Understanding the SID-to-name map cache

Purpose of the SID-to-name map cache

CIFS frequently is required to map security identifiers (SIDs) to user and group names and vice versa for user authentication, quota management, console command processing, and various RPC responses. NetApp storage systems obtain the SID-to-name mapping information by querying the domain controller. To minimize multiple lookups of the same names, SID-to-name information received from the domain controller is saved in the SID-to-name map cache on the storage system.

What the cache contains

The SID-to-name map cache contains entries that map SIDs to pre-Windows 2000 user and group names. SID-to-name mapping entries have a limited lifetime.

How the cache is controlled

The SID-to-name map cache is enabled on the storage system by default. You can manually control the cache by changing the lifetime of the entries, clearing entries, or turning SID-to-name map caching off or on. The cache persists if CIFS is terminated or restarted, but it does not persist across a reboot or a takeover and giveback.

How the storage system uses the cache

When the storage system requires SID-to-name mapping information, it first looks for a matching entry in the SID-to-name map cache. If a matching entry is not found or if an expired matching entry is found, the storage system queries the appropriate domain controller for current mapping information. If the domain controller is not available, an expired mapping entry might be used by the storage system.

Benefits of using the cache

The main benefits of using the SID-to-name map cache for name lookup are

Increased performance for authorization
Faster user response for console commands that perform mapping operations