Group configuration options are modified in a similar way to any account configuration option.
Group configurations are not forced upon accounts belonging to the group. Group configurations are optional, they are used to specify the actual values for account configuration options set as Inherit.
The only exception of forced configuration is the enabled option. When a group is disabled, all accounts will be disabled.
Accounts can overwrite group configuration at any time by defining a value other than Inherit.
There are few differences in changing groups configuration, and they are described on this page.
The configuration file must define the following group: DEFAULT_GROUP.
Besides acting like any other group and allowing association with any account, the DEFAULT_GROUP is also automatically associated to all application or operating system accounts for which a group was not explicitly configured.
The default group cannot be renamed and it has the special UUID and name DEFAULT_GROUP.
Here is an example configuration for the DEFAULT_GROUP:
[groups/DEFAULT_GROUP]
name = DEFAULT_GROUP
enabled = Yes
description = Default group for all accounts.
lock_in_home_folder = Yes
home_folder_path = c:\partners\${USER}
create_home_folder = No
create_home_folder_owner = ${DEFAULT_OS_USER}
create_home_folder_group = ${DEFAULT_OS_GROUP}
; SSH key authentication is disabled by default
ssh_authorized_keys_path = Disabled
allow_certificate_authentication = No
Adding a new group is done by creating a new section inside the configuration file. The name of the section should be prefixed by groups/ and followed by the group’s UUID.
The group’s UUID can be any unique string used to identify the group. Once defined, the UUID should not be changed.
For more information about UUIDs, please see the dedicated UUID documentation.
For example, to add a new group named partners
[groups/804aab78-70c0-4e1d-8480-4979e169a0a2]
name = partners
enabled = Yes
description = Group dedicated for partners accounts.
home_folder_path = /BASE/FOLDER/FOR/PARTNERS
| Default value: | ‘’ |
|---|---|
| Optional: | No |
| From version: | 2.0.0 |
| Values: |
|
| Description: | Human-readable short string used to identify this group. |
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 1.8 |
| Values: |
|
| Description: | This option specifies whether or not to disable all accounts belonging to the group. When set to No, all accounts from this group will be disabled. |
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 1.7 |
| Values: |
|
| Description: | This is a free form text for attaching notes or a description to this group. Example: [groups/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = OS file transfer
description = OS accounts with access to the file server.
|
| Default value: | ‘’ |
||
|---|---|---|---|
| Optional: | Yes |
||
| From version: | 1.6 |
||
| Values: |
|
||
| Description: | This option specifies the path to the base folder, where the files for this group’s accounts are stored. The home folder is used as the initial current folder for new connections. It may contain the ‘${USER}’ placeholder which will be replaced with the user’s name for each account. If the defined path value does not contain the ${USER} placeholder, the placeholder is automatically appended to the end of the path. In this way all users from the group will have different home folders. This is why c:\Users has the same effect as c:\Users\${USER} When set to Disabled it will require each account associated with the group to define its own home folder path. When defined, it should be defined as an absolute path.
On Windows: c:\Users\${USER}\reports will be mapped as c:\Users\some_user\reports for the account named some_user. On Unix /home/${USER}/reports will be mapped as /home/some_user/reports for the account named some_user. When defining the home_folder_path for a group, the accounts belonging to it should use the Inherit value, otherwise the group values will not be applied. For a better understanding, please follow the explanations and examples on properties inheritance. Warning The ${OS_HOME} option is not available for Windows XP and Windows Server 2003. On these systems you need to configure an explicit home folder path. It is however available on Windows 2008 and newer systems. For domain accounts, the server cannot automatically create missing Windows home folders, also known as user profiles. Because of this, you cannot use the ${OS_HOME} placeholder when configuring the home_folder_path for a domain account. For domain accounts, a regular folder can be set as home_folder_path. The folder can be automatically created, just as for regular accounts. |
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 1.6 |
| Values: |
|
| Description: | This option enables you to decide whether the accounts belonging to this group are allowed access outside the home folder or not. This is only valid for operating system accounts, as application accounts are always locked in home folder. |
| Default value: | No |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | This option specifies whether or not the server should create the home folders for the accounts belonging to the group, in the case that they are missing. If this option is set to No the server will deny access to users for which the home folder is not already created. When set to Yes the server will try to create missing home folders for users that have been successfully authenticated. |
| Default value: | ${DEFAULT_OS_USER} |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | When the server is configured to automatically create missing home folders, this option specifies who the owner of the newly created folder should be. When this value is set to ${DEFAULT_OS_USER}, the folder owner will be set to the default value specified by the operating system. |
| Default value: | ${DEFAULT_OS_GROUP} |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | When the server is configured to automatically create missing home folders, this option specifies what operating system group should be associated with the newly created folder. When this value is set to ${DEFAULT_OS_GROUP}, the folder group owner will be set to the default value specified by the operating system. Note On Windows operating systems, ${DEFAULT_OS_GROUP} is defined as the Users group. Please contact us in the case that you need a different behaviour. |
| Default value: | Disabled |
|---|---|
| Optional: | Yes |
| From version: | 1.7.0 |
| Values: |
|
| Description: | This option specifies whether or not the server will permit access using a list of known SSH keys for each user. More details about SSH key authentication can be found in the dedicated section. When the defined value does not contain the ${USER} placeholder, the placeholder is automatically appended at the end of the path. In this way all users from the group will have different SSH authorized files. This is why for example setting the value to c:\Path has the same effect as c:\Path\${USER} |
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 1.8.1 |
| Values: |
|
| Description: | Allow this group to authenticate using SSL certificates. Certificates need to be issued using the same Common Name field (CN) as the account name. If SSL certificate base authentication is not enabled, accounts belonging to this group will have to use other means of authentication. |
The enabled configuration option affects the state of all users from that group.
For example, the following configuration will enable all accounts from the accounting group, while disabling access to the server for any account from the partners group:
[groups/0a3f3aa7-50d2-44ef-9456-4f0beb69cf7d]
name = accounting
enabled = Yes
[groups/804aab78-70c0-4e1d-8480-4979e169a0a2]
name = partners
enabled = No
While a group is enabled, specific accounts can be disabled by setting the enabled property for those specific accounts.
The home_folder_path and ssh_authorized_keys_path group options may contain the ${USER} placeholder which will be replaced with the name for each account. If the value for this option does not contain ${USER}, the home folders will be sub-folders of the configured folders.
For example, in the following configuration:
[groups/2fd149b3-9fdb-49d0-8666-3c28f151f64d]
name = partners
enabled = Yes
home_folder_path = /home/${USER}/reports
[accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = john
enabled = yes
type = application
group = 2fd149b3-9fdb-49d0-8666-3c28f151f64d
home_folder_path = Inherited
The home_folder_path for account john will be mapped as /home/john/reports.
If the home_folder_path defined for a group does not contain the ${USER} placeholder, the account name will be appended to the path defined by the home_folder_path. For example, in the following configuration:
[groups/2fd149b3-9fdb-49d0-8666-3c28f151f64d]
name = partners
enabled = Yes
home_folder_path = c:\Users
[accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = john
enabled = yes
type = application
group = 2fd149b3-9fdb-49d0-8666-3c28f151f64d
home_folder_path = Inherited
[accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f5]
name = ben@dc-domain
enabled = yes
type = os
group = 2fd149b3-9fdb-49d0-8666-3c28f151f64d
home_folder_path = Inherited
The home_folder_path for account john will be mapped as c:\Users\john.
The home_folder_path for account ben@dc-domain will be mapped as c:\Users\ben.DC-DOMAIN.
For groups, setting home_folder_path to c:\Users has the same effect as setting it to c:\Users\${USER}. When the ${USERS} placeholder is not used, it is automatically appended to the group’s home folder path.