How CIFS users obtain UNIX credentials

About UNIX credentials

When connecting to the filer, a user on a CIFS client receives a CIFS credential. The user must also have one or more UNIX credentials. A UNIX credential consists of a UNIX-style user ID (UID) and group IDs (GIDs). When a CIFS user tries to connect to the filer, Data ONTAP tries to determine the UID and primary GID of the CIFS user. If Data ONTAP cannot determine the UID of the CIFS user, the user is denied access.

You can see the UNIX credential of a connected CIFS user when you display CIFS session information, as described in Displaying CIFS session information.

How Data ONTAP uses the UNIX credential

Data ONTAP uses the UNIX credential for the following purposes:

When a user tries to access files that have UNIX-style security, Data ONTAP uses the UID and GID to determine the access rights of the user.
When you want to use group quotas on a group that contains CIFS users, those CIFS users must have UNIX credentials. For more information about group quotas, see the Storage Management Guide.

How Data ONTAP obtains the UNIX credential

Data ONTAP obtains users' UNIX credentials by looking up the UNIX password database, which can be an NIS map or the /etc/passwd file, to obtain the UID for a user. The database contains accounts for all users that might access the filer. Each account contains a UNIX-style user name and UID.

For Data ONTAP to obtain a UID for a CIFS user, it must first determine the user's UNIX-style name. Data ONTAP does not require that a user's Windows name be identical to the UNIX name. By entering information in the /etc/usermap.cfg file, you can specify how each Windows name maps to a UNIX name. If you accept the default mapping, you do not need to enter this information. By default, Data ONTAP uses the Windows name as the UNIX name when it looks up the UID. (The filer converts uppercase characters in the Windows name to lowercase before the lookup.)

If the user names in the UNIX password database are identical to the Windows names, you need not provide the mapping information in the /etc/usermap.cfg file. If the user name is not found in the UNIX password database and the wafl.default_unix_user option has been specified, the default login name specified for that option is used. See the Data ONTAP command reference for more information about setting the wafl.default_unix_user option.

How Data ONTAP obtains the GIDs

Data ONTAP obtains a user's GIDs in the following ways:

Data ONTAP obtains the user's primary GID from the UNIX password database. Each account in the UNIX password database contains the primary GID for that user.
Data ONTAP obtains the user's other GIDs from the group database, which can be the NIS group map or the /etc/group file. The group database is where you define membership for various groups.

Ensuring that only intended CIFS users receive UNIX credentials

To ensure that only the intended CIFS users receive UNIX credentials and can access the filer, complete the following steps.

Step	Action
1	If...	Then...
	Some Windows names are different from UNIX names or you want to prevent some CIFS users from accessing the filer	Edit the /etc/usermap.cfg file, and then go to Step 2. See How Data ONTAP maps user names.
	All Windows names are the same as UNIX names and you want all CIFS users to be able access the filer	Go to Step 2.
2	Create groups in the UNIX group database. See Mapping UNIX names to UIDs and GIDs.
3	For each CIFS user with a mapped UNIX name, enter the user account in the UNIX password database.
4	If...	Then...
	You rename the Administrator account	Make sure at least one CIFS user maps to the UNIX root account, and then go to Step 5. See Mapping a Windows account to root. Note If you set the option `wafl.nt_admin_priv_map_ to_root to` On, all accounts in the Administrators group are considered root. You do not need to complete the following steps.
	You do not rename the Administrator account	Go to Step 5.
5	If...	Then...
	You want CIFS users who do not have an entry in the UNIX password database to access the filer	Create a default user account in the UNIX password database, set the `wafl.default_unix_user` option to that user, and then go to Step 6. See Creating or disabling the default UNIX user account.
	You want all CIFS users who have an entry in the UNIX password database to access the filer	Go to Step 6.
6	If...	Then...
	You want unauthenticated users to access the filer	See Enabling or disabling the Windows guest user account.
	You do not want unauthenticated users to access the filer	You are done.