Hi Kambiz, What I know is that Jcifs can't control the access user to fetch protected folders/documents by e.g. creating pseudo strong user. Usually I ask for some MCF users to create strong 'crawler' user regardless of small or bigger organizations. Because sub folders inherits parent folders which are often managed by Domain admins, only Domain admins knows entire ACLs. IMO, there is not a workaround except for disabling ShareDriveConnector's security options, but it might not fetch documents correctly since fetching user doesn't have full authority. FYI, even when we use SharePointConnector, Domain admins user is required.
Shinichiro Abe On 2014/09/24, at 16:03, Kambiz Niktabar <[email protected]> wrote: > Thanks Karl & Shinichiro, > > Yes, we are using Active Directory. Actually using a user member of domain > admin might be possible for small organizations but it definitely would not > be the case for bigger ones where there is a team handling different > services. I can not get a domain admin user for crawling. Is there any > workaround for that? > > Regards > Kambiz > > From: Shinichiro Abe <[email protected]> > To: "[email protected]" <[email protected]>; Kambiz > Niktabar <[email protected]> > Cc: "[email protected]" <[email protected]> > Sent: Wednesday, September 24, 2014 2:52 AM > Subject: Re: JCIFS error while crawling DFS share > > Hi Kambiz, > > If your server is managed by Active Directory, > you will need to add user of Domain admins group with full control to access > folders. > Otherwise you can't obtain all ACLs information probably. > > Shinichiro Abe > > > > On 2014/09/24, at 4:11, Karl Wright <[email protected]> wrote: > > > Hi Kambiz, > > > > I don't know what particular MSFT permission controls this access. If I > > were you, I'd start with "full control" and work backwards. You don't need > > write permission for the connector, but you *do* need the ability to query > > for acls for documents, folders, and shares. > > > > Karl > > > > > > On Tue, Sep 23, 2014 at 3:09 PM, Kambiz Niktabar <[email protected]> wrote: > > Hi Karl, > > > > Thanks for the info. What kind of permission is required to get share > > security? I tried with an account which has modify access to the folder but > > got the same error. Is Full Control access required? Please advise. > > > > Regards > > Kambiz > > > > From: Karl Wright <[email protected]> > > To: "[email protected]" <[email protected]>; Kambiz > > Niktabar <[email protected]> > > Sent: Tuesday, September 23, 2014 5:54 PM > > Subject: Re: JCIFS error while crawling DFS share > > > > Hi Kambiz, > > > > The problem is that your user doesn't have permissions to obtain the share > > security for the documents in question. The ability to obtain ACLs for a > > document is critical in order to be able to enforce document security at > > search time. > > > > Thanks, > > Karl > > > > > > > > > > On Tue, Sep 23, 2014 at 11:18 AM, Kambiz Niktabar <[email protected]> > > wrote: > > Hi, > > > > After the attempt for crawling content on DFS share was unsuccessful, I > > tried crawling it through the actual server name but I got "Access is > > denied" message although the user has access to the shared folder and > > document. > > Here is the debug log for the connector. Any idea what the problem is ? > > > > Regards > > Kambiz Niktabar > > > > > > DEBUG 2014-09-23 11:59:03,449 (Startup thread) - Connecting to: > > smb://domain.net;user:<password>@server1/ > > DEBUG 2014-09-23 11:59:03,480 (Startup thread) - Seed = > > 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,683 (Worker thread '1') - JCIFS: getVersions(): > > documentIdentifiers[0] is: smb://server1/folder1/folder2/FT_Test/ > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: In checkInclude > > for 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: Matching > > startpoint 'smb://server1/folder1/folder2/FT_Test/' against actual > > 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: Startpoint found! > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: Startpoint: > > always included > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: Leaving > > checkInclude for 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: Processing > > 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: > > 'smb://server1/folder1/folder2/FT_Test/' is a directory > > DEBUG 2014-09-23 11:59:05,761 (Worker thread '1') - JCIFS: In checkInclude > > for 'smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc' > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Matching > > startpoint 'smb://server1/folder1/folder2/FT_Test/' against actual > > 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Startpoint found! > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Checking '*' > > against '/Test1_Shared.doc' > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Match found. > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Leaving > > checkInclude for 'smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc' > > DEBUG 2014-09-23 11:59:05,777 (Worker thread '1') - JCIFS: Recorded path is > > 'smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc' and is included. > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: getVersions(): > > documentIdentifiers[0] is: > > smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: In checkInclude > > for 'smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc' > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: Matching > > startpoint 'smb://server1/folder1/folder2/FT_Test/' against actual > > 'smb://server1/folder1/folder2/FT_Test/' > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: Startpoint found! > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: Checking '*' > > against '/Test1_Shared.doc' > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: Match found. > > DEBUG 2014-09-23 11:59:07,495 (Worker thread '7') - JCIFS: Leaving > > checkInclude for 'smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc' > > WARN 2014-09-23 11:59:07,527 (Worker thread '7') - JCIFS: Possibly > > transient exception detected on attempt 1 while getting share security: > > Access is denied. > > jcifs.smb.SmbException: Access is denied. > > at jcifs.smb.SmbFile.getShareSecurity(SmbFile.java:2945) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getFileShareSecurity(SharedDriveConnector.java:2552) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.describeDocumentSecurity(SharedDriveConnector.java:1070) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getDocumentVersions(SharedDriveConnector.java:560) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:469) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:435) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.processDocuments(BaseRepositoryConnector.java:358) > > at > > org.apache.manifoldcf.crawler.system.WorkerThread.run(WorkerThread.java:380) > > WARN 2014-09-23 11:59:07,527 (Worker thread '7') - JCIFS: Possibly > > transient exception detected on attempt 2 while getting share security: > > Access is denied. > > jcifs.smb.SmbException: Access is denied. > > at jcifs.smb.SmbFile.getShareSecurity(SmbFile.java:2945) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getFileShareSecurity(SharedDriveConnector.java:2552) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.describeDocumentSecurity(SharedDriveConnector.java:1070) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getDocumentVersions(SharedDriveConnector.java:560) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:469) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:435) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.processDocuments(BaseRepositoryConnector.java:358) > > at > > org.apache.manifoldcf.crawler.system.WorkerThread.run(WorkerThread.java:380) > > WARN 2014-09-23 11:59:07,527 (Worker thread '7') - JCIFS: Possibly > > transient exception detected on attempt 3 while getting share security: > > Access is denied. > > jcifs.smb.SmbException: Access is denied. > > at jcifs.smb.SmbFile.getShareSecurity(SmbFile.java:2945) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getFileShareSecurity(SharedDriveConnector.java:2552) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.describeDocumentSecurity(SharedDriveConnector.java:1070) > > at > > org.apache.manifoldcf.crawler.connectors.sharedrive.SharedDriveConnector.getDocumentVersions(SharedDriveConnector.java:560) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:469) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.getDocumentVersions(BaseRepositoryConnector.java:435) > > at > > org.apache.manifoldcf.crawler.connectors.BaseRepositoryConnector.processDocuments(BaseRepositoryConnector.java:358) > > at > > org.apache.manifoldcf.crawler.system.WorkerThread.run(WorkerThread.java:380) > > WARN 2014-09-23 11:59:07,527 (Worker thread '7') - JCIFS: Access exception > > when getting document version for > > smb://server1/folder1/folder2/FT_Test/Test1_Shared.doc - skipping > > > > > > > > > > > > > >
