Windows & File System Repository - security issues

Question

Hello,
I got a strange behavior in EP 6 SP 2 using KM and Windows file systems. Here is the scenario:
- I created a Network Path and a File System Repository pointing to a Windows 2003 File System, following the portal help instructions. Both EP6 server and Windows 2003 server are in the same domain.
- according the KM Monitor, the repository is up and running
- the portal users can access their respectives folders in the file system after having their uids / passwords mapped in the user mapping option
- the portal is assuming the permissions (read & write & list folder & etc) from windows
So far it seemed to be everything ok - but after some tests we got the problem:
- user "A" has his uid/pwd mapped in portal, and read & write access to the file system "dept_folder". He can access the folder through a KM iview, with r/w privileges.
- user "B" has his uid/pwd mapped in portal, and ONLY read access to the file system "dept_folder". He can access the folder through an KM iview, with read privileges.
- and here comes the problem: if user "A" is logged, and user "B" replaces his uid by user "A" uid in the user mapping (only the uid, the password doesn't matter) he can access the file system "dept_folder" with the same privileges than user "A".
I looked in SDN, SAP Notes and SAP Portal Help trying to find an article related to this, no success so far. We have CM Patches 2 & 3 applied, and Patch 4 doesn't have any comment about this specific security problem.
Has someone already face this problem ? Or could be something wrong in my configuration ?
Rgds, and tks in advance
Fernando Cervantes

Answer 1

Hi David
The same occurred here, I think I know the reason. Let me just give you an overview of my configuration:
Network Path id          ccc-ccc1fs-drive_i
Description *            DRIVE I - CCC1FS Server
Network Path *       
ccc1fs\Drive_I
Password           *********
Re-Enter Password      *********
User *            ccc\service
The user was provided by the Windows administrator and has full control for this folder.
File System Repository
Description                  File System drive_i CCC1FS Server
Prefix *                 /ccc-ccc1fs-drive_i
Root Directory *            //ccc1fs/drive_i
Windows Landscape System       Windows
ACL Manager                Not set
Security Manager          W2KSecurityManager
The important here is the Security Manager configuration - it must be W2KSecurityManager, otherwise you will have the user permissions overrided by admin user permission. And you will need to configure a Windows system landscape too.
I hope this can help you...concerning the bosses, I got the same situation, I said the whole stuff would work fine
Rgds,
Fernando