Understanding the SID-to-name map cache

Purpose of the SID-to-name map cache

CIFS frequently is required to map security identifiers (SIDs) to user and group names and vice versa for user authentication, quota management, console command processing, and various RPC responses. The filer obtains the SID-to-name mapping information by querying the domain controller. To minimize multiple lookups of the same names, SID-to-name information received from the domain controller is saved in the SID-to-name map cache on the filer.

What the cache contains

The SID-to-name map cache contains entries that map SIDs to pre-Windows 2000 user and group names. SID-to-name mapping entries have a limited lifetime.

How the cache is controlled

The SID-to-name map cache is enabled on the filer by default. You can manually control the cache by changing the lifetime of the entries, clearing entries, or turning SID-to-name map caching off or on. The cache persists if CIFS is terminated or restarted, but does not persist across a reboot or a takeover and giveback.

How the filer uses the cache

When the filer requires SID-to-name mapping information, it first looks for a matching entry in the SID-to-name map cache. If a matching entry is not found or if an expired matching entry is found, the filer queries the appropriate domain controller for current mapping information. If the domain controller is not available, an expired mapping entry may be used by the filer.

Benefits of using the cache

The main benefits of using the SID-to-name map cache for name lookup are

Increased performance for authorization
Faster user response for console commands that perform mapping operations

Managing the cache

The following sections discuss how you can manage the SID-to-name map cache: