Chapter 1

Introduction to File Access Management

About this chapter

This chapter describes how to publish files that can be accessed and modified by clients running different protocols, and how to use Data ONTAP features that allow you to manage and control access to those files.

Supported protocols

Data ONTAP provides an infrastructure to manage files (resources) and the accounts of users trying to access those files. This infrastructure includes the mapping of read and write permissions for users and groups, regardless of the protocol being used by the file creator and the user trying to access that file.

Data ONTAP maps these permissions across the following protocols:

NFS
CIFS
FTP
HTTP
WebDAV

Factors used to control file access

Authentication:

In addition to enforcing file-based permissions, Data ONTAP also enforces authentication-based access restrictions. Authentication restrictions determine whether a user can connect to the storage system at all. Data ONTAP supports Kerberos authentication from both UNIX and Windows servers. Using authentication, Data ONTAP can control file access by denying access to an entire storage system or vFiler^TM unit, based upon which user is trying to connect and which client machine they are using to make that connection.

The remaining chapters of this guide describe procedures and processes that are specific to each protocol, for the purpose of providing, controlling, and monitoring file access.

File permission attributes

When a file is created, a list of access permissions is generated. While the form of that permissions list varies with each protocol, Data ONTAP maps common permissions, such as reading and writing to the file. When a user tries to access a file, Data ONTAP uses the permissions list to determine whether to permit access. Access can be permitted or denied based upon the operation being performed (such as reading or writing), and upon the following factors:

User account
User group or netgroup
client protocol
client IP address
file type

Using the lookup service you specify--Lightweight Directory Access Protocol (LDAP), Network Information Service (NIS), or local storage system information--Data ONTAP determines who is trying to access the resource, and verifies that the permission list indicates operations that can be performed on that resource, by that user.