SMB Connector

Overview

Used for OneTrust Data Discovery, the SMB connector connects to Server Message Block (SMB) storage options and can be used to scan file system information directly from those file systems.

Pod Residency

storage-scanner

Connection Method

SMB2

Note:

SMB1 is a legacy protocol. See SMB1 Legacy Support for guidance.

SMB2 is now enabled by default starting with version 202504.1.0. SMB3 is also supported.

Supported Scan Actions

Scan Type

Description

Catalog

This will fetch the list of shares and folder/files present in those shares. It collects the metadata for these objects and sends it back to the main OneTrust app.

Catalog & Scan

This will fetch the list of shares and folder/files present in those shares. Metadata is collected and then content extraction. It will return personally identifiable information (PII), data elements (DE), and terms as per the classification label identified.

Credentials & System Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources.

Permissions

  • User Authentication

  • Read-only

Basic JSON

JSON 
{
	"connectionUrl": "smb://1.1.1.1",
	"username": "your_username",
	"password": "your_password"
}
Important:

Discovering SMB shares automatically requires permission to access the IPC$ administrative share. If this access is restricted, shares will not be discovered automatically and must be provided explicitly in the vault configuration.

Configuring Domains

If your SMB server requires a domain as part of the authentication, instead of including it directly in the username field (e.g., DOMAIN\\USERNAME), you must now provide the domain separately using the property smbj.domain. More details available in the Additional Parameters section below.

JSON 
Basic JSON with domain
{
    "connectionUrl": "smb://1.1.1.1",
    "username": "your_username",
    "password": "your_password",
    "smbj.domain": "your_domain"
}

Configuring Parameters

In the credentials JSON, you can define several parameters to control how the SMB client interacts with the target SMB server. While our SMB connector is designed to automatically handle most SMB scenarios, there are edge cases (particularly when connecting to legacy or non-standard servers) where manual configuration might be required. These parameters allow for tuning the behavior of the SMB client for compatibility, performance, and security.

SMBj Parameter

Description

Default Value

Equivalent in JCIFS-ng

smbj.encryptData

Requires all SMB sessions to use encryption (if the server supports it). Ensures end-to-end encrypted communication using SMB 3.x's encryption capabilities.

true

jcifs.smb.client.encryptionEnabled

smbj.signingRequired

If set to true, requires message signing on all SMB connections. Enhances integrity by ensuring messages are not tampered with in transit.

false

jcifs.smb.client.signingPreferred

smbj.dfsEnabled

Enables support for accessing DFS (Distributed File System) shares. DFS allows logical grouping of network shares across multiple servers.

false

jcifs.smb.client.dfs.disabled (inverse)
Note:

SMB encryption adds security but can impact performance and compatibility. SMB signing offers better performance with tamper protection, but no snooping protection. Disabling both gives the best performance but minimal security. If SMB encryption is enabled, it overrides signing, providing the same tamper protection.

JSON with Custom Parameters

JSON 
{  
    "connectionUrl": "smb://40.117.99.62/",  
    "smbj.encryptData": "false",  
    "smbj.dfsEnabled": "true",   
    "password": "< >",  
    "username": "< >"
}

Additional Parameters

SMBj Parameter

Description

Default Value

Equivalent in JCIFS-ng

smbj.domain

Domain name used during authentication. This is usually required in Active Directory environments.

"" (empty string)

jcifs.smb.client.domain

smbj.dialects

Comma-separated list of supported SMB protocol versions (e.g. SMB_2_1,SMB_3_0). Restricts negotiation to specific dialects.

SMB_2_0_2 and above

jcifs.smb.client.minVersion / maxVersion

smbj.multiProtocolNegotiate

Enables compatibility mode for servers that require legacy SMB1-style protocol negotiation before upgrading to SMB2+. Helps with older servers.

true

Not available

smbj.readBufferSize

Size in bytes for reading data from the server. Increasing this may improve performance for large file reads.

65536

jcifs.smb.client.rcv_buf_size

smbj.writeBufferSize

Size in bytes for writing data to the server. Larger values may improve performance for large file writes.

65536

jcifs.smb.client.snd_buf_size

smbj.bufferSize

General-purpose buffer size for file operations. Acts as an internal buffer for reading/writing large blocks of data.

1048576

Not available

smbj.readTimeout

Maximum time (in milliseconds) the client will wait when reading from the server before timing out. Helps avoid hangs due to slow reads.

60000 (1 minute)

jcifs.smb.client.responseTimeout

smbj.socketTimeout

Timeout (in milliseconds) for socket-level operations. If 0, no timeout is applied.

0 (no timeout)

jcifs.smb.client.soTimeout

smbj.connectTimeout

Timeout (in milliseconds) applied when attempting to establish a new connection to the SMB server.

0 (no timeout)

jcifs.smb.client.connTimeout

smbj.clientGuid

Optional GUID to uniquely identify the SMB client during negotiation. If not set, a random GUID is generated. Useful for traceability in logs.

Randomly generated

Not available
Note:

SMBj Client does not expose configuration parameters in the same way JCIFS does. To address this, we created a similar parameter structure based on the options available in the SMBj client, using the official SmbConfig.Builder documentation as reference.

Scan Profile Support

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

  • Max Number of Shares

  • Max Number of Folders Per Share

  • Max Number of Files per Share

Scope

You can also narrow down the scope for you scan by using these fields of scan profile.

Scope

Description

Min/Max File Size

You can provide the Minimum and Maximum file size with appropriate unit to be scanned in this field. By default, If these fields are left empty, there will not be any limit on file size for Catalog.

Incremental Scan

You can perform incremental scan which will only catalog and scan items on or before the last modified date time period specified.

Include/Exclude File Types

You can provide the File extensions in this field which you are not at all interested to scan. We expect to provide these extensions in comma separated format.

Include File Paths

Share: A share name can be given here which needs to be included. Wildcard is supported. It can be kept empty or “*“ can be given if all the shares has to be scanned. Giving “Share*“ will allow user to scan all the share starting with prefix Share (e.g. Share1 and Share2).

Folder: A particular folder path can be given here which needs to be included in scan. It can be kept empty or “*“ can be given if all the folders has to be scanned. Giving /folder/childFolder* will allow user to scan all the folders having prefix /folder/childFolder in their path (e.g. /folder/childFolder1 and /folder/childFolder2).

File: A particular fileName can be given here which needs to be included in scan. It can be kept empty or “*“ can be given if all the folders has to be scanned. Giving /fileName* will allow user to scan all the files having prefix folder /fileName in their name (e.g. /fileName1.txt and /fileName2.pdf).

Exclude File Paths

Share: A share name can be given here which needs to be excluded. Wildcard is supported. “*“ will lead to not to scan anything. Keeping it Empty won’t be having impact. Giving “Share*“ will allow user to not to scan all the share starting with prefix Shar (e.g. Share1 and Share2).

Folder: A particular folder path can be given here which needs to be excluded in scan. “*“ will lead to not to scan anything. Keeping it Empty won’t be having impact. Giving /folder/childFolder* will allow user to not to scan all the folders having prefix /folder/childFolder in their path (e.g. folder/childFolder1 and /folder/childFolder2).

File: A particular fileName can be given here which needs to be excluded in scan. “*“ will lead to not to scan anything. Keeping it Empty won’t be having impact. Giving fileName* will allow user to not to scan all the files having prefix folder fileName in their name (e.g. fileName1.txt and fileName2.pdf).

Include/Exclude Path Configuration

Users can start/end any fields of Include/Exclude Paths fields with forward slash.

OneTrust sanitizes and handles adding/removing of '/'s in path.

Collected Objects

Objects

  • Share: A shared folder on the network via SMB protocol

  • Folder: Nested folders in share

  • Files: Files directly inside a share or folders

    Note:

    Hidden files are supported and scanned.

Collected Fields

Objects

Fields

Files

  • Name

  • Modified Date

  • Accessed Date

  • Created Date

  • File Owner

  • Size on Disk (Files Only)

  • Content Type

  • Parent Object

  • Path

Scanning Shares

The vault JSON involves two distinct formats:

1. Scanning the Entire SMB Share

If you intend to scan the complete SMB share, you should adhere to the format provided below. It's important to note that the share name can be defined within both the exclude and include filters. For instance, suppose you possess three shares named MY-SHARE-1, MY-SHARE-2, and MY-SHARE-3. If the requirement entails scanning only MY-SHARE-1 and MY-SHARE-2, then MY-SHARE-3 can be designated as part of the exclusion criteria.

Second scenario, in cases where you solely desire to scan MY-SHARE-1, you can specify MY-SHARE-1 as an inclusion filter. The remaining aspects, such as inclusion and exclusion, will remain consistent.

Alternatively, in case you are looking to scan the complete smb server, you do not need to specify the share name.

JSON 
{ 
    "connectionUrl": "smb://10.152.10.37", 
    "username": "SVC_OneTrust_Liberty", 
    "password": "PASSWORD" 
}

2. Scanning Specific Shares

In instances where you wish to scan a specific share without utilizing the previously mentioned format, this objective can be accomplished through an alternative method. By incorporating the share name into the connection URL, the desired outcome can be achieved. It's important to note that the file filtering process will operate in a manner similar to the previously described method; however, it's essential to exclude the site name from both the inclusion and exclusion filters.

JSON 
{ 
    "connectionUrl": "smb://10.152.10.37/<SHARE-NAME>", 
    "username": "SVC_OneTrust_Liberty", 
    "password": "PASSWORD" 
}

SMB1 Legacy Support

OneTrust is currently enabling SMB2 by default in 202504.1.0, but for customers who are still using SMB1, we have introduced a configuration option to continue using the legacy SMB client (JCIFS) that still supports SMB1.

Switching SMB Clients

You can switch between the two clients by using the smbClientEnabled parameter. The following values are accepted:

  • "smbj" - for SMB2 and SMB3 (default)

    JSON 
    #The smbClientEnabled parameter is optional since it defaults to "smbj".

{
  "connectionUrl": "smb://host/",
  "smbClientEnabled": "smbj",
  "password": "<REDACTED>",
  "username": "ot-dev-user"
}

  • "jcifs" - for SMB1 (legacy)

    JSON 
    {
  "connectionUrl": "smb://host/",
  "smbClientEnabled": "jcifs",
  "password": "<REDACTED>",
  "username": "ot-dev-user"
}