How does the ONTAP NFS credential cache work?
Applies to
- ONTAP 9
- NFS
Answer
- When a client accesses the node (nblade), ONTAP will check if the cached entry exists. 
    - If the cache exists, the credential is served from the node cache.
- ONTAP will then check if the cache is expired.
        - If expired, ONTAP will then check the global cache otherwise known as the cluster cache.
            - If the global cache exists, ONTAP will check if the user (passwd) exists.- If the user exists, ONTAP will check if the user has group membership.
                    - If no group membership exists, ONTAP will query (group)for the groups.- Upon successful query, ONTAP will synchronize the global cache.
 
- If yes, ONTAP will synchronize the global cache.
 
- If no group membership exists, ONTAP will query 
- The user does not exist, ONTAP will query (passwd) for the user. 
                    - Once the user is successfully queried, ONTAP will repeat the cycle and check if the user has group membership. 
                        - If no group membership exists, ONTAP will query (group) for the groups. 
                            - Upon successful query, ONTAP will synchronize the global cache.
 
- If yes, ONTAP will synchronize the global cache.
 
- If no group membership exists, ONTAP will query (group) for the groups. 
                            
 
- Once the user is successfully queried, ONTAP will repeat the cycle and check if the user has group membership. 
                        
 
- If the user exists, ONTAP will check if the user has group membership.
                    
 
- If the global cache exists, ONTAP will check if the user (
- If not expired, access continues without further actions for the cache.
 
- If expired, ONTAP will then check the global cache otherwise known as the cluster cache.
            
 
Additional Information
- On cache expiration, unless the entry was harvested, reuse it and set the flag pending refresh.- Do not reuse while pending refreshonce refresh completes, the cache entry will be updated and the flag removed.
 
- Do not reuse while 
- After the first for 914483, the expired NFS credential will continue to be used until refresh completes.
- If the credential does not exist, it will be created in a partial state, and ONTAP will continually attempt refresh until it succeeds.
