Description
The 'Everyone' Permission on the Stub Share
You will need to manually add the 'Everyone' group to the stub share with read/write permission, but then remove the NTFS permissions for the 'Everyone' group that is added as a result of applying the share.
The Veritas Alta SaaS Protection Retrieval Service will automatically set permissions on the stub share and automatically update them on an hourly basis. However, if you are installing a fresh HCS instance using a new service account, you may want to prompt Veritas Alta SaaS Protection to update the stub share permissions instead of waiting for the hourly maintenance job. To force the permissions to update, you will need to visit the Retrieval Service configuration interface. To do this, follow these steps:
- Open Retrieval Service GUI
- Select Advanced tab
- In the Link-based Stubbing settings, ensure the stub share's path is entered and then select the button 'Force Permissions Update...'
The stub share simply contains seamless stubs that are offline files. The Retrieval Service uses reparse points within the stub share's offline files to make a recall request to Veritas Alta SaaS Protection in the cloud for the full item.
Retrieval Authorization Checking
The 'everyone' permission on the stub share does not mean that any user in the organization can access all content or that the stub share is somehow a vulnerability!
The offline files in the stub share have a numerical file path and no distinguishing metadata.
When "Require Authorization for Stub Retrieval" is enabled, on each stub retrieval request, Veritas Alta SaaS Protection performs a data-level authorization check in the cloud to confirm that the requestor has permissions to the file in question. Thus, it is necessary for stub retrieval security authorization to pass that the requesting user is a domain account that is synchronized to Veritas Alta SaaS Protection via Azure Active Directory. If this is not true, then Veritas Alta SaaS Protection's authorization check will fail for the user, even if they are allowed access on-premises because the identity and/or permissions have not yet synchronized to the cloud.
Unrecognized Retrieval Users
It is possible that some retrieval request scenarios will fail authorization. This is typically because the user account making the retrieval request is unknown to Veritas Alta SaaS Protection.
Optionally, you may whitelist certain accounts. Accounts that have experienced failed authorization into Veritas Alta SaaS Protection will be listed in the Admin Portal where there is the option of adding them to the whitelist.
Was this content helpful?
Translated Content
Please note that this document is a translation from English, and may have been machine-translated. It is possible that updates have been made to the original version after this document was translated and published. Veritas does not guarantee the accuracy regarding the completeness of the translation. You may also refer to the English Version of this knowledge base article for up-to-date information.