Configuring NetFile

This chapter introduces you to NetFile and explains its configuration and operation in detail.

Overview of NetFile

NetFile is a file manager application that enables the user to access and operate on remote file systems and directories.

The NetFile component of Sun™ ONE Portal Server, Secure Remote Access is available as Java1 and Java2 applets. Users who do not have the Java2 plugin for their browsers can use the Java1 applet. The Java2 applet has a better interface and increases the ease of accessibility.

Facility to add or remove shares or folders

File upload and download

Search for files and folders

File compression using GZIP and ZIP

Mail facility within the NetFile environment

Save the current NetFile session information

Supported File Access Protocols

NetFile allows you to access remote systems using FTP, SMB (Windows), and NFS protocols. It includes the following file access protocol features:

If the user specifies AUTODETECT to add a system, NetFile uses the following sequence to automatically detect which protocol to use:

Check the host for SMB server on port 139.

Check the host for FTP server on port 21. If the FTP response contains the string "NetWare", this is considered a NETWARE host.

Check the host for NFS server on port 2049.

If all of the above fail, a message saying unable to determine the host type is displayed.

The first file system type that is detected is used to connect to the requested host.



Note	The connection fails if the servers are running on non-standard ports.

NetFile allows users to select the file server/system protocol of their choice.

For each of these protocols, the platforms/servers that are supported are listed below.

Table 4-1 File Systems and Protocols Supported
File System/Protocol	Platform
NFS	Solaris 2.6 and higher
SMB	Windows 95/98/NT/2000/ME/XP
FTP	Novell FTP 5.1 Server on Novell Netware MS FTP Server 4.0 on Win NT 4.0 MS FTP Server 5.0 on Win NT 2000 Solaris FTP Server WU_FTP 2.6.1


Note	Support for Novell Netware is only through FTP server and not through native access.

Enabling Access to NetFile

When you install Secure Remote Access, the NetFile service is registered only for the organization that you specified during installation. The NetFile User Role is also created for this organization.

To Enable NetFile for Organizations and Users

Create a role for Netfile users for each of these organizations. Create this role with the following attributes:

Type: Services

Access Permissions: Organization Help Desk Admin

Assign the NetFile service to each user who requires access to NetFile.

Assign the NetFile User Role to each user who requires access to NetFile.

See the Sun ONE Identity Server Administration Guide for more information on creating and assigning roles and services.

Configuring NetFile Attributes

As an administrator, you can configure various attributes at the organization, role, and user levels.

Organization - These attributes can be set only at the organization level. These attributes cannot be changed at the role or user levels, and are available to all roles and users under a specific organization. You cannot edit these attributes at the role or user level.

The organization attributes are - Temporary Directory Location, OS Character Set, SMB Client Location, and MIME-types Configuration File Location.

Dynamic - These attributes can be set at the organization, role and user levels. The values set at the user level override the values set at the organization or role levels.

The Dynamic attributes are - Conflict Resolution Level, Window Size, Window Location, Search Directories Limit, Allow Access to Window Hosts, Allow Access to FTP Hosts, Allow Access to NFS Hosts, Allow Access to Netware Hosts, Common Hosts, Allowed Hosts, Denied Hosts, Allow File Deletion, Allow File Rename, Allow Changing User Id, Allow Changing Windows Domains, File Upload Limit(in MB), Default Domain, and Default Windows Domain/Workgroup.

Setting NetFile Attributes at the Service Configuration Tab

The attributes at the Service Configuration level serve as a template. Any new organization or user that is created inherits these values by default. You can make changes to the attribute values at the Service Configuration level. The new values are reflected only when new organizations are added. Changes in the attribute values at the Service Configuration tab do not affect existing organizations or users.

Setting NetFile Attributes at the Organization Level

If you configure an attribute at the organization level, that attribute is inherited by all roles and users under that organization.

Setting NetFile Attributes at the User Level


Note	Conflict Resolution Level is not available at the Service Configuration tab, or at the User level. This is available at the organization and role levels.


Note	This chapter describes the configuration of all the attributes at the organization level.

Only the dynamic NetFile attributes are available for configuring at the user level. See "Configuring NetFile Attributes" for details on dynamic attributes.

Specifying the Temporary Files Directory

NetFile needs a temporary directory for various file operations. The default temporary directory is /tmp. The temporary files are deleted after the required operation has been carried out.

The specified temporary directory is created if it does not exist on the server.

Ensure that the ID with which the web server is running (such as nobody or noaccess) has rwx permissions for the specified directory. Also ensure that the ID has rx permissions for the entire path to the required temporary directory.

To Specify a Temporary Directory


Tip	You may want to create a separate temporary directory for NetFile. If you specify a temporary directory that is common to all modules of the portal server, the disk may quickly run out of space. NetFile will not work if the temporary directory has no space.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Type the required temporary directory in the NetFile Temporary Directory Location field.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the OS Character Set

You can specify the character set used as the default encoding for communicating with hosts. The default value is UTF-8.

To Specify the OS Character Set


Caution	If the character set is not specified correctly, the behavior of the machine and error messages that appear cannot be predicted.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the OS Character Set field and type the character set code.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the SMB Client Location

The Samba client is packaged as part of Secure Remote Access. You need to install the SMB client and specify the exact location to be able to access Windows hosts.

Specify the full path until the bin directory that contains the smbclient executable. For example, /usr/sfw/bin.

To Specify the Location of the SMB Client

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the SMB Client Location field and type the full path to where the SMB client is located.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the MIME-types Configuration File Location

This information is required to determine the response content type to send to the client browser. The browser needs this information to determine the application that a file needs to be associated with during a NetFile open or download operation. This is configured during installation.

If the MIME-types file of the portal server’s web server needs to be used, specify the location:

To Specify the Location of the MIME-types Configuration File

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the MIME-types Configuration File Location field and type the full path to where the MIME-types configuration file is located.

Click Save at the top or bottom of the NetFile page to record the change.

Setting the Conflict Resolution Level

You can set the priority level for the dynamic attributes. If a user inherits multiple attribute templates, say from an organization and a role assignment, and there is a template conflict between the attributes in the two templates, the template with the highest priority is inherited. There are seven settings available ranging from Highest to Lowest.

See the Sun ONE Identity Server Administration Guide for more details on conflict resolution.

To Set the Conflict Resolution Level

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Select Services from the View drop-down list.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Select the required level from the Conflict Resolution Level field drop-down list.

Specifying the NetFile Window Size

You can specify the size of the NetFile window in pixels on the user’s desktop. The default value is 700|400 in pixels. If you enter an invalid value, NetFile uses the default value.

To Specify the Size of the NetFile Window


Note	The user can also edit this value in the limited admin console that is available to the user. The value that you specify is replaced with the new values if the user resizes the NetFile window on the desktop.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Window Size field under NetFile - Dynamic and type the required window size in pixels.

Type the value in the format 700|400 without any spaces. The coordinates are in the form x|y. No other character should be used as a separator.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the NetFile Window Location

You can specify the location where the NetFile window displays on the user’s desktop. The default value is 100|50 in pixels. If you enter an invalid value, NetFile uses the default value.

To Specify the Location of the NetFile Window


Note	The user can also edit this value in the limited admin console that is available to the user. The value that you specify is replaced with the new values if the user relocates the NetFile window on the desktop.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Window Location field under Dynamic and type the required window location coordinates.

Type the value in the format 100|50 without any spaces. The coordinates are in the form x|y. No other character should be used as a separator.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the Default Domain

You can specify the default domain that NetFile needs to use to contact allowed hosts.

This default domain value is applicable only if the user does not specify a qualified machine name while adding a host using NetFile.

To Specify the Default Domain


Caution	Ensure that the Default Domain field is not blank, and that it contains a valid domain name.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Default Domain field, and type the default domain name.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the Windows Domain/Workgroup

This is the default Windows domain or workgroup which the users choose to access a Windows host.

A user can override this value by specifying a different value while adding a machine.

To Specify the Default Windows Domain or Workgroup

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Default Windows Domain/Workgroup field, and type the default domain or workgroup name.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying the Search Directories Limit

You can configure the maximum number of directories that will be searched in a single search operation. This limit helps reduce network clogging and increases the speed of access if a number of users are logged in simultaneously. The default value is 100. If you type an invalid value, NetFile resets the value to the default. You need to type only positive integers in this field.

Suppose a user has a directory called A. Assume that A has 100 subdirectories. If you specify the maximum directories to be searched as 100, the search operation will go through directory A and stop. The search will not proceed through the other directories in the user’s machine since the limit of 100 was reached with directory A. To continue the search, the user has to manually restart the search at the next directory.

The search operation is carried out in a depth-first manner. This means that the search operation is carried out in all the subdirectories of the directory that the user selected, before moving on to the next directory.

To Specify the Search Directories Limit

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Search Directories Limit field under Dynamic and type the required number.



Note	Ensure that you type an integer value in this field.

Click Save at the top or bottom of the NetFile page to record the change.

Specifying Access to Different Types of Hosts

You can specify whether users can access specific hosts such as Windows, FTP, NFS or Netware hosts. You can set the option to allow or deny access to each type of host. All these options are enabled by default.

To Specify Access to Different Types of Hosts

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the required Allow Access to host type Hosts option. You can choose to enable:

Allow Access to Windows Hosts

Allow Access to FTP Hosts

Allow Access to NFS Hosts

Allow Access to Netware Hosts

Selecting the option enables users to access that particular type of host. Clearing the checkbox prevents users from accessing that type of host.

Click Save at the top or bottom of the page to record the change.

Configuring a Common Hosts List

You can configure a list of hosts to be available through NetFile to all remote NetFile users. You need to specify the following information for each host that you add:

machine name - You can type either the simple machine name, or the fully qualified name. If the machine name that you have provided matches the machine name configured by the user, the two sets of information are merged and the user-specified values override the values that you specified.

For example, suppose you have configured 4 common hosts - sesta, siroe, florizon, and abc. A user configures 3 hosts out of which 2 are sesta and siroe. User-specified values override administrator-specified values in such conflict situations. florizon and abc are also listed in the user’s NetFile, and the user can carry out various operations on those hosts. In case you have listed florizon in the Denied Hosts List, florizon is listed in the user’s NetFile, but no operation can be carried out on florizon.

machine type - If the user has already added a machine that is listed in the Common Hosts list, the user setting takes precedence. If there is a conflict in the type, the shares added by the administrator are not added for that user. If the user and the administrator add the same share, the share is added, but the password set by the user takes precedence.

FTP

NFS

WIN

NETWARE

machine encoding - If there is a conflict between the value specified here and the user setting, the user setting takes precedence. If you have specified a blank or invalid setting, the character set of the client OS (user’s machine) is considered.

To Configure the Common Hosts List


Note	The user can edit any of these values in the NetFile client application. But the edited values are valid only for the current session. If the user log out and logs in again, the edited values are not retained.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Type the required information in the Common Hosts field as shown below:

machine_name=machinename

machine_type=type

machine_encoding=encoding

machine_domain=domain

machine_password=password

machine_user_name=username

share_name=/share

share_password=password



Note	Ensure that there are no blank lines in the information set for one host. Press the Enter or the Return key to type the next line. You can leave the machine_domain, machine_password, machine_user_name, share_name and share_password fields blank if no entry is required.

Listed below is a sample information set for a machine abc.

machine_name=abc.sesta.com

machine_type=FTP

machine_encoding=ISO-8859-1

machine_domain=

machine_password=a$$a$$a

machine_user_name=abcdef

share_name=/space

share_password=a$$a$$a



Note	Ensure that there are no spaces, and that all the keyword spellings and case (such as machine_name and machine_encoding) are correct. Ensure that the machine_type is one of the following: FTP, NFS, NT, WIN, NETWARE Specify the machine_type as NT for Windows NT, XP and 2000 machines. Specify the machine_type as WIN for Windows 95, 98 and ME machines. You cannot specify any other machine_type. Repeat the share_name and share_password lines to include multiple shares. Leave the share_password blank if there is no password for a particular share, or if you want the user to supply the password while accessing the share.

Repeat this information set for each common host that you want to add.

Click Save at the top or bottom of the NetFile page to record the change.

Configuring the Allowed Hosts List

By default, users are allowed to access all the hosts through NetFile because of the * entry in this list. If you want to change that, remove the * entry and specify only those hosts to which users need to have access through NetFile, in this list. Alternatively, you can keep the * entry here, and specify the hosts to which you want to deny access in the Denied Hosts list. In that case, all the hosts except the ones specified in the Denied Hosts list are allowed access.

To Create the Allowed Hosts List


Note	If both the Allowed Hosts and Denied Hosts lists are blank, access is not allowed to any host.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Allowed Hosts List field.

Type the names of the hosts to which you want to allow access in the edit field and click Add.

The host name is added to the Allowed Hosts List list box.

Click Save at the top or bottom of the page to record the changes.

Configuring the Denied Hosts List

After specifying the list of commonly available hosts under "Configuring a Common Hosts List", you can also specify a list of hosts to which users are denied access through NetFile.

To Create a Denied Hosts List


Note	If you deny access to a host, and a user has already added this host in the NetFile window, the denied host will continue to be displayed in the NetFile window of the user. But the user will not be able to carry out any operations on the host. In NetFile Java2, denied hosts, if displayed in the application, are marked with a red cross to indicate that they are inaccessible.


Note	If both the Allowed Hosts and Denied Hosts lists are blank, access is not allowed to any host.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Denied Hosts List field.

Type the names of the hosts to which you want to deny access in the edit field and click Add.

The host name is added to the Denied Hosts List list box.

Click Save at the top or bottom of the page to record the changes.

Setting File Delete Permissions

You can allow or deny permission for a user to delete files from remote machines. This option is enabled by default.

If you disable this option, the Delete button will not be available to the user in the NetFile Java1 application. The Delete button will be disabled in the NetFile Java2 application.

To Allow File Deletion


Note	If you disable this option after the user has started using NetFile, the change takes effect only if the user logs out of NetFile and logs in again.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the required Allow File Deletion field under Dynamic and select the option.

Selecting the option enables all the users in the selected organization to delete files from the remote machine.

Click Save at the top or bottom of the NetFile page to record the change.

Setting File Rename Permissions

You can set this option to allow the user to rename files on the remote file system. This option is enabled by default.

If you disable this option, the Rename button will not be available to the user in the NetFile Java1 application. The Rename button is disabled in the NetFile Java2 application.

To Set File Rename Permission


Note	If you disable this option after the user has started using NetFile, the change will take effect only if the user logs out of NetFile and logs in again.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the Allow File Rename field and select the option.

Selecting the option enables all the users in the selected organization to rename files on the remote machine.

Click Save at the top or bottom of the NetFile page to record the change.

Allowing User ID Change

This option lets you specify whether a user can use different IDs to connect to hosts using NetFile. In a large organization, users may have multiple user IDs. You may want to restrict users to use a single user ID. In that case, you can disable the Allow Changing User ID option. This prevents all the users in the specific organization from changing their user ID, and limits them to using a single ID (the desktop login ID) to connect to hosts using NetFile. In another situation, a user may have different login IDs on different machines, in which case, you may want to allow the user to change the ID as required.

To Allow User Id Change

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the required Allow Changing User ID field under Dynamic and select the option.

Selecting the option enables all the users in the selected organization to change their user ID if required.

Click Save at the top or bottom of the NetFile page to record the change.

Allowing NT Domain Change

If the user specifies an invalid domain name in the User NT Domain name field while adding a system, an error message displays. If the user edits the host information later, and specifies an invalid domain name, an error message does not appear.

If the user specifies a domain name, the username and password for that domain also needs to be specified. If the username and password for the machine needs to be used, the user needs to remove the domain from the User NT Domain name field.

To Allow Domain Change

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab.

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the required Allow Changing Windows Domains field under Dynamic and select the option.

Selecting the option enables all the users in the selected organization to change their domain if required.

Click Save at the top or bottom of the NetFile page to record the change.

Setting the File Upload Size Limit

You can specify the maximum size of the files that can be uploaded in this field. If the size of the file being uploaded exceeds the limit specified here, an error message is displayed and the file is not uploaded. The default value is 5 MB. If you enter an invalid value, NetFile resets the value to the default.

To Set the File Upload Size Limit


Note	Specify the maximum file size for upload in megabytes. Ensure that you type an integer value.

Select the Identity Management tab.

Select Organizations from the View drop-down list.

Click the required organization name. The selected organization name is reflected as the location in the top left corner of the admin console.

Click the Service Configuration tab

Click the arrow next to NetFile under SRAP Configuration.

The NetFile page is displayed in the right pane.

Scroll down to the File Upload Limit (in MB) field under Dynamic. Type the required size limit in mega bytes.

Click Save at the top or bottom of the NetFile page to record the change.

Enabling Debugging for NetFile

The location of the debug information depends on the setting of the com.iplanet.services.debug.directory attribute in the AmConfig.properties file on the portal server node.

For example, if the value of the com.iplanet.services.debug.directory attribute is:

Then the debug information for NetFile will be available in the srapNetFile file in the /var/opt/SUNWam/debug directory.

Enabling Logging for NetFile

Specify the log location using the Identity Server Logging service to enable logging for NetFile. The name of the log file is srapNetFile. By default it is located in the /var/opt/SUNWam/logs directory.

Configuring Unix Authentication

You need to configure the Unix authentication daemon on the portal server for accessing NFS systems. This is done as follows:

Chapter 4 Configuring NetFile

Overview of NetFile

Supported File Access Protocols

Enabling Access to NetFile

To Enable NetFile for Organizations and Users