Update on this: after a long investigation, I heard back from IT services. Their message:
"Having taken a look at the 'permission denied' issue you've been having when trying to do in place imports, it looks like it is being caused by an incompatibility between Omero and SMB versions greater than 1.
By default, our provided VMs use SMB protocol version 3 when mounting to external SMB shares, the reason for this is that SMB1 is considered insecure and support for this has been deprecated by the Storage Team.
I have not had the chance to narrow down the exact file operation that Omero it trying to carry out when doing in place imports using soft symbolic links, but it looks to be related to a flush operation.
I set up a test install of Omero and a test Samba server so I could enable debug logging. When trying an import with the remote share mounted using SMB3, the following error gets logged on the Samba server
[2018/06/15 08:58:45.431921, 10, pid=7573, effective(1003, 1003), real(1003, 0)] ../source3/smbd/smb2_server.c:2279(smbd_smb2_request_dispatch)
smbd_smb2_request_dispatch: opcode[SMB2_OP_FLUSH] mid = 186821[2018/06/15 08:58:45.431969, 10, pid=7573, effective(1003, 1003), real(1003, 0)] ../source3/smbd/smb2_flush.c:134(smbd_smb2_flush_send)
smbd_smb2_flush: u1473606/RPE1Sec61gfp_16_11_17/RPE1-ser61bGFP_siRDNA_noco_wash1H_2_4_R3D.dv - fnum 2286971918
[2018/06/15 08:58:45.431998, 3, pid=7573, effective(1003, 1003), real(1003, 0)] ../source3/smbd/smb2_server.c:3120(smbd_smb2_request_error_ex)
smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../source3/smbd/smb2_flush.c:78
When changing the protocol to use SMB1, this does not occur and the import succeeds, without issue. I have also tried this using a Windows server to provide the share, to rule out any issues with Samba, and the same behaviour occurs."
They've also sent me the import log and smbd log (
https://pastebin.com/TQTg0nHv and
https://pastebin.com/xTfVi6pC)
It seems like using SMB1 version is the only thing that made the symlink problem go away, but we are (of course) a bit wary about using SMB1. Is in-place importing from an SMB3 share a known issue?