It is a bit complex scenario so I will try to make this a simple as possible for you.
ENVIRONMENT
I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to multiple groups. Authentication is maintained using Active Directory and mapping between Linux and Windows is achieved using Winbind(Samba package).
PROBLEM
The thing is that I was asked to introduce some sort of security & restrictions on both sides for certain groups of users, to prevent users from looking at each others work.
POSSIBLE SOLUTION
I am able to that using extended ACLs in Linux which will be mapped in Windows (hopefully & somewhat accurately by Samba).
ISSUES ASSOCIATED
Lets say that a user which belongs to both groupsA(primary group) and groupB. He/she would like to access files which are restricted to groupB only. Is that even possible since groupB is not his primary group?
OTHER SOLUTIONS
I was thinking if there is another solution to this. Using extended ACLs for such a massive filesystem will be a pain (if not impossible) to maintain, so I am trying to come up with a more efficient solution.
Any kind of suggestions, help, links etc would be appreciated.