Updating the docroot or restriction of a running Watch Folder service

If aswatchfolderadmin returns the error code "err=28672" when you try to create a Watch Folder, confirm that the user's docroot or restriction allows access to the source directory specified in the JSON configuration file. You might have specified a destination that is not permitted by the docroot or restriction of the user that runs asperawatchfolderd, or you might have no docroot that is configured at all.

About this task

These instructions describe how to retrieve the docroot or restriction configuration for the user and update the docroot or restriction, if necessary. The configuration change automatically triggers asperawatchd that is associated with the user to restart.

Procedure

  1. Run the following command to retrieve the docroot or restriction setting for the user: 
    #/opt/aspera/bin/asuserdata -u username | grep "absolute"
    • If no docroot is configured for the user, no output is returned. Proceed to the next step to set a docroot or restriction.
    • If a docroot is configured, the command returns output similar to the following: 
      canonical_absolute: "/"
absolute: "/"
    • If a restriction is configured, the command returns output similar to the following: 
      file_restriction: "file:////*"

    If the user's docroot or restriction does not permit access to the source folder, proceed to the next step to update the docroot.

  2. Configure a docroot or file restriction for the user.
    Docroots and path restrictions limit the area of a file system or object storage to which the user has access. Users can create Watch Folders and Watch services on files or objects only within their docroot or restriction.
    Note: Users can have a docroot or restriction, but not both or Watch Folder creation fails.

    Docroots can be set up in the GUI or command line. In the GUI, click Configuration > Users > username > Docroot and set the permitted path as the value for Absolute Path. To set up a docroot from the command line, run the following command:

    # asconfigurator -x "set_user_data;user_name,username;absolute,docroot"

    Restrictions must be set from the command line:

    # asconfigurator -x "set_user_data;user_name,username;file_restriction,|path"

    The restriction path format depends on the type of storage. In the following examples, the restriction allows access to the entire storage; specify a bucket or path to limit access.

    Storage Type Format Example
    local storage For Unix-like OS:
    • specific folder: file:////folder/*
    • drive root: file:////*
    For Windows OS:
    • specific folder: file:///c%3A/folder/*
    • drive root: file:///c*
    Amazon S3 and IBM Cloud Object Storage - S3 s3://*
    Azure azu://*
    Azure Files azure-files://*
    Alibaba Cloud oss://*
    Google Cloud gs://*

    With a docroot or restriction setup, the user is now an Aspera® transfer user. Restart asperanoded to activate your change:

    Run the following commands to restart reload asperanoded: 
    # systemctl restart asperanoded
    or for Linux® systems that use init.d: 
    # service asperanoded restart