File Service Protocols
System Administration Manual
225
Security information on a user is contained in an
access token
, which comprises the user
security identifier (SID), primary group SID, and other SIDs. The server gets the token from the
domain controller and caches it for use throughout the user’s session.
Security information on a file is contained in its
security descriptor
, which comprises the owner
SID, group SID, and access control list (ACL). The ACL can contain several access control
entries (ACEs), which specify whether or not to allow access.
NFS Access to Native NFS Files
When an NFS client tries to access a
native
file, one with UNIX security information, the server
checks the user’s UNIX credentials against the file’s security information to determine whether
or not an operation is permissible. The file security information comprises a user ID, group ID,
and read, write, and execute permissions.
Client Access to Non-Native Files
CIFS users may access files which have UNIX security information, and NFS users may access
files which have Windows security information. The server provides the following features to
make this possible:
•
Using the Web Manager, you set up mapping tables that associate the names of NFS
users and groups with their Windows equivalents.
For example, when a CIFS user tries to access a file that has UNIX-only security
information, the server automatically maps the user name to the corresponding NFS
name in the mapping table.
•
Titan automatically translates user security information from UNIX to Windows format,
or vice-versa, and caches it for the duration of the session.
•
The system automatically converts file security attributes from Windows to UNIX format
and stores the result in file metadata. This means that the files are henceforth native to
both CIFS and NFS clients. Although UNIX files are also converted to Windows format,
the results are not stored in file metadata.
UNIX credential
NT access token
UID
User mapping table
User SID
GID
Group mapping table
Primary group SID
Other groups
Group mapping table
Other groups
