File Server Permissions
The Fileserver Permissions tab is only available for InLoox Self-Hosted installations that use a file server as document storage. The feature is currently marked as Beta.
As a general rule, the InLoox document permissions apply within InLoox only. On the file server itself, access is controlled solely by the Windows folder permissions. A user who has no access to the documents of a project in InLoox — or no access to the project at all — can still open the project folder directly on the file server, for example through a mapped network drive or the UNC path, as long as their Windows account has access to the folder.
The permission sync closes this gap: it transfers the InLoox document permissions to the file server store, so the Windows folder permissions of a project folder match the InLoox permissions of its members.
You need administrator rights to configure the permission sync. The sync changes the Windows permissions of the document root folder and of every project folder below it. Review the settings with your file server administrator before you activate the sync.
How the permission sync works
- InLoox assigns the Windows permissions of a project folder to the Windows accounts of the InLoox users.
- A user with read access to the project and to the documents receives read access to the project folder. A user with write access to the project and to the documents additionally receives write access to the folder. A user without access to the project loses access to the folder.
- Locked and recycled projects are never granted write access.
- After the activation, InLoox applies the permissions of all file server projects once and updates them automatically afterwards — for permission changes, new projects, and renamed or moved project folders.
Prerequisites
- InLoox Self-Hosted uses a file server as document storage.
- The Windows account that InLoox uses to access the file server has Full control on the document root folder. This is the account whose domain, user name, and password you entered together with the UNC path in the document storage step of the InLoox Self-Hosted Server installer — see Configure Document Storage. The permission sync uses this account to change the Windows permissions of the root folder and of every project folder below it. Read and write access is not sufficient: without Full control, InLoox cannot change the permissions there and the activation fails.
- Every user who needs access to a project folder has a Windows account and has linked it to their InLoox profile. InLoox uses the Windows security identifier (SID) of the linked account — see Enable Windows Authentication (Single Sign-On).
Open the file server permissions
- Click on your profile picture in the upper-right corner of InLoox.
- Click on Account Settings.
- Click on Documents.
- Click on the Fileserver Permissions tab.
Prepare the Windows accounts
Users who link their Windows account after the tab was made available receive their SID automatically when they sign in. For users who had already linked their Windows account, load the SIDs once:
- Open the Fileserver Permissions tab.
- Click Synchronize in the One-time setup message.
InLoox collects the SIDs in the background and updates the list while it works. The message disappears once the request has been recorded.
Users without Windows account
The Users without Windows account section lists all users who have no SID yet, with their display name and e-mail address. InLoox cannot assign permissions on the file server to these users. Ask them to link their Windows account under My Profile > Settings in the Linked Accounts section.
Windows accounts shared by multiple users
The section Windows accounts (SIDs) shared by multiple users lists SIDs that are assigned to more than one InLoox user. If one of these users changes, the permission sync applies only the access of that user to the shared SID, which can remove or reduce the access of the other users. Assign every user a Windows account with its own SID.
Exclude accounts from the sync
Accounts on the Ignored SIDs list are never changed by the permission sync: InLoox neither sets nor removes their permissions on the file server store. Use the list for central administrative groups and service accounts.
- Open the Fileserver Permissions tab.
- In the Ignored SIDs section, click .
- Enter the SID in the Add SID dialog, for example
S-1-5-32-544, and confirm. - To document the entry, click in the Note column and enter a note.
To change an entry, click in the SID column or in the Note column. To delete an entry, click the red and confirm.
Changing the list affects the permissions of all file server projects. While the sync is active, InLoox queues every file server project again and reapplies its permissions.
Set folder navigation
The Folder navigation setting applies to the accounts that already had access to the document folder before the activation: they keep browse-only access to the root folder. Select whether this also covers the subfolders between the root folder and the project folders.
- Browse folder hierarchy — Users can navigate through the intermediate folders, for example a year or a division, to their project folders. Recommended.
- Direct access only — Browse access is limited to the root folder itself. Users open their project folders in InLoox or through a direct link.
If the sync is active, InLoox applies a change to the root folder immediately. Otherwise the setting is applied when you activate the sync.
If users access the file server directly through File Explorer, they may still see the folders of projects they have no access to. Whether these folders are displayed depends on the underlying file system. For an SMB share, you can limit the display to the folders the user has access to with the following PowerShell command:
Set-SmbShare -Name <ShareName> -FolderEnumerationMode AccessBased
Replace <ShareName> with the name of your share.
InLoox does not provide support for manual changes to the file server configuration.
Activate the permission sync
Activating the sync breaks the permission inheritance of the document root folder. Accounts that already had access keep browse-only access, all other accounts lose their access to the document folder. Test the sync in a test environment before you activate it in production.
- Open the Fileserver Permissions tab.
- In the Permission sync section, click Activate permission sync.
InLoox prepares the root folder and queues all file server projects — including archived and recycled projects — for a permission update. The message shows how many projects were queued, and the section displays the status Active.
InLoox processes the queued permission updates in the background. As long as updates are pending, the Permission sync section shows how many are waiting. Click Process now to start the processing immediately.
Deactivate the permission sync
- In the Permission sync section, click Deactivate.
InLoox stops applying permission changes to the file server. Permissions that were already applied are not restored. Pending updates stay in the queue and are applied the next time you activate the sync.
Projects outside the document folder
The permission sync can only protect folders below the document folder that is configured for the file server. The Projects outside the document folder section lists every project whose project folder is not below this folder, with the project number, project name, and path. Move the documents of these projects or correct the folder path of the project. Otherwise the permission sync cannot protect these folders.
Check the permission sync log
The Permission sync log section is the diagnostic log of the sync. Entries are kept for 30 days and show the time, the level (Information, Warning, Error, or Critical), the message, the path, and the exception of every step.
- If errors or warnings occurred in the last 30 days, a message with the number of entries is displayed at the top of the section. Click the message to filter the list for that level.
- Enter a search term to search the messages and the exception details.
- Click Download log to export the entries.
An entry with the level Error and the message that the configured account is not allowed to change permissions means that the Windows account of InLoox is missing Full control on the document folder.