Data ONTAP enables concurrent access to files via the NFS and CIFS protocols and the use of the Kerberos authentication protocol. Although all of these protocols have the concept of a principal (a user or group), they use incompatible formats for storing principal information. CIFS stores user and group information on a Windows Domain Controller (primary or backup) by using either NetLanMan (NTLM) or Kerberos authentication. NFS stores user and group information in the Network Information System (NIS) (or in unix-group/unix-user accounts), with few rules for authentication. NFS supports a single NIS domain per file server, whereas CIFS supports a network of cooperating domains. Kerberos maintains its own database, one per Kerberos realm. Name mappings provide a level of compatibility among these models.

NFS and CIFS use incompatible models to internally represent principal information. Data ONTAP bases its conversions on user and group names. A typical CIFS user might be ENG\jones, where ENG in the domain or workgroup name and jones is the login name of a user. An NFS user name might be jones. Note that CIFS names include a domain, but NFS names do not. Because NFS supports only a single domain per file server, the domain name is implied. A Kerberos user might be jones/myserver@EXAMPLE.COM, where jones is the login name of a user (in Kerberos terms, the primary), myserver is a hostname or other information that qualifies the primary (in Kerberos terms, the instance), and EXAMPLE.COM is a logical network (in Kerberos terms, the realm)) served by a single Kerberos database and one or more Key Distribution Centers (KDCs). A KDC is a server that issues Kerberos tickets. Kerberos realms are listed in uppercase.