1IDMAP_SCRIPT(8)           System Administration tools          IDMAP_SCRIPT(8)
2
3
4

NAME

6       idmap_script - Samba's idmap_script Backend for Winbind
7

DESCRIPTION

9       The idmap_script plugin is a substitute for the idmap_tdb2 backend used
10       by winbindd for storing SID/uid/gid mapping tables in clustered
11       environments with Samba and CTDB. It is a read only backend that uses a
12       script to perform mapping.
13
14       It was developed out of the idmap_tdb2 back end and does not store
15       SID/uid/gid mappings in a TDB, since the winbind_cache tdb will store
16       the mappings once they are provided.
17

IDMAP OPTIONS

19       range = low - high
20           Defines the available matching uid and gid range for which the
21           backend is authoritative.
22
23       script
24           This option can be used to configure an external program for
25           performing id mappings.
26

IDMAP SCRIPT

28       The tdb2 idmap backend supports an external program for performing id
29       mappings through the /etc/samba/smb.conf option idmap config * : script
30       or its deprecated legacy form idmap : script.
31
32       The mappings obtained by the script are then stored in the idmap tdb2
33       database instead of mappings created by the incrementing id counters.
34       It is therefore important that the script covers the complete range of
35       SIDs that can be passed in for SID to Unix ID mapping, since otherwise
36       SIDs unmapped by the script might get mapped to IDs that had previously
37       been mapped by the script.
38
39       The script should accept the following command line options.
40
41                SIDTOID S-1-xxxx
42                IDTOSID UID xxxx
43                IDTOSID GID xxxx
44                IDTOSID XID xxxx
45
46
47       And it should return one of the following responses as a single line of
48       text.
49
50                UID:yyyy
51                GID:yyyy
52                XID:yyyy
53                SID:ssss
54                ERR:yyyy
55
56
57       XID indicates that the ID returned should be both a UID and a GID. That
58       is, it requests an ID_TYPE_BOTH, but it is ultimately up to the script
59       whether or not it can honor that request. It can choose to return a UID
60       or a GID mapping only.
61

EXAMPLES

63       This example shows how script is used as a the default idmap backend
64       using an external program via the script parameter:
65
66                [global]
67                idmap config * : backend = script
68                idmap config * : range = 1000000-2000000
69                idmap config * : script = /usr/local/samba/bin/idmap_script.sh
70
71
72       This shows a simple script to partially perform the task:
73
74                #!/bin/sh
75                #
76                # Uncomment this if you want some logging
77                #echo $@ >> /tmp/idmap.sh.log
78                if [ "$1" == "SIDTOID" ]
79                then
80                     # Note. The number returned has to be within the range defined
81                     #echo "Sending UID:1000005" >> /tmp/idmap.sh.log
82                     echo "UID:1000005"
83                     exit 0
84                else
85                     #echo "Sending ERR: No idea what to do" >> /tmp/idmap.sh.log
86                     echo "ERR: No idea what to do"
87                     exit 1
88                fi
89
90
91       Clearly, this script is not enough, as it should probably use wbinfo to
92       determine if an incoming SID is a user or group SID and then look up
93       the mapping in a table or use some other mechanism for mapping SIDs to
94       UIDs and etc.
95
96       Please be aware that the script is called with the _NO_WINBINDD
97       environment variable set to 1. This prevents recursive calls into
98       winbind from the script both via explicit calls to wbinfo and via
99       implicit calls via nss_winbind. For example a call to ls -l could
100       trigger such an infinite recursion.
101
102       It is safe to call wbinfo -n and wbinfo -s from within an idmap script.
103       To do so, the script must unset the _NO_WINBINDD environment variable
104       right before the call to wbinfo and set it to 1 again right after
105       wbinfo has returned to protect against the recursion.
106

AUTHOR

108       The original Samba software and related utilities were created by
109       Andrew Tridgell. Samba is now developed by the Samba Team as an Open
110       Source project similar to the way the Linux kernel is developed.
111
112
113
114Samba 4.17.5                      01/26/2023                   IDMAP_SCRIPT(8)
Impressum