How ONTAP handles SMB client authentication
Suggest changes
PDFs
Before users can create SMB connections to access data contained on the SVM, they must be authenticated by the domain to which the SMB server belongs. The SMB server supports two authentication methods, Kerberos and NTLM (NTLMv1 or NTLMv2). Kerberos is the default method used to authenticate domain users.
Kerberos authentication
ONTAP supports Kerberos authentication when creating authenticated SMB sessions.
Kerberos is the primary authentication service for Active Directory. The Kerberos server, or Kerberos Key Distribution Center (KDC) service, stores and retrieves information about security principles in the Active Directory. Unlike the NTLM model, Active Directory clients who want to establish a session with another computer, such the SMB server, contact a KDC directly to obtain their session credentials.
NTLM authentication
NTLM client authentication is done using a challenge response protocol based on shared knowledge of a user-specific secret based on a password.
If a user creates an SMB connection using a local Windows user account, authentication is done locally by the SMB server using NTLMv2.