How does name-mapping work when CIFS clients access UNIX security style resources?
Applies to
- ONTAP 9
- UNIX
- CIFS
Answer
- As the user has already been authenticated in the domain, ONTAP needs to build credentials for the user for each newly created CIFS session.
- To build credentials, ONTAP needs to map the Windows user to a UNIX user to be able to lookup the mapped UID and GID(s) via the sources defined in ns-switch
::> vserver services name-service ns-switch show
Source
Vserver Database Order
--------------- ------------ ---------
vs0 hosts files,
dns
vs1 passwd files,
ldap, nis
2 entries were displayed.
- ONTAP will attempt to map the Windows user to a UNIX user in the following order to attempt to lookup the UNIX user's UID and GID(s) via the sources defined in ns-switch.:
- Explicit name-mapping: ONTAP attempts to match the Windows user utilizing string comparison as per the explicit name-mapping 'win-unix' rules defined
::> vserver name-mapping show -vserver SVM01 -direction win-unix
Example:
Vserver: SVM01
Direction: win-unix
Position Hostname IP Address/Mask
-------- ---------------- ----------------
1 test.com - Pattern: EXAMPLE\\administrator
Replacement: nobody
2 - 10.238.2.34/32 Pattern: EXAMPLE\\(.+)
Replacement: \_1
Note: How to create and understand vserver name-mapping rules
- Implicit name-mapping: if no explicit rules are matched, ONTAP attempts to map Windows user against a unix user with the same user name
Example: Windows User 'DOMAIN\USER01' to UNIX user 'User01'
- Default UNIX user: if both methods above fail (e.g. filer cannot pull the UID and GID(s) for the mapped UNIX user), for any reason, the filer will map the Windows user to the "Default UNIX User" which is defined in the CIFS server options.
::> vserver cifs options show -vserver SVM01 -fields default-unix-user
Note: The default unix user is set to 'pcuser' (UID 65534) by default.
- Access is granted or denied based on the UID and GID(s) of the UNIX credentials because the volume is set to UNIX security style.
- To confirm name-mapping:
Example:
::> set -privilege advanced
::*> vserver services access-check name-mapping show -node cluster1-node01 -vserver SVM01 -direction win-unix -name EXAMPLE\Administrator
EXAMPLE\Administrator maps to root