1IDMAP_RID(8)              System Administration tools             IDMAP_RID(8)
2
3
4

NAME

6       idmap_rid - Samba's idmap_rid Backend for Winbind
7

DESCRIPTION

9       The idmap_rid backend provides a way to use an algorithmic mapping
10       scheme to map UIDs/GIDs and SIDs. No database is required in this case
11       as the mapping is deterministic.
12
13       Currently, there should to be an explicit idmap configuration for each
14       domain that should use the idmap_rid backend, using disjoint ranges.
15
16       NOTE: The idmap_rid backend can NOT bet used as the default backend.
17       One usually needs to define a writeable default idmap range, using a
18       backend like tdb or ldap that can create unix ids, in order to be able
19       to map the BUILTIN sids and other domains, and also in order to be able
20       to create group mappings. See the example below.
21

IDMAP OPTIONS

23       range = low - high
24           Defines the available matching uid and gid range for which the
25           backend is authoritative. Note that the range acts as a filter. If
26           algorithmically determined UID or GID fall outside the range, they
27           are ignored and the corresponding map is discarded. It is intended
28           as a way to avoid accidental UID/GID overlaps between local and
29           remotely defined IDs.
30
31       base_rid = INTEGER
32           Defines the base integer used to build SIDs out of a UID or a GID,
33           and to rebase the UID or GID to be obtained from a SID. This means
34           SIDs with a RID less than the base rid are filtered. The default is
35           not to restrict the allowed rids at all, i.e. a base_rid value of
36           0.
37
38           Use of this parameter is deprecated.
39

THE MAPPING FORMULAS

41       The Unix ID for a RID is calculated this way:
42
43                          ID = RID - BASE_RID + LOW_RANGE_ID.
44
45
46       Correspondingly, the formula for calculating the RID for a given Unix
47       ID is this:
48
49                          RID = ID + BASE_RID - LOW_RANGE_ID.
50
51
52

EXAMPLES

54       This example shows how to configure two domains with idmap_rid, the
55       principal domain and a trusted domain, leaving the default id mapping
56       scheme at tdb. The example also demonstrates the use of the base_rid
57       parameter for the trusted domain.
58
59                [global]
60                security = domain
61                workgroup = MAIN
62
63                idmap config * : backend        = tdb
64                idmap config * : range          = 1000000-1999999
65
66                idmap config MAIN : backend     = rid
67                idmap config MAIN : range       = 10000 - 49999
68
69                idmap config TRUSTED : backend  = rid
70                idmap config TRUSTED : range    = 50000 - 99999
71
72

AUTHOR

74       The original Samba software and related utilities were created by
75       Andrew Tridgell. Samba is now developed by the Samba Team as an Open
76       Source project similar to the way the Linux kernel is developed.
77
78
79
80Samba 4.13.7                      03/25/2021                      IDMAP_RID(8)
Impressum