ACL Permissions through Windows GUI, can only set on Domain PC

[JayG30]

Hello,
I'm experiencing something that seems a bit strange to me on the latest FreeNAS 9.2.1.7-Release.

I have datasets that are set to use Windows ACL. I go to change the permissions through the Security tab in Windows. If I do so from a computer that is connected to the domain (lets call it internal.local) then everything works fine. I can change permissions by being the root user (owner) or my login which is part of a group I made for admins with full permissions. The important part though is if I try to ADD another user or group and I type it into the search field it returns a result of freenas/user or freenas/group. It doesn't prompt me for a login or anything, it just works.

HOWEVER, if I try to do the same thing from any computer not connected to the domain (say my personal laptop) that is simply part of a default Microsoft WORKGROUP, then what happens is I get prompted for a login when I try to search for the user or group. I've tried various logins and nothing works. The search returns nothing. I can however alter existing permissions and owners of folders so permissions must be being recognized on these machines not part of the domain, just can't search users or groups and add them.

I do not have AD configured at this time. Everything is freenas users and groups. What I have done is add an A record to the internal DNS to point the IP to FreeNAS. Global Configuration for FreeNAS has the domain set to internal.local (for our example) and hostname to freenas. System Information tab shows Hostname as freenas.internal.local. CIFS has workgroup set to WORKGROUP.

Has anyone ever seen this or have an ideas? I've tested out various settings to no avail.

Thank You.

 

[anodos]

Let me clarify.

• Your network currently has an AD domain 'internal.local'
• Your FreeNAS server is configured as a standalone server 'freenas.internal.local' and a member of 'workgroup'.
• Members of domain 'internal.local' can authenticate but nonmembers can't.

Can you authenticate if you navigate to server by ip?

 

[JayG30]

Almost. When a user attempts to access a share folder they enter the freenas local account info, not domain login. That works fine regardless of what computer you are on.

The problem is noticed when you attempt to set ACL permissions through the windows security tab on a computer that has not been joined to domain internal.local. If you try to search a freenas user or group you get a windows popup to login but nothing works and you can't find anything. Do the same from a PC on the domain and it works.

Accessing by IP didn't change anything.

If I have time I'll make a video to demonstrate.

 

[anodos]

Is your laptop logged in as a user that has "full control" of the share in question? Typically on a stand-alone server I will ensure this by setting dataset ownership with my user as owner.

 

[JayG30]

I believe so. Like I mentioned I can actually change permissions in the shares if those permissions already exist. So if group A had read permission already on the share then I'm able to give them write or remove them. But if I try to search for a new user or group it doesn't work.