ONTAP 9 Manuals ( CA08871-402 )

Before Dynamic Access Control, a CIFS credential included a security principal’s (the user’s) identity and Windows group membership. With Dynamic Access Control, three more types of information are added to the credential—​device identity, device claims, and user claims:

Central access policies for files enable organizations to centrally deploy and manage authorization policies that include conditional expressions using user groups, user claims, device claims, and resource properties.

For example, for accessing high business impact data, a user needs to be a full time employee and only have access to the data from a managed device. Central access policies are defined in Active Directory and distributed to file servers via the GPO mechanism.

Central access policies can be “staged”, in which case they are evaluated in a “what-if” manner during file access checks. The results of what would have happened if the policy was in effect and how that differs from what is currently configured are logged as an audit event. In this way, administrators can use audit event logs to study the impact of an access policy change before actually putting the policy in play. After evaluating the impact of an access policy change, the policy can be deployed via GPOs to the desired SVMs.

Supported GPOs

Apply Group Policy Objects to SMB servers overview

Enabling or disabling GPO support on a CIFS server

Displaying information about GPO configurations

Displaying information about central access policies

Displaying information about central access policy rules

Configuring central access policies to secure data on CIFS servers

Displaying information about Dynamic Access Control security

SMB and NFS auditing and security tracing overview