Use configured NTFS ACL permissions

LiamBaseClasses/C4IT.LIAM.Base.cs

@@ -80,6 +80,9 @@ namespace C4IT.LIAM
         public string ReadGroupGlobal { get; set; } = "";
         public string ReadGroupLocal { get; set; } = "";
         public string TraverseGroup { get; set; } = "";
+        public int ReadACLPermission { get; set; } = 0x200A9;
+        public int WriteACLPermission { get; set; } = 0x301BF;
+        public int OwnerACLPermission { get; set; } = 0x1F01FF;
 
         public List<cLiamNamingConvention> NamingConventions { get; set; } = new List<cLiamNamingConvention>();
         public Dictionary<string, string> CustomTags { get; set; } = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
@@ -98,6 +101,9 @@ namespace C4IT.LIAM
             To.GroupFilter = From.GroupFilter;
             To.GroupRegEx = From.GroupRegEx;
             To.GroupPath = From.GroupPath;
+            To.ReadACLPermission = From.ReadACLPermission;
+            To.WriteACLPermission = From.WriteACLPermission;
+            To.OwnerACLPermission = From.OwnerACLPermission;
             To.CustomTags = From.CustomTags;
             To.AdditionalConfiguration = From.AdditionalConfiguration;
             To.CustomTags = From.CustomTags;

LiamNtfs/C4IT.LIAM.Ntfs.cs

@@ -1349,10 +1349,17 @@ namespace C4IT.LIAM
                 groupNameSanitizeReplacement = GetAdditionalConfigurationValueOrDefault(
                     AdditionalConfigurationGroupNameSanitizeReplacementKey,
                     Helper.DefaultGroupNameSanitizeReplacement),
-                preserveAdGroupNameCase = IsAdditionalConfigurationEnabled(AdditionalConfigurationPreserveAdGroupNameCaseKey)
+                preserveAdGroupNameCase = IsAdditionalConfigurationEnabled(AdditionalConfigurationPreserveAdGroupNameCaseKey),
+                OwnerACLPermission = this.OwnerACLPermission,
+                WriteACLPermission = this.WriteACLPermission,
+                ReadACLPermission = this.ReadACLPermission
             };
             engine.traverseBoundaryPath = GetEffectiveTraverseBoundaryPath();
 
+            LogEntry(
+                $"NTFS filesystem engine ACL permissions: Owner=0x{engine.OwnerACLPermission:X}, Write=0x{engine.WriteACLPermission:X}, Read=0x{engine.ReadACLPermission:X}",
+                LogLevels.Debug);
+
             foreach (var template in BuildSecurityGroupTemplates())
                 engine.templates.Add(template);
 

LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs

@@ -68,7 +68,10 @@ namespace C4IT.LIAM.Activities
 
                 var dataMain = dataProvider.GetDataList(constFragmentNameConfigProviderMain,
                     "ID, [Expression-ObjectId] as EOID, GCCDomain, GCCTarget, GCCMaxDepth, " +
-                    "GCCgroupLDAPFilter, GCCgroupOUPath, GCCPermissionGroupStrategy, GCCtargetType",
+                    "GCCgroupLDAPFilter, GCCgroupOUPath, GCCPermissionGroupStrategy, GCCtargetType, " +
+                    "OwnerACLPermission.C4IT_EnumValueInt as OwnerACLPermission, " +
+                    "WriteACLPermission.C4IT_EnumValueInt as WriteACLPermission, " +
+                    "ReadACLPermission.C4IT_EnumValueInt as ReadACLPermission",
                     $"[Expression-ObjectId] = '{configEOID}'");
 
                 Guid ConfigClassId = (Guid)dataMain.First()["ID"];

LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs

@@ -300,7 +300,10 @@ namespace LiamWorkflowActivities
                     GroupFilter = cLIAMHelper.getStringFromObject(dataMain["GCCgroupLDAPFilter"]),
                     GroupPath = cLIAMHelper.getStringFromObject(dataMain["GCCgroupOUPath"]),
                     GroupStrategy = (eLiamGroupStrategies)cLIAMHelper.getIntFromObject(dataMain["GCCPermissionGroupStrategy"]),
-                    ProviderType = (eLiamProviderTypes)cLIAMHelper.getIntFromObject(dataMain["GCCtargetType"])
+                    ProviderType = (eLiamProviderTypes)cLIAMHelper.getIntFromObject(dataMain["GCCtargetType"]),
+                    OwnerACLPermission = GetAclPermissionFromDataRow(dataMain, "OwnerACLPermission", 0x1F01FF),
+                    WriteACLPermission = GetAclPermissionFromDataRow(dataMain, "WriteACLPermission", 0x301BF),
+                    ReadACLPermission = GetAclPermissionFromDataRow(dataMain, "ReadACLPermission", 0x200A9)
                 };
                 if (dataAdditional != null)
                 {
@@ -421,6 +424,34 @@ namespace LiamWorkflowActivities
 
         }
 
+        private int GetAclPermissionFromDataRow(DataRow row, string columnName, int defaultValue)
+        {
+            if (row == null || string.IsNullOrWhiteSpace(columnName) || !row.Table.Columns.Contains(columnName))
+                return defaultValue;
+
+            var rawValue = cLIAMHelper.getStringFromObject(row[columnName]);
+            if (string.IsNullOrWhiteSpace(rawValue))
+                return defaultValue;
+
+            var value = rawValue.Trim();
+            try
+            {
+                if (value.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+                    return Convert.ToInt32(value.Substring(2), 16);
+
+                if (int.TryParse(value, out var parsedValue))
+                    return parsedValue;
+            }
+            catch (Exception ex)
+            {
+                LogEntry($"Could not parse ACL permission config value '{columnName}'='{rawValue}': {ex.Message}. Falling back to default '{defaultValue}'.", LogLevels.Warning);
+                return defaultValue;
+            }
+
+            LogEntry($"Could not parse ACL permission config value '{columnName}'='{rawValue}'. Falling back to default '{defaultValue}'.", LogLevels.Warning);
+            return defaultValue;
+        }
+
         public ProviderCacheEntry getDataProvider(Guid ProviderConfigClassID)
         {
             var CM = MethodBase.GetCurrentMethod();