2

I have been searching on this and just can't find enough information on the topic.

We are trying to develop a custom folder / permission tool. The clients needs are quiet complicated as there will be 20.000 folders to manage (to begin with) where permission requirements would mandate over 1000 security groups per user. Because the system has to stay scalable and user count scales the slowest, we were thinking of writing users explicitly into the ACL of folders.

Now what I would like to know: How does scaling the ACL entry count impact the system? We are talking VM virtualized Windows Server 2012 with Samba share. What happens, when we start writing 500 users into the ACL of a folder? Is there anyone with experience in that topic?

What people were able to tell me was and what I could find out was: - Don't use denies - Use groups instead of users and put the users into the group - Max of about 1000 groups per user (groups he can be in)

Problem is: The client's requirements imply that writing users into the ACL is the most efficient way of solving the problem. Nesting groups will limit the scalability of the system.

Regards and thanks in advance.

11
  • Are you using samba or windows sharing?
    – Jim B
    Sep 25, 2015 at 17:57
  • Files are shared by Windows standard share (thought that was smb) but permissions are written in ntfs directly.
    – Shumachine
    Sep 25, 2015 at 21:53
  • You should consider dynamic access control rather than straight permissions. redmondmag.com/articles/2013/01/01/group-control.aspx?m=1
    – Jim B
    Sep 26, 2015 at 3:04
  • I tried to do that. But the client's needs demand us writing rights directly into ACL.
    – Shumachine
    Sep 28, 2015 at 9:25
  • What's causing the clients to fail Kerberos auth. You'll have an interesting time if that's already broken.
    – Jim B
    Sep 28, 2015 at 10:12

0

You must log in to answer this question.