How Data ONTAP identifies users

Two types of user IDs

When applying a user quota, Data ONTAP distinguishes one user from another based on the ID, which can be a UNIX ID or a Windows ID.

Format of a UNIX ID

If you want to apply user quotas to UNIX users, specify the UNIX ID of each user in one of the following formats:

The user name, as defined in the /etc/passwd file or the NIS password map, such as jsmith.
The UID, such as 20.
A file or directory whose UID matches the user. In this case, you should choose a path name that will last as long as the user account remains on the system.
Note
Specifying a file or directory name only enables Data ONTAP to obtain the UID. Data ONTAP does not apply quotas to the file or directory, or to the volume in which the file or directory resides.

Restrictions on UNIX user names

A UNIX user name must not include a backslash (\) or an @ sign, because Data ONTAP treats names containing these characters as Windows names.

Special UID

You cannot impose restrictions on users whose UID is 0. You can specify a quota only to track the disk space and number of files used by this UID.

Format of a Windows ID

If you want to apply user quotas to Windows users, specify the Windows ID of each user in one of the following formats:

A Windows name specified in pre-Windows 2000 format. For details, see the section on specifying a Windows name in the CIFS chapter of the File Access Management Guide.
If the domain name or user name contains spaces or special characters, the entire Windows name must be in quotation marks, such as "tech support\john#smith".
A security ID (SID), as displayed by Windows in text form, such as S-1-5-32-544.
A file or directory that has an ACL owned by the SID of the user. In this case, you should choose a path name that will last as long as the user account remains on the system.
Note
For Data ONTAP to obtain the SID from the ACL, the ACL must be valid. If a file or directory exists in a UNIX-style qtree or if the filer uses UNIX mode for user authentication, Data ONTAP applies the user quota to the user whose UID matches that of the file or directory, not to the SID.

How Windows group IDs are treated

Data ONTAP does not support group quotas based on Windows group IDs. If you specify a Windows group ID as the quota target, the quota is treated like a user quota.

The following list describes what happens if the quota target is a special Windows group ID:

If the quota target is the Everyone group, a file whose ACL shows that the owner is Everyone is counted under the SID for Everyone.
If the quota target is BUILTIN\Administrators, the entry is considered a user quota for tracking only. You cannot impose restrictions on BUILTIN\Administrators. If a member of BUILTIN\Administrators creates a file, the file is owned by BUILTIN\Administrators and is counted under the SID for BUILTIN\Administrators.

How quotas are applied to users with multiple IDs

A user can be represented by multiple IDs. You can specify a single user quota entry for such a user by specifying a list of IDs as the quota target. A file owned by any of these IDs is subject to the restriction of the user quota.

Example

A user has the UNIX UID 20 and the Windows IDs corp\john_smith and engineering\jsmith. For this user, you can specify a quota where the quota target is a list of the UID and Windows IDs. When this user writes to the filer, the specified quota applies, regardless of whether the write originates from UID 20, corp\john_smith, or engineering\jsmith.

Quota targets listed in different quota entries are considered separate targets, even though the IDs belong to the same user.

Example

You can specify one quota that limits UID 20 to 1 GB of disk space and another quota that limits corp\john_smith to 2 GB of disk space, even though both IDs represent the same user. Data ONTAP applies quotas to UID 20 and corp\john_smith separately.

If the user has another Windows ID, engineering\jsmith, and there is no applicable quota entry, files owned by engineering\jsmith are not subject to restrictions, even though quota entries are in effect for UID 20 and corp\john_smith.

Root users and quotas

A root user is subject to tree quotas, but not user quotas or group quotas.

When root carries out a file or directory ownership change or other operation (such as the UNIX chown command) on behalf of a nonroot user, Data ONTAP checks the quotas based on the new owner but does not report errors or stop the operation even if the nonroot user's hard quota restrictions are exceeded. The root user can therefore carry out operations for a nonroot user (such as recovering data), even if those operations temporarily result in that nonroot user's quotas being exceeded.

Once the ownership transfer is carried out, however, a client system will report a disk space error for the nonroot user who is attempting to allocate more disk space while the quota is still exceeded.