Docroot vs. File Restriction

A transfer user's access to the server's file system can be restricted by configuring a docroot or a file restriction. Though similar, certain Aspera features require that the transfer user have a file restriction rather than a docroot.

Note: A configuration (global, group, or user) can have a docroot or a file restriction; configurations with both are not supported.
  Docroot File Restriction
Required for
  • Server-side encryption-at-rest (docroot in URI format)
  • Connecting the node to IBM Aspera Faspex, IBM Aspera Shares, IBM Aspera Console, or IBM Aspera Application for Microsoft SharePoint
  • Complex file-system access rules
  • Creating access keys with the Node API
  • Connecting the node to IBM Aspera on Cloud
Syntax An absolute pathname that can include a substitutional string. Supported strings:
  • $(name)
  • $(home)

The pathname can be in URI format; special characters must be URL-encoded.

 A set of file system filters that use "*" as a wildcard and "!" to indicate "exclude". Paths are in URI format; special characters in a URI must be URL-encoded.

Access to a file is rejected unless the file matches the restrictions, which are processed in the following order:

  • If a restriction starts with "!", the user is not allowed to access any files that match the rest of the restriction.
  • If a restriction does not start with "!", the user can access any file that matches the filter.
  • If one or more restrictions do not start with "!", the user can access any file that matches any one of the no-"!" restrictions.
Examples

  • As an absolute path:

    /docs

  • With a substitutional string:

    /users/$(name)

  • As a URI:

    s3://s3.amazonaws.com/my_bucket

    or

    file:///docs

  • For a specific folder:

    file:////docs/*

  • For the drive root:

    file:///c*

  • For ICOS-S3 storage:

    s3://my_vault/*

  • To exclude access to key files:

    !*.key

For more examples, see Getting Started with Watch Folders in the Command Line
How to set See Setting Up Users (GUI) or Setting Up Transfer Users (Terminal). See Getting Started with Watch Folders in the GUI or Getting Started with Watch Folders in the Command Line.

URL Encoding Characters

The following reserved characters are often included in passwords and secret keys:

Character ! # $ & ' ( ) * +
URL encoded %21 %23 %24 %26 %27 %28 %29 %2A %2B
Character . / : ; = ? @ [ ]
URL encoded %2C %2F %3A %3B %3D %3F %40 %5B %5D

To URL encode other characters and to encode entire strings at once, you may use the online tool:

http://www.url-encode-decode.com/

Select UTF-8 as the target.