Using the NT Explorer GUI to Create ACLs

Click the add button in the File/Directory Permissions dialog box of the Windows NT GUI to bring up the Add Users and Groups dialog box.

Figure 3-3 Windows NT Explorer File Permissions

	NOTE: The List Names From field displays the source of the list of group names. It may also show the name of your domain. Do not use the domain list to add new ACLs.

Figure 3-4 Windows NT Explorer List Names From Field

Instead, what you need is a list of groups and users that can be recognized by the underlying UNIX file system.

Since the actual ACLs will be UNIX file permissions or VxFS POSIX ACLs in their final form, the only valid groups and users are UNIX groups and users that the Samba server knows about.

Go to the List Names From dropdown list in the Add Users and Groups dialog box. One screen choice is to list names on your Samba server. This is the list HP recommends.

Figure 3-5 Windows NT Explorer Add Users and Groups Dialog Box

Select any name on the list that is labelled local UNIX group. Those groups are actually UNIX groups on the Samba server.

Optionally, click the Show Users button and all the UNIX users on the Samba server will be added to the list as well. You will always be able to add an ACE for the local Unix groups and the users in this list.

Figure 3-6 Add UNIX Groups and Users

You can type user and group names into the Add Names text field to add users and groups. If the names are valid UNIX group or user names, the users and groups will be added.

Optionally, add the Samba server name and a backslash to the beginning of the user or group name and it will be added (for example, server1\users1). When you select names off the name list, the GUI will put that name in the text list and automatically add the server name as well.

Optionally use the user name mapping feature to define a mapping of NT user names (or domain names) to UNIX user names. For example, you could map the NT user names administrator and admin to the UNIX user name root. The mapping can be either one-to-one or many-to-one.

Samba supports the creation of ACEs with NT user names that are mapped to UNIX user names.

To continue the example above, you could create an ACE for the administrator user on the NT client and, on the Samba server, the ACE would be created for the root user. The client will display the corresponding ACE as being for the root user, not the administrator user.

If you add an ACE for one user name, like administrator and then display the list of ACEs and see a new ACE for a different user name (root), it maybe confusing. As many NT user names can be mapped to one UNIX user name, Samba only displays the one UNIX user name. It cannot display the NT name that was mapped to the UNIX user name.