyone@:read_data/write_data/append_data/write_xattr/execute
/write_attributes/write_acl/write_owner:deny
7:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
Somehow, the account patrold account is first denied access and then allowed access. Unfortunately this seems to result in a deny, as the ID is unable to read the file.
Did I misunderstand the way that this is supposed to work, or have I implemented it incorrectly?
Thanks,
Chris

Thanks, that is exactly what it was.
Once I set the aclmode to passthrough, the permissions were set correctly.
Thanks again!

ACL inheritance

A short description of our filesharing system:
We have five Macs, all with 10.5.1. We got no central server to store the files because all the macs are portables and often they are on the go and need the data on their own harddrive. But we also have to do file-sharing when we are at the office. For that, every user has an account on every mac. But only on his own mac he got a folder in his home directory which is called "Office (user1)" and there are all his documents stored. On the macs are also some users which aren't from the office, so they won't have access to the office folder. There exists a group called "ouroffice" and all the office-users belong to this group. All those should be able to make everything inside the office folders of the others. They should be able to create files, delete file etc. But when they have created a file, the others should be still able to make everything with the file.
To manage that, I thought ACL would be something great. I created for the office folders the following ACL:
+drwxrwx--- 18 silu ouroffice 612 5 Jan 15:26 Office (silu)+
+0: group:ouroffice inherited allow list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,writeextattr ,readsecurity,writesecurity,chown,file_inherit,directoryinherit+
+1: group:everyone inherited deny list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,writeextattr ,readsecurity,writesecurity,chown,file_inherit,directoryinherit+
When I create a new folder or copy a file to the "Office (silu)" folder, then all ACL are also on the new folder/file. But when I move a file or create a file (e.g. with Word), then no ACL are defined for this file. Why are ACL only inherited to copied files and not to created oder moved files? And how I could solve this problem?

<BLOCKQUOTE>quote:<HR>Originally posted by Vijay(Oracle):
Are you asking that whenever a document is added to a folder,
should the Folder's ACL become Document's ACL ?
- This is not good scheme. That is because, what will happen
if the document is multiply linked ? What will be the ACL
of the document ? If your iFS instance is guaranteed
to not have links, then you can customize by using server
side override.
A better approach would be to make the user's folders
have Published ACL and have a common folder for
sharing documents.
Thanks,
Vijay
<HR></BLOCKQUOTE>
Thanks for your reply. I'm just fearing that you didn't get my point correctly.
I am not asking that the Document should get the Folder ACL. But the Document should get an ACL which is the concantenation of the Document and Folder ACL.
Multiply linked Documents are a problem. My Environment certainly makes heavy use of multiple links. Is there a way to have different ACLs for the same Document in different Folders ?
The aim is to share Files. But not via a single Folder.
Users should contribute files to a collection of files. Then a special group of collection administrators need to sort these files into the collection. They are allowed to read the files of the users but are unable to delete or move them unless I give them administration privilege which I certainly do not want.
So I've got 2 groups of users (or 2 users for simplicity). User 1 puts something in a folder owned by user 2. User 2 is unable to move or delete the Document of user 1 out of this folder.
On a Unix filesystem I would set the SetGID-Bit on the folders an create a special group for user 2. I'm unable to do this in iFS. And I'm looking for to achieve the same result in iFS.
Hope. It got clearer now.
Regards,
Jens
null

JWS not Inheriting PROXY settings from Netscape

Hi!
We are using JWS 1.0.1_01 to launch our application, which needs the proxy settings of the user to connect via SSL to our servers.
We do not have any problems when the user does not use proxies to access the Internet or uses Internet Explorer as their default browser.
For users with Netscape 4.* as their default browsers, many users are not able to launch our application, as it can not find the proxy settings.
They can not download the sample applications of Java Web Start either.
They work fine if they make Internet Explore as their default browser or set the proxy manually in Java Web Start.
As our customers use some sort of scripts for proxy configurations we do not want to set the proxy manually in Java Web Start.
We want to use the proxy settings of the browser.
So I want to know if there is a known issue with Java Web Start not detecting the proxies automatically from Netscape.
Any help appreciated.
Thanks
-Nawaz

Basically web start can only pick up the settings of whatever
happens to be the current Windows default browser. If that's Netscape then the Netscape settings will be used.
Since your clients are using a script to specify the proxy settings you should also be aware that there's an issue with web start 1.0_01 where it locates the proxy setting based on the first occurrence of the word "Proxy" in that script. This can cause issues if the first proxy
listed is for https only of even if the first occurrence of "proxy" is
inside a comment.

ACL Inheritancy

I've read some messages, but still not understanding a solution.
I have a directory where I drop documents into. Can be one at a time or 20 or so at a time using FTP / Windows mapped drive.
Because there are more than one user who have access to place documents into this directory, others only read. I want to be able to initially apply a specific ACL (the diretory ACL) to all objects in this directory automatically when the object is uploaded.
This is so that upload users don't have to go to each object and change the ACL everytime. At the present the only way I can do this is by setting the default ACL for the user to the ACL assigned of the directory.
Is there a way, and how to set this up?
It seems that the Home directory area is set up this way. When any object is uploaded into the home directory it picks up the private ACL and not the default for the user, can this be extended to other directories..?
Cheers
Andy

Hello, Andrew:
The behavior you're describing is what we are calling "ACL Scalability," and is one of the new features of 9iFS version 9.0.2,
our next release.
Currently, you have the option to do as you've said, and set the User's default ACL to match the folder where the document is stored.
This would only make sense, though, if this were the user's primary task in working with 9iFS. You also have the option of creating a
custom parser that could set the ACL for the document based on your business logic as the file is inserted to 9iFS.
I hope this helps,
Dennis Dawson

WebApp not inheriting Safari Settings

I have a simple web app that launches Safari (full screen mode) calling a website (let's call it website A) containing another website (website B) in an iframe. Website B uses cookies. When i launch the app, and the window opens, website B fails because the cookies aren't being set. Looks like Website B is considered a third party website because its contained within an iframe.
If i call website A outside the web app, both websites work fine.
I found that enabling the Safari cookies option to always allow third party cookies determines whether website B works in Safari, but it has no bearing on it when i call it from the web app.
Why doesn't the web app inherit the safari settings? Is there any workaround or setting that i've missed?
Device: IPAD with ios8
Thanks in advance.

Basically web start can only pick up the settings of whatever
happens to be the current Windows default browser. If that's Netscape then the Netscape settings will be used.
Since your clients are using a script to specify the proxy settings you should also be aware that there's an issue with web start 1.0_01 where it locates the proxy setting based on the first occurrence of the word "Proxy" in that script. This can cause issues if the first proxy
listed is for https only of even if the first occurrence of "proxy" is
inside a comment.

Possible to automatize the creation of ACL and subfolders in KM ?

Hi,
I would like to create following folder structure
/root
 /subfolder elec/
 /subfolder user1/
 /subfolder user2/
 /subfolder documents/
 /subfolder LMS/
Subfolder user 1 : only user1 may have autorisations to this folder.
Subfolerd user 2 : only user2 may have autorisations to this folder
I can manage this autorisations by creating an ACL map -> details -> settings -> permissions
This is a good solution if therer were only a few subfolders to manage but I have to create +/- 9000 subfolders, for every user his own subfolder.
Does anybody knows if you there is a possibility to automatize the creation of those ACL and also the creation of the subfolder ?
Kind regards
Pascale Thys

Hi Pascale!
Here is a static method to create directories and provide them with permissions. It takes a resource residing in a directory called and creates new sub dirs for every iso language in the array languages. Then it copies the source resource into those new sub dirs.
It has everything you need to know about creation of dirs and files in km via API. Just adapt it to your needs.
 private static void createLanguages(
 IResource resource,
 String[] languages)
 throws ResourceException, WcmException {
 // iterate through languages and create copies of the original document
 // pattern is "com.xxx.<foldername><n>_<language id> with n >= 0
 // Folder of newly created document
 ICollection sourceDir = resource.getParentCollection();
 RID sourceDirRID = sourceDir.getRID();
 // Name (plus extension) of document
 RID resourceRIDName = resource.getRID().name();
 // Name of parent folder
 RID sourceDirRIDName = sourceDirRID.name();
 // source directory of new resource without language shortcut
 String sourceDirRIDNameBase =
 sourceDirRIDName.toString().substring(
 0,
 sourceDirRIDName.toString().length() - 2);
 ICopyParameter copyParams = new CopyParameter();
 RID destination = null;
 for (int i = 0; i < languages.length; i++) {
 String newDir = sourceDirRIDNameBase + languages;
 destination =
 sourceDirRID.parent().addPathSegment(
 sourceDirRIDNameBase + languages);
 // Create language dependend directory parallel to original, if not existing
 ICollection newCollection = null;
 try {
 newCollection =
 sourceDir.getParentCollection().createCollection(
 newDir,
 null);
 } catch (NameAlreadyExistsException e) {
 logger.info(
 "directory "
 + newDir
 + " already exists.");
 // Even if directory exists, add permissions
 try {
 if (newCollection == null) {
 IResourceFactory resourceFactory =
 ResourceFactory.getInstance();
 newCollection =
 (ICollection) resourceFactory.getResource(
 destination,
 sourceDir.getParentCollection().getContext());
 newCollection.setProperty(
 Property.createDisplaynameProp(
 destination.name().toString()));
 // Setting ACLs on newly created directory
 ISecurityManager sm =
 newCollection.getRepositoryManager().getSecurityManager(
 newCollection);
 if (sm != null && sm instanceof IAclSecurityManager) {
 IAclSecurityManager asm = (IAclSecurityManager) sm;
 IResourceAclManager ram = asm.getAclManager();
 // Inheritance has to be broken to include new permissions
 // Get a copy parent ACL
 IResourceAcl ra = ram.getAcl(newCollection);
 if (ra == null) {
 ra = ram.getInheritedAcl(newCollection);
 // Still no acl found? Permissions cannot be set
 if (ra == null) {
 logger.severe(
 " - no ACL found for "
 + newCollection
 + " no permission has been set!");
 } else {
 // Remove old ACL
 ram.removeAcl(newCollection);
 // create new ACL for current directory
 IResourceAcl raNew = ram.createAcl(newCollection);
 // Copy all acl entries from inherited acl to new acl
 IResourceAclEntryList rel = ra.getEntries();
 IResourceAclEntryListIterator it = rel.iterator();
 IResourceAclEntry aclEntry = null;
 while (it.hasNext()) {
 aclEntry = it.next();
 raNew.addEntry(aclEntry);
 IUMPrincipal allCountriesPrincipal =
 WPUMFactory.getGroupFactory().getGroup(
 "XXX_EDITOR_"
 + "ALL");
 // Editor for specific country
 IUMPrincipal thisCountryPrincipal =
 WPUMFactory.getGroupFactory().getGroup(
 "XXX_EDITOR_"
 + languages.toUpperCase());
 raNew.addEntry(
 ram.createAclEntry(
 allCountriesPrincipal,
 false,
 ram.getPermission(
 IAclPermission.ACL_PERMISSION_READ),
 0));
 raNew.addEntry(
 ram.createAclEntry(
 thisCountryPrincipal,
 false,
 ram.getPermission(
 IAclPermission.ACL_PERMISSION_READWRITE),
 0));
 // Now copy permission owners
 IUMPrincipalList permissionOwners = ra.getOwners();
 IUMPrincipalListIterator permissionOwnersIt = permissionOwners.iterator();
 IUMPrincipal principal = null;
 while (permissionOwnersIt.hasNext()) {
 principal = permissionOwnersIt.next();
 raNew.addOwner(principal);
 } catch (AclPersistenceException e) {
 logger.severe(
 "I raised an AclPersistenceException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 } catch (ResourceException e) {
 logger.severe(
 "I raised a ResourceException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 } catch (NotAuthorizedException e) {
 logger.severe(
 "I raised a NotAuthorizedException @"
 + (new Date()).toString()
 + ": "
 + e.getMessage()
 + "**"
 + LoggingFormatter.extractCallstack(e));
 // } catch (AclExistsException e) {
 // logger.severe(
 // "I raised an AclExistsException @"
 // + (new Date()).toString()
 // + ": "
 // + LoggingFormatter.extractCallstack(e));
 } catch (UserManagementException e) {
 logger.severe(
 "I raised a UserManagementException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 } catch (InvalidClassException e) {
 logger.severe(
 "I raised an InvalidClassException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 } catch (AlreadyAssignedToAclException e) {
 logger.severe(
 "I raised an AlreadyAssignedToAclException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 } catch (PermissionNotSupportedException e) {
 logger.severe(
 "I raised a PermissionNotSupportedException @"
 + (new Date()).toString()
 + ": "
 + LoggingFormatter.extractCallstack(e));
 destination = destination.add(resourceRIDName);
 try {
 IResource newResouce = resource.copy(destination, copyParams);
 } catch (NameAlreadyExistsException e) {
 logger.info("file "
 + destination
 + " already exists.");
Imports needed:
import java.util.Date;
import com.sapportals.portal.prt.logger.ILogger;
import com.sapportals.portal.security.usermanagement.IUMPrincipal;
import com.sapportals.portal.security.usermanagement.UserManagementException;
import com.sapportals.wcm.WcmException;
import com.sapportals.wcm.repository.CopyParameter;
import com.sapportals.wcm.repository.ICollection;
import com.sapportals.wcm.repository.ICopyParameter;
import com.sapportals.wcm.repository.IResource;
import com.sapportals.wcm.repository.IResourceFactory;
import com.sapportals.wcm.repository.NameAlreadyExistsException;
import com.sapportals.wcm.repository.Property;
import com.sapportals.wcm.repository.ResourceException;
import com.sapportals.wcm.repository.ResourceFactory;
import com.sapportals.wcm.repository.manager.IAclSecurityManager;
import com.sapportals.wcm.repository.manager.ISecurityManager;
import com.sapportals.wcm.repository.security.IResourceAcl;
import com.sapportals.wcm.repository.security.IResourceAclEntry;
import com.sapportals.wcm.repository.security.IResourceAclEntryList;
import com.sapportals.wcm.repository.security.IResourceAclEntryListIterator;
import com.sapportals.wcm.repository.security.IResourceAclManager;
import com.sapportals.wcm.util.acl.AclPersistenceException;
import com.sapportals.wcm.util.acl.AlreadyAssignedToAclException;
import com.sapportals.wcm.util.acl.IAclPermission;
import com.sapportals.wcm.util.acl.IUMPrincipalList;
import com.sapportals.wcm.util.acl.IUMPrincipalListIterator;
import com.sapportals.wcm.util.acl.InvalidClassException;
import com.sapportals.wcm.util.acl.NotAuthorizedException;
import com.sapportals.wcm.util.acl.PermissionNotSupportedException;
import com.sapportals.wcm.util.logging.LoggingFormatter;
import com.sapportals.wcm.util.uri.RID;
import com.sapportals.wcm.util.usermanagement.WPUMFactory;
This is my .classpath variable for this projekt (for the necessary JARs):
<?xml version="1.0" encoding="UTF-8"?>
<classpath>
 <classpathentry kind="src" path="src.api"></classpathentry>
 <classpathentry kind="var" path="JRE_LIB" sourcepath="JRE_SRC"></classpathentry>
 <classpathentry kind="src" path="src.core"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/prtapi.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/prttest.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/com.sap.portal.runtime.application.soap_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.tssap.ext.libs.j2ee_1.3.0/lib/activation.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.security_2.0.0/lib/com.sap.security.api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ext.libs.webservices_2.0.0/lib/jaxm-api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.tssap.ext.libs.j2ee_1.3.0/lib/mail.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ext.libs.webservices_2.0.0/lib/saaj-api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.tssap.sap.libs.xmltoolkit_2.0.0/lib/sapxmltoolkit.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.engine.webservices_2.0.0/lib/webservices_lib.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.crt_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/prtapi.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/logging.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.exception_2.0.0/lib/exception.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.common_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/com.sap.security.api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/com.sap.security.api.ep5.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.util.public_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.sf.framework_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.util_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.runtime_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.repository.service.serviceacl_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.mi_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.urlgenerator_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.urimapper_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.rtr_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.relation_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.pipeline_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.oth_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.notificator_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.mime_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.global.service.appproperties_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.rf.framework_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.util.kmmonitor_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.netweaver.bc.uwl.plugin_1.0.0/lib/bc.uwl.service.api_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.tc.ap_2.0.0/comp/CAF/DCs/sap.com/caf/api/_comp/gen/default/public/default/lib/java/sap.com~caf~eu~gp~api~default.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.tc.ap_2.0.0/comp/CAF/DCs/sap.com/caf/api/wd/_comp/gen/default/public/default/lib/java/sap.com~caf~eu~gp~api~wd~default.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/bc.wdf.ui.framework_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.base_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.enum_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.event_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.generic_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.util_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/com.sap.portal.htmlb_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.command_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.base_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.screenflow_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.uicommand_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.util_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/htmlb.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/com.sap.workflow.wcm_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.actioninbox_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.cachecontrol_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.checkout_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.collaboration_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.crawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.efp_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.expimp_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.ice_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.indexmanagement_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.propertyconfig_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.propertystructure_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.quickpoll_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.reporting_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.resourcefilter_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.resourcelistfilter_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.template_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.xcrawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.service.xmlforms_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.acl_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.actioninbox_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.applog_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.cache_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.classification_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.classificationtest_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.collaboration_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.config_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.crawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.crawlerindexmon_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.demo_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.edit_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.collaboration_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.collection_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.component_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.config_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.control_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.detailsoverview_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.detailsproperties_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.expimp_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.property_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.resource_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.flex.uicommand_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.ice_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.indexadmin_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.layout_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.navigation_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.oth_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.quickpoll_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.reporting_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.scheduler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.search_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.security_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.settings_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.statemanagement_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.subscription_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.user_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.websiteimport_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.xcrawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.appl.ui.xmlforms_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.rep.util.rfadapter_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.actioninbox_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.cachecontrol_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.checkout_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.collaboration_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.crawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.efp_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.expimp_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.ice_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.indexmanagement_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.propertyconfig_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.propertystructure_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.quickpoll_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.reporting_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.resourcefilter_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.resourcelistfilter_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.template_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.xcrawler_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.service.xmlforms_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.fields_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.collection_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.control_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.detailsoverview_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.detailsproperties_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.enum_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.layout_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.property_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.readymades_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.flex.resource_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.released_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.ui.search_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/com.sap.portal.usermanagementapi.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/com.sap.security.api.ep5.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/org.eclipse.tomcat_4.0.6.2/servlet.jar"></classpathentry>
 <classpathentry kind="lib" path="dist/PORTAL-INF/lib/commons-lang-2.4.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/km.shared.ui.event_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.portal.runtime.config/lib/bc.cfg_api.jar"></classpathentry>
 <classpathentry kind="var" path="KMC_LIBS/km.appl.ui.flex.control_api.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.km.cm.ui.flex/private/lib/km.appl.ui.flex.control_core.jar"></classpathentry>
 <classpathentry kind="var" path="ECLIPSE_HOME/plugins/com.sap.ep.applicationDevelopment_7.00/libs/km.shared.repository.service.layout_api.jar"></classpathentry>
 <classpathentry kind="output" path="classes.api"></classpathentry>
</classpath>
You probably don't need all of them.
Cheers,
Jürgen

Propagate ACLs

Hi all,
I have a client who is running OS X Server 10.4.9 and has an odd problem with ACLs not fully propagating. We enabled ACLs on the server, rebooted and went about setting ACL permissions on the root of a share point. When propagating, it stopped at about halfway though it seems; meaning that the ACLs show up fine in the "Access" tab and are working on half the folders, but not the other half. There doesn't seem to be anything particularly different about the folder it stops at either.
Hope someone can shed some light on this, thanks!

Depending on what permissions were set before, we used to have problems with propagating NON-ACL (POSIX) permissions (Panther, Tiger) from WGM.
This was probably because the user/admin that was logged in in WGM didn't have the permissions to alter all files/folders from their current settings.
I can't say I have encountered the same problem with ACLs.
If the volume is set to use ACLs (inherited permissions dimmed) I guess you should perhaps first check the volume with a disk tool. You then might have to use CLI tools: chown, chgrp, chmod to set ACLs. I haven't used those myself for setting ACLs since it seems a pain compared to using the WGM. For setting POSIX permission the CLI tools are relatively easy.
Did yoy try changing only ACLs or ACLs and POSIX at the same time?
Changing only ACLs should suffice (I don't bother with POSIX if not neccessary) for user rights as they are used before POSIX.

ICloud Keychain Bug - inherits setting of new machine

iCloud Keychain is a great idea that allows you to choose more complex, difficult to break passwords and keep them available for all you OSX Mavericks and iOS 7.0.3+ devices. Add this to Safari password suggestion tool, and you enhance security of your data tremendously. And so I happily upgraded my Macbook Pro and my iOS devices and changed my most important passwords. And the the big problem: I decided to upgrade the mac mini in my office. Problem is that, if you add a new mac to your collection, iCloud Keychain inherits the settings of the attached computer instead of asking, destroying all you have done before and making you reset all passwords, what may require hours of tedious work depending on your password collection.
Bad Apple. Very bad.

You could try to find the old ID as explained here: try to find it as explained here: Apple ID: How to find your Apple ID. If you find it, you would then have to reset the password as explained here: iCloud: Change your iCloud password.
Or, you could just create a new Apple ID by going here: https://appleid.apple.com/account.
To create your iCloud account, you would then go to System Preferences>iCloud on the new Mac and sign in with the ID to create the account, then check the items you want to sync with iCloud. Just be aware that each device/Mac can only create a maximum of three iCloud accounts. If these have already been created on this Mac then you won't be able to create a new account without using a different iOS device running iOS 5 or higher (iPhoto, iPad, iPod touch) or Mac running OS X 10.7.5 or higher, if you have one.

ACL granularity on XML element

Hello,
when I store a XML in a XMLTYPE (column or table) can I define an ACL on a specific XML element(node)? How fine grained is the ACL restriction? on the whole XML document or even lower to elements and attributes? If it is fine grained to elements can someone provide an example?

As far as I know, it is top down...
In http://www.oracle.com/technology/products/database/oracle11g/pdf/xml-db-11g-whitepaper.pdf it is described as follows (the 11g extras):
ENHANCED ACL SECURITY
In Oracle Database 11g, the Oracle XML DB ACL-based security model has been enhanced in a number of ways, including the following:
• ACL Inheritance.
ACL inheritance simplifies the process of defining, managing, and enforcing a common set of security policies across all of the documents stored in Oracle XML DB Repository. These rules can be organization-wide policies or policies specific to certain types of documents. These rules are specified by creating one or more master ACLs. With ACL inheritance it is possible to ensure that all new ACLs must be based on an existing ACL. This ensures that the newly created ACL inherits all of security policies defined by the ACL it is derived from, ensuring that the policies defined by the parent ACL are enforced whenever the new ACL is used.
• DAV ACL Compliance.
The Oracle XML DB ACL model has been enhanced to provide more complete support for the DAV ACL specification. This will allow improved interaction with clients that provide support for the DAV ACL security model.
• User defined ACLs.
In Oracle Database 11g the set of permissions defined by Oracle XML DB can be extended to allow the ACL based security model to be used to secure other kinds of database object.
• Time-sensitive ACLs.
In Oracle Database 11g it is possible to create ACLs that enforce access control polices in a timesensitive manner. This can be used to automatically publish and then expire content, based on rules defined by the ACL.

Can not set security settings explicitly

Hi,
I'm trying to create a workspace(library) and a folder via APIs and need the program NOT TO INHERIT security setting from the library to the sub folder.
Given below are my attribute for the workspace creation and folder creation respectively,
Attributes for the workspace:
NamedValue[] wsDef = WsUtility.newNamedValueArray(new Object[][] {
{ Attributes.NAME, workspaceName },
{ Attributes.DESCRIPTION, workspaceDesc },
{ Attributes.SECURITY_CONFIGURATION,
WsUtility.newNamedValueArray(new Object[][] {
{ Attributes.GRANTS, wsGrants }}) } });
Where wsGrants,
contains row with
NamedValue[] wsReaderGRPGrant = WsUtility.newNamedValueArray(new Object[][] {
{ Attributes.GRANTEE, attr[0].getValue()},
{ Attributes.ROLES, new long[] { readerRole.getId() }},
{Attributes.PROPAGATING, Boolean.FALSE}});
Attributes for the folder:
NamedValue[] fDef = WsUtility.newNamedValueArray(new Object[][] {
{ Attributes.NAME, folderName },
{ Attributes.DESCRIPTION, folderDesc},
{ Attributes.HAS_EXPLICIT_SECURITY_CONFIGURATION,Boolean.TRUE} });
With these setting, the sub folder still inherits security settings from the workspace.
Can anyone help me please?
Thanks,
Tenjuka

I haven't tried to create this sort of setup using code, yet. Some thoughts though...
In what order are you performing these steps? One of things I've observed is that when using the Content UI, when switching from Inherit to Modify, the base security configuration starts out the same as the parent. Are you still seeing the "inherit" switch set to on your subfolder?
Another thought, it would appear that you are setting each GRANT to be non-propagating for the user being added with the READER role to the workspace. This would imply that only accounts added in with this should not propagate to the folder that isn't inheriting. Are you seeing these additional readers?
Is the workspace security configuration set to CONFIGURATION_FINAL? Are you supplying a security configuration for the subfolder after providing the HAS_EXPLICIT_SECURITY_CONFIGURATION attribute for the folder? Perhaps the system doesn't like having a null security configuration when it's been instructed that there is one.

ACLs & 10.7.3

So i stupidly made the mistake of upgrading my relatively small xsan to 10.7.3. Previously it was sitting at 10.7.2 and seemed fairly stable. (MDCs were 10.7.2 but the clients were 10.5.8) We recently purchased a new J-class expansion array that we grew our volume onto. At that time, a decision was made to bring all the clients up to Lion and FCS3. We performed the grow and then upgraded all of the clients. Shortly afterwords, i realized the clients were all sitting at 10.7.3. (Software Update pulled down the latest greatest) With xsan best practices in mind I decided to go ahead and update my MDCs as well to keep them at the same level as the highest client. (Version wise)
Big mistake.
The Xsan volume did not like this. After the upgrade, my volume stopped accepting ACLs & AD permissions. As of right now, ACLs are completely worthless and broken. If i put any kind of ACL on the volume, none of my clients logged in with their domain accounts are able to write files to it. They can read the volume. They just can't write to it. If they try to edit/delete/create files or folders they get an "Error code -43" message. If i remove ACLs (clicking the minus sign on all ACLs under "Set Permissions") and fall back to Posix permissions alone ("everyone" set to read/write), the clients work just fine. They can read/write/edit/delete/change files all day long. But with ACLs on the volume, its worthless.
All of my machines are bound to AD. They all seem perfectly fine. I can login with domain accounts and don't have any problems. The machines all have green lights next to the domain in the system preference pane. I can set permissions on local folders and everything seems great.
I've tried practically everything i can think of. I've removed clients from the san and re-added. I've unbound machines from AD and rebound. I've unbound both MDCs and rebound. I wiped one of the clients and did a fresh Lion install from scratch. I've added a single AD account (instead of our normal security group) to the ACLs section and still no luck. I still get that stupid -43 error. I've even turned ACLs in Volume Settings off and then back on. No luck. Today i tried rolling back one of the clients to 10.7.2 (leaving the MDCs @ 10.7.3) and still had the same issue.
Looking through the logs, i'm not seeing anything suspicious. Though i will say that i'm fairly new to Mac logs. The only thing i see that might be of any concern is a few annoying Spotlight errors. (Even though spotlight search is unchecked in volume settings)
At this point the only idea i have left is to rollback both my MDCs to 10.7.2. I'm planning to try that tomorrow evening to see if i have any luck. If anyone has any advice, i would greatly appreciate it. Lion (at least where xsan is concerned) still seems to be in beta and i seem to be one of only a few beta testers.

I just got off the phone with Apple's Xsan tech support. We got it fixed. There's a small bug that caused this so i'm going to document it here for future reference or for anyone else on 10.7.3 what is having the same problem.
The problem turned out to be the posix group that owned the volume. Our volume was owned by a unix group that only existed on the MDCs and not on the clients. (We had changed it to something other than wheel/admin a while back for various reasons) For some reason the clients were getting hung up and erroring because they had no idea what or who this group was. As soon as i set it back to admin/wheel everything started working again. (ACLs and all) The error code -43 went away.
The apple engineer said the posix group owner needs to be set to something that the clients AND MDCs can recognize. He said i could either go around and create this group on all the clients, set it back to admin/wheel or, even better, just set it to an Active Directory group which all the clients and MDCs recognized. (Which is what i did.)
So there you go. He did confirm that this is a bug with 10.7.3. He said by design the clients aren't really supposed to care about posix permissions if ACLs exist. He said if Xsan encounters a posix group and/or owner id that it doesn't recognize its not supposed to care. But for some reason 10.7.3 is caring and erroring with error code -43. He said a future release should fix this problem.

ACL - Inheritance of settings

Similar Messages

Maybe you are looking for