Unable to add additional local sftp user to a child folder within SFTP/Blob container

Question

Unable to add additional local sftp user to a child folder within SFTP/Blob container

Ramkumar Perumal 30 Microsoft Employee

My storage is ADLS Gen2, SFTP is enabled.

I have a child folder named testdirectory1child1 under a container as shown below. (testfolder is the container name).

testfolder/testdirectory1/testdirectory1child1

I have three local SFTP users: test1, test2 and test3. I need to give test1 read access to testdirectory1child1 folder, and test2, and test3 to be given read and write access to testdirectory1child1 folder.

Using the provided documentation, I can only set or change owner for only one test user, but not for all three.

If i change to another user, the previous owner is changed and hence the user lost access.

Alex Burlachenko 4,550 Reputation points

2025-04-01T08:07:40.56+00:00

Dear Ramkumar,

Thank you for your question. May I have an clarifycation your requirement to grant access to all three SFTP users (test1, test2, and test3) for the same child folder (testdirectory1child1). I understand the current limitation where only one local user can be set as owner is impacting your workflow. am I right?

rgds,

Alex
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-01T08:57:27.98+00:00
Hello Ramkumar

I understand that you are utilizing Azure Data Lake Storage Gen2 (ADLS Gen2) with SFTP functionality activated, and you need to configure permissions for multiple SFTP users on a directory hierarchy However, you have observed that the documentation appears to permit only the designation of an owner, while you require the ability to assign varying access levels (read and read/write) to different users.

Please be informed that when SFTP is activated on ADLS Gen2, Azure employs POSIX-style permissions to manage access to files and directories. This system includes the configuration of read, write, and execute permissions for the owner, group, and other users. For more fine-grained control, ADLS Gen2 uses Access Control Lists (ACLs). ACLs allow you to set permissions for specific users or groups, which is exactly what you need in your scenario.

For each of your SFTP users (test1, test2, and test3), you need to identify their corresponding Azure AD user principals. When you create local SFTP users in ADLS Gen2, they are associated with Azure AD users. You'll need the Object ID of these Azure AD users. You can find the Object IDs in the Azure portal (Azure Active Directory > Users) or using the Azure CLI.

Set UP ACL:

Set the ACL for test1 (Read Access): You must provide the user test1 with read permissions for the folder testdirectory1child1. This can be accomplished by configuring the Access Control List (ACL) for the user. Utilize the following command, assuming you are operating within Azure CLI or a comparable tool: az storage fs access set-acl --acl "user:test1:r-x" --path "testdirectory1/testdirectory1child1" --file-system "testfolder"

Set the ACL for test2 and test3 (Read and Write Access): For test2 and test3, you will provide both read and write permissions. This can be accomplished using the commands below: az storage fs access set-acl --acl "user:test2:rw-" --path "testdirectory1/testdirectory1child1" --file-system "testfolder" az storage fs access set-acl --acl "user:test3:rw-" --path "testdirectory1/testdirectory1child1" --file-system "testfolder"

After setting the ACLs, you can verify that the permissions have been set correctly by running: az storage fs access get-acl --path "testdirectory1/testdirectory1child1" --file-system "testfolder"This command will show you the current ACLs for the specified path, and you should see entries for test1, test2, and test3 with the appropriate permissions.

Please be informed that by default, files created within testdirectory1child1 will inherit the ACLs of the directory. If you want more granular control over individual files, you can set ACLs on those files as well. You can also set default ACLs on a directory. Default ACLs determine the ACLs for any new files or subdirectories created under that directory. This can help you ensure that new files and subdirectories automatically inherit the correct permissions.

NOTE: Ownership is generally employed to determine who has authority over a resource, whereas Access Control Lists (ACLs) are utilized to regulate access permissions. In your case using ACLs is the right approach since you have multiple users with different access levels. The permissions are specified in the format user:<username>:<permissions>, where <permissions> can be r (read), w (write), and x (execute).

References: https://techcommunity.microsoft.com/blog/azurepaasblog/how-to-configure-directory-level-permission-for-sftp-local-user/4373620

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-02T06:18:20.0666667+00:00

Hello Ramkumar

Just checking in to see if the provided answer helped. If this answers your query, do click "Up-Vote” for the same, which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-02T07:59:17.16+00:00

Hi Alex Burlachenko, The issue was that I am not able to assign access to multiple local users for single child folder (not at the container level).
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-02T08:00:03.81+00:00

Hi Nandamuri Pranay Teja, I will review and respond after trying the approach you suggested.
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-04T08:14:27.35+00:00

Hello Ramkumar

I would like to check in and inquire whether you have had the opportunity to assess the provided response and if it was beneficial. If this solution addresses your concern, kindly click "up-Vote," as it may assist other community members who come across this discussion. Additionally, if you have further questions, please do not hesitate to reach out.
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-08T05:12:37.77+00:00

Hello Ramkumar

I would like to check in and inquire whether you have had the opportunity to assess the provided response and if it was beneficial. If this solution addresses your concern, kindly click "up-Vote," as it may assist other community members who come across this discussion. Additionally, if you have further questions, please do not hesitate to reach out.

1 answer

Your answer

Alex Burlachenko 4,550 Reputation points

2025-04-01T08:07:40.56+00:00

Dear Ramkumar,

Thank you for your question. May I have an clarifycation your requirement to grant access to all three SFTP users (test1, test2, and test3) for the same child folder (testdirectory1child1). I understand the current limitation where only one local user can be set as owner is impacting your workflow. am I right?

rgds,

Alex
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-02T06:18:20.0666667+00:00

Hello Ramkumar

Just checking in to see if the provided answer helped. If this answers your query, do click "Up-Vote” for the same, which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-02T07:59:17.16+00:00

Hi Alex Burlachenko, The issue was that I am not able to assign access to multiple local users for single child folder (not at the container level).
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-02T08:00:03.81+00:00

Hi Nandamuri Pranay Teja, I will review and respond after trying the approach you suggested.
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-04T08:14:27.35+00:00

Hello Ramkumar

I would like to check in and inquire whether you have had the opportunity to assess the provided response and if it was beneficial. If this solution addresses your concern, kindly click "up-Vote," as it may assist other community members who come across this discussion. Additionally, if you have further questions, please do not hesitate to reach out.
Nandamuri Pranay Teja 2,015 Reputation points Microsoft External Staff

2025-04-08T05:12:37.77+00:00

Hello Ramkumar

I would like to check in and inquire whether you have had the opportunity to assess the provided response and if it was beneficial. If this solution addresses your concern, kindly click "up-Vote," as it may assist other community members who come across this discussion. Additionally, if you have further questions, please do not hesitate to reach out.

Answer 1

Hello Ramkumar Perumal,

The challenge involves enabling multiple local SFTP users to access the same ADLS Gen2 folder without locking out previous owners when folder ownership is changed, thus requiring a method for concurrent access without conflict.

The best workaround is to use ACLs (Access Control Lists) instead of changing ownership. ACLs let you set permissions for multiple users at the same time, so you don’t have to worry about users losing access. (Take into consideration that these are still in preview. This means they might not be fully optimized for production environments yet.)

How to do it:

Enable ACL authorization for your local SFTP users when creating them.
Assign permissions using ACLs instead of changing ownership:( Give test1 read (r) access to testdirectory1child1 and Give test2 and test3 read and write (rw) access to testdirectory1child1)
Apply ACLs using the following SFTP commands ( sftp> setfacl -m u:test1:r testdirectory1child1 )
Verify permissions using: (sftp> getfacl testdirectory1child1)

References:

If the information helped address your question, please Accept the answer. Luis

Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-02T08:00:34.89+00:00

Hi Luis, I will try to setup per the instructions and will respond with update.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-04-18T18:19:27.45+00:00

Hi Luis, Looks like SSH access is blocked for the SFTP and i am unable to setup the acls using setfacl and getfacl. Are there any other options i can try with?

Share via

Unable to add additional local sftp user to a child folder within SFTP/Blob container

1 answer

Your answer