In NetApp ONTAP multiprotocol environments where both UNIX (NFS) and Windows (SMB/CIFS) clients access the exact same FlexVol volume or qtree, ONTAP must authenticate and validate file access permissions across two distinct identity schemes. Volumes originally created for NFSv3 typically use UNIX security style, where files and directories are governed by UNIX UID/GID and POSIX permissions.

When a Windows client attempts to access the volume via SMB, granting share-level permissions is not sufficient. ONTAP must translate the incoming Windows Active Directory user (represented by a Security Identifier, or SID) into a valid UNIX user identity (UID/GID) to evaluate underlying WAFL filesystem permissions. If an explicit or implicit name mapping does not exist, the Windows user identity cannot be resolved to a UNIX account, and ONTAP denies access. The administrator must create a name mapping rule (vserver name-mapping create) to establish this translation. Creating a quota policy governs space consumption. Mounting the volume is already done since NFS is active, and igroups apply strictly to SAN block protocols (FC/iSCSI).