Trouble with shares and access to sub folders

Question

We're attempting to replicate our Netware configuration to a new MacOS 10.4.6 server. On Netware we where able to create a share that was available to all users, however the folders they saw within the share where governed by their access rights within the tree. For example, take the following structure:
Data --+-- Folder1
|
+-- Folder2
Rights for Folder1 where assigned to Group1 and rights to Folder2 to Group2. All users in Group1 and Group2 could then mount the drive and see the folders that they where a member of.
We have attempted to replicate this on MacOS as follows:
Data --+-- Folder1 (ACL Group1 = Read/Write)
|
+-- Folder2 (ACL Group2 = Read/Write)
However, when you mount Data on Mac or Windows it says you have no access rights and won't let you dig down to Folder1 or Folder2. Is there something I'm missing?

Answer 1

If all users in Group 1 and Group2 have access to
the root Data folder then that permission will
propogate down the tree and they will have read
access to each of the sub folders. If folders within
suddenly gain everyone RW access then they will be
able to open and see the folder.
Thanks, I've solved the problem. I needed all users to have access to the root of the 'volume' but for that not to propogate down the tree. I've found the inheritence settings and that I think has solved the problems.
You can control this by propagating permissions
downward from the top level folder. Do this:
Create a group for everyone who accesses Data called
DataGroup.
Add DataGroup to the group list for everyone. (You
can mass select Users and add the group to everyone
who needs it at once.)
Change the Unix group owner of the Data folder to
DataGroup and set these permissions:
Owner: admin RW, Group: DataGroup R, Everyone: None
Open Data and set Folder1 privileges to:
Owner: admin RW, Group: Group1 RW, Everyone: None
and propagate these settings to the subfolders. Be
sure to propagate Group Ownership and Group
Permissions and Everyone permissions.
NOTE: This is the traditional *nix way - with ACLs
you can do this and then fine-grain the control using
the ACL granting Group 1 Full Control and propagating
that.
Now set Folder2 to Group2 etc.
This allows you access to Data (versus using staff or
some generic Unix group but those will work too) but
allows you to control who has access to the
subfolders. In this case membership in DataGroup only
grants you access to see the folders - it doesn't
even guarantee access to any of the subfolders.
If you want nested folders within Folder1 or Folder2
you can do the same thing - create a folder owned by
a specific user and set Group Read access to none and
propagate that through the subtree. Just be aware
that propagations that happen above that folder can
reverse the settings. Always set large and then get
specific. New Users are granted access to Data by
adding DataGroup and users access to folders are
granted or revoked by adding or removing the Group1,
Group2 etc settings.
I think that once you get it set how you want and try
it you'll find that the Data folder is redundant and
is giving you unnecessary conceptual problems. If you
make the Folder1, Folder2 etc shares then after a
user authenticates they will see only the folders
they have permission to access. If I am in Group1 and
I authenticate my selection of folders will only be
folders accessible by Group1 - I will never even see
Folder2. By grouping them in Data you are adding a
layer of permissions that is probably not needed. But
everyone has their own organizational system and
sometimes it's easier to leave users with what their
used to using. (I have users that still mount Users
and navigate to their own folder even though their
user folder shows up at the login level simply
because that's the way they've always done it.)
No there are good reasons to share the Data folder and not the children below. For example, if you are on Windows clients and you wish to map the share to a drive letter you will have no way of doing this if you don't have the containing folder.
Yes, I understand with ACLs (or at least I think I
do and have setup a system that works). The problem
is that new folders get Everyone Read access. Which
ruins the effective permissions for that folder. I
need a way of making the default posix permissions
O=RW,G=None,Everyone=None.
We have a lot of folders to deal with Folder 1 and
Folder 2 are only examples. We have about 15 or more
folders with sub folders that have differing access
rights. All this we have sorted out except the
default POSIX permissions for new folders/files.
You can change Umask default privilege settings but
DON'T. Well, DON'T unless you're a *nix guru. It
changes the default for all created files - including
those created by the system and this can lead to
serious problems down the road.
I don't want a whole system default change to umask I want one that works only for people connected via AFP, you would think that would be possible. Similarly I want one for SMB access also.
If you get this working you will see that despite the
POSIX settings the ACLs are working. If you really
need your Unix permissions to be set a certain way
chuck ACLs and set "Inherit from Parent Folder" in
AFP and SAMBA. With ACLs on the system will only do
POSIX settings.
In the windows world you either use POSIX or ACLs in the mac world you use a combination of both. That can be an asset but it can also be a major problem. If only you could use the inherit setting for POSIX when ACLs where enabled it would solve all these worries.
Thanks for your time on this.
Ian