Folder Level permissions on an Azure File Storage (SMB Share) via Azure Function or CLI

Question

We have a custom solution that hosts a bunch of files, that are supposed to be handled in an Azure Storage account. The majority of their lifecycle they sit in Blob storage and access is handled via SAS Token created for Users after authentication and Authorization validation (no problems here).

Now those files need to be copied to an Azure File Share, that is mounted to the client system (to allow Adobe Acrobat interactions). But the files need to reside in specific folders in the File Share with very specific Folder permissions, so that each user can only access their Folder of the global share (similar to any on-premises File Share before the age of cloud).

I was able to activate Identity-based access via AD DS. I can now mount the drive with the Storage File Data SMB Share Elevated Contributor RBAC Role assigned. It allows me to can change Folder permissions on my local machine (so far so good).

Now the question, is there any way how this can be done from within Azure as it will be an on-demand action handled by our Web App and a an existing set of Azure Functions ?

I did try to validate it with an Azure CLI console and run the simplest command "az storage fs access show" but this already fails with permission issues. I also tried multiple Azure Functions with C# to set those permissions. In one of my attempts I used FileSystemAccessRule on a DirectoryInfo Object.

So what is the correct way to set Folder level permissions on a SMB File Share in Azure in an automated way, so that I do NOT have to run any on-premises code ?

Answer 1

After spending a lot of additional hours, I finally found a solution to the issue.

First, you have to use the Azure.Storage.Files.Shares Namespace.

using Azure.Storage;
using Azure.Storage.Files.Shares;
using Azure.Storage.Files.Shares.Models;

var shareClient = new ShareClient(new Uri($"https://{storageAccountName}.file.core.windows.net/{shareName}"),    
	new StorageSharedKeyCredential(storageAccountName, storageAccountKey));
var directoryClient = shareClient.GetDirectoryClient(folderPath);

foreach (var item in directoryClient.GetFilesAndDirectories())
{
    var fileClient = directoryClient.GetFileClient(item.Name);
    // ShareFileProperties properties = fileClient.GetProperties();
    // var permissions = properties.SmbProperties.FilePermissionKey; //to read the existing permissions 

    var smbProperties = new FileSmbProperties
    {
       FilePermissionKey = "1234567890123456789*1234567890123456789"
    };
    var httpHeadersOptions = new ShareFileSetHttpHeadersOptions
    {
        SmbProperties = smbProperties
    };

    await fileClient.SetHttpHeadersAsync(httpHeadersOptions);

I still do not know exactly how to "create" a new FilePermissionKey, as this seems to be 19 digit number * 19 digit number.

But If I read the existing permissions form a different file / folder

var permissions = properties.SmbProperties.FilePermissionKey;

And apply the same value to another File or Folder, it does apply the same permissions.

So only thing left is to explore how I can create those required FilePermissionKey values on demand.