NAS user identity & authentication

Authorization succeeds only when ONTAP resolves the presented identity, maps it across Windows and UNIX when necessary, and evaluates the owning security style. Trace those steps in order.

Identity flow and security styles

NFS normally presents UID/GID; SMB authenticates a SID through the SVM CIFS server and AD. ONTAP resolves credentials in ns-switch order, maps UNIX↔Windows when needed, then enforces volume or qtree style. See NFS, SMB/CIFS and SVM.

cluster::> volume show -vserver svm1 -fields security-style
vserver  volume    security-style
svm1     unixdata  unix
svm1     shares    ntfs
svm1     projects  mixed

Style	Authority	Meaning
UNIX	Mode bits/NFS ACLs, UID/GID.	Windows access needs a UNIX identity.
NTFS	Windows descriptors and SIDs.	UNIX access needs a Windows identity.
Mixed	Last permission-setting operation determines effective file style.	Not “permissions checked twice”; authority can flip, creating the horror stories.

A qtree can override the volume.

cluster::> volume qtree show -vserver svm1 -volume projects -fields security-style
vserver  volume    qtree      security-style
svm1     projects  unix-team  unix
svm1     projects  finance    ntfs

UNIX identity: LDAP and NIS

Local users/groups resemble passwd/group entries. LDAP commonly uses RFC2307; AD-backed LDAP may need a schema mapping. Create the client, associate it, then add LDAP to ns-switch.

cluster::> vserver services name-service ldap client create -vserver svm1 \
  -client-config corp-rfc2307 -ldap-servers 192.0.2.40,192.0.2.41 \
  -schema RFC-2307 -base-dn dc=example,dc=com
cluster::> vserver services name-service ldap create -vserver svm1 \
  -client-config corp-rfc2307

cluster::> vserver services name-service ldap show -vserver svm1
Vserver  Client Configuration
svm1     corp-rfc2307
cluster::> vserver services name-service ns-switch modify -vserver svm1 \
  -database passwd -sources files,ldap

Use protected binds/TLS where supported; parameters depend on schema and release. NIS uses the nis-domain family:

cluster::> vserver services name-service nis-domain create -vserver svm1 \
  -domain legacy.example -nis-servers 192.0.2.60,192.0.2.61
cluster::> vserver services name-service nis-domain show -vserver svm1
Vserver  Domain          NIS Servers
svm1     legacy.example  192.0.2.60, 192.0.2.61

Windows identity and AD

vserver cifs create joins the SVM to AD. DNS and synchronized time are prerequisites; see NTP, DNS & name services.

cluster::> vserver cifs create -vserver svm1 -cifs-server SVM1FILES \
  -domain CORP.EXAMPLE.COM
Enter the user name: CORP\adjoin
Enter the password:
cluster::> vserver cifs check -vserver svm1
Vserver : svm1
Cifs Status : Running

SMB guest access maps unauthenticated users to a configured guest account. Treat it as an exception: scope shares/ACLs tightly and disable it if unneeded.

Ordered name mapping

Mappings are POSIX regular expressions, evaluated by direction and position. A broad early rule shadows later rules.

cluster::> vserver name-mapping create -vserver svm1 -direction win-unix \
  -position 1 -pattern "CORP\\(.+)" -replacement "\1"
cluster::> vserver name-mapping create -vserver svm1 -direction unix-win \
  -position 1 -pattern "(.+)" -replacement "CORP\\\1"
cluster::> vserver name-mapping show -vserver svm1
Vserver  Direction  Position  Pattern       Replacement
svm1     win-unix   1         CORP\(.+)     \1

Resolution tests and failure

cluster::> vserver services name-service getxxbyyy getpwbyname \
  -vserver svm1 -username alice
pw_name: alice
pw_uid: 10421
pw_gid: 10020
pw_dir: /home/alice

cluster::> vserver services name-service ns-switch show -vserver svm1
Vserver  Database  Source Order
svm1     hosts     files,dns
svm1     passwd    files,ldap
svm1     group     files,ldap
svm1     namemap   files

On lookup failure, NFS can use the anonymous/squashed identity specified by the matched export rule; SMB may report unknown user or access denied. Inspect the rule—do not call every denial “root squash.”

Troubleshooting matrix

Symptom	Check	Evidence
LDAP bind fails	Base/bind DN, TLS trust, DNS/route.	LDAP show, client config, EMS.
No mapping	Direction, priority, escaped regex, case.	Name-mapping show.
UID collision	Duplicates across files/LDAP/NIS.	getpwbyname/getpwbyuid.
NFS root squashed	Matched export `-superuser`/`-anon`.	Rule index and client match.
CIFS lookup fails	DC, DNS/time, secure channel, mapping.	CIFS check, LDAP show, secd EMS.

cluster::> event log show -time >30m -severity ERROR -message-name *secd*
Time                 Node   Severity  Event
8/27/2026 13:42:08   node1  ERROR     secd.ldap.query.timed.out: ...

Official ONTAP sources

Outputs are illustrative. Verify schema names and active help on your release.