Controlling CIFS access to symbolic links

About Widelink entries

What Widelink entries are

Widelink entries are another way to redirect absolute symbolic links on the filer. You create Widelink entries in the /etc/symlink.translations file. Widelink entries allow CIFS clients to follow absolute symbolic links to target destinations either on the same filer or outside the filer. This is enabled on a per-share basis.

Requirements for Widelink entries

Widelink entries have the following requirements:

The share in which the absolute symbolic links are located must be enabled for wide symbolic links.
In order to resolve an absolute symbolic link, there must be a Widelink entry in the /etc/symlink.translations file that determines the destination of the link.
The destination of the Widelink entry must be one of the following:
- The same share as the symbolic link
- Another share on the same filer
- A share on another filer
- A share on another CIFS server or desktop PC
The CIFS client must have client-side support for Microsoft Distributed File System (DFS). Windows NT and later clients support DFS by default.

Using Widelink entries

To follow Widelink entries, the CIFS client automatically requests and receives a DFS referral from the filer to establish an authenticated connection with the target share. This preserves NT share security for both the symbolic link and the destination. Once the connection is established, the CIFS client can make new requests directly to the target share or server, thereby increasing performance.

If you have both Map entries and Widelink entries in the symlink.translations file, the filer will use the first matching entry it finds.

Limitations

Widelink entries have the following limitations:

If the destination of the wide symbolic link is a file, it will be displayed as a directory in directory listings. The system API for opening the file will correctly follow the wide symbolic link, but this may confuse certain applications. To avoid this problem, create a wide symbolic link that resolves to a directory, rather than a file.
Windows 95, Windows 98, and Windows ME clients cannot follow a wide symbolic link to another wide symbolic link.
Windows NT clients cannot display or modify ACLs in a share enabled for wide symbolic links. This restriction does not apply to Windows 2000 and later clients.
Wide symbolic links cannot direct a client to a non-shared area on the destination machine.

For more information

For information about how to create Widelink entries to redirect symbolic links, see Redirecting absolute symbolic links. For information about how to enable a share for wide symbolic links, see Sharing directories on the filer.