1idmapd.conf(5) File Formats Manual idmapd.conf(5)
2
6 idmapd.conf - configuration file for libnfsidmap
7
9 Configuration file for libnfsidmap. Used by idmapd and svcgssd to map
10 NFSv4 name to and from ids.
11
13 The idmapd.conf configuration file consists of several sections, initi‐
14 ated by strings of the form [General] and [Mapping]. Each section may
15 contain lines of the form
16 variable = value
17 The recognized sections and their recognized variables are as follows:
18 [General] section variables
20 Verbosity
21 Verbosity level of debugging (Default: 0)
22 Domain The local NFSv4 domain name. An NFSv4 domain is a namespace
24 with a unique username<->UID and groupname<->GID mapping. (De‐
25 fault: Host's fully-qualified DNS domain name)
26 No-Strip
28 In multi-domain environments, some NFS servers will append the
29 identity management domain to the owner and owner_group in lieu
30 of a true NFSv4 domain. This option can facilitate lookups in
31 such environments. If set to a value other than "none", the
32 nsswitch plugin will first pass the name to the password/group
33 lookup function without stripping the domain off. If that map‐
34 ping fails then the plugin will try again using the old method
35 (comparing the domain in the string to the Domain value, strip‐
36 ping it if it matches, and passing the resulting short name to
37 the lookup function). Valid values are "user", "group", "both",
38 and "none". (Default: "none")
39 Reformat-Group
41 Winbind has a quirk whereby doing a group lookup in UPN format
42 (e.g. staff@americas.example.com) will cause the group to be
43 displayed prefixed with the full domain in uppercase (e.g. AMER‐
44 ICAS.EXAMPLE.COM\staff) instead of in the familiar netbios name
45 format (e.g. AMERICAS\staff). Setting this option to true
46 causes the name to be reformatted before passing it to the group
47 lookup function in order to work around this. This setting is
48 ignored unless No-Strip is set to either "both" or "group".
49 (Default: "false")
50 Local-Realms
52 A comma-separated list of Kerberos realm names that may be con‐
53 sidered equivalent to the local realm name. For example, users
54 juser@ORDER.EDU and juser@MAIL.ORDER.EDU may be considered to be
55 the same user in the specified Domain. (Default: the host's de‐
56 fault realm name)
57 Note: If a value is specified here, the default local realm must
58 be included as well.
59 [Mapping] section variables
61 Nobody-User
62 Local user name to be used when a mapping cannot be completed.
63 Nobody-Group
65 Local group name to be used when a mapping cannot be completed.
66 [Translation] section variables
68 Method A comma-separated, ordered list of mapping methods (plug-ins) to
69 use when mapping between NFSv4 names and local IDs. Each speci‐
70 fied method is tried in order until a mapping is found, or there
71 are no more methods to try. The methods included in the default
72 distribution include "nsswitch", "umich_ldap", and "static".
73 (Default: nsswitch)
74 GSS-Methods
76 An optional comma-separated, ordered list of mapping methods
77 (plug-ins) to use when mapping between GSS Authenticated names
78 and local IDs. (Default: the same list as specified for Method)
79 [Static] section variables
81 The "static" translation method uses a static list of GSS-Authenticated
82 names to local user names. Entries in the list are of the form:
83 principal@REALM = localusername
84 [REGEX] section variables
86 If the "regex" translation method is specified, the following variables
87 within the [REGEX] section are used to map between NFS4 names and local
88 IDs.
89 User-Regex
91 Case-insensitive regular expression that extracts the local user
92 name from an NFSv4 name. Multiple expressions may be concate‐
93 nated with '|'. The first match will be used. There is no de‐
94 fault. A basic regular expression for domain DOMAIN.ORG and
95 realm MY.DOMAIN.ORG would be:
96 ^DOMAIN\([^@]+)@MY.DOMAIN.ORG$
97 Group-Regex
99 Case-insensitive regular expression that extracts the local
100 group name from an NFSv4 name. Multiple expressions may be con‐
101 catenated with '|'. The first match will be used. There is no
102 default. A basic regular expression for domain DOMAIN.ORG and
103 realm MY.DOMAIN.ORG would be:
104 ^([^@]+)@DOMAIN.ORG@MY.DOMAIN.ORG$|^DOMAIN\([^@]+)@MY.DOMAIN.ORG$
105 Prepend-Before-User
107 Constant string to put before a local user name when building an
108 NFSv4 name. Usually this is the short domain name followed by
109 '´. (Default: none)
110 Append-After-User
112 Constant string to put after a local user name when building an
113 NFSv4 name. Usually this is '@' followed by the default realm.
114 (Default: none)
115 Prepend-Before-Group
117 Constant string to put before a local group name when building
118 an NFSv4 name. Usually not used. (Default: none)
119 Append-After-Group
121 Constant string to put before a local group name when building
122 an NFSv4 name. Usually this is '@' followed by the domain name
123 followed by another '@' and the default realm. (Default: none)
124 Group-Name-Prefix
126 Constant string that is prepended to a local group name when
127 converting it to an NFSv4 name. If an NFSv4 group name has this
128 prefix it is removed when converting it to a local group name.
129 With this group names of a central directory can be shortened
130 for an isolated organizational unit if all groups have a common
131 prefix. (Default: none)
132 Group-Name-No-Prefix-Regex
134 Case-insensitive regular expression to exclude groups from
135 adding and removing the prefix set by Group-Name-Prefix. The
136 regular expression must match both the remote and local group
137 names. Multiple expressions may be concatenated with '|'. (De‐
138 fault: none)
139 [UMICH_SCHEMA] section variables
141 If the "umich_ldap" translation method is specified, the following
142 variables within the [UMICH_SCHEMA] section are used.
143 LDAP_server
145 LDAP server name or address (Required if using UMICH_LDAP)
146 LDAP_base
148 Absolute LDAP search base. (Required if using UMICH_LDAP)
149 LDAP_people_base
151 Absolute LDAP search base for people accounts. (Default: The
152 LDAP_base value)
153 LDAP_group_base
155 Absolute LDAP search base for group accounts. (Default: The
156 LDAP_base value)
157 LDAP_canonicalize_name
159 Whether or not to perform name canonicalization on the name
160 given as LDAP_server (Default: "true")
161 LDAP_follow_referrals
163 Whether or not to follow ldap referrals. (Default: "true")
164 LDAP_use_ssl
166 Set to "true" to enable SSL communication with the LDAP server.
167 (Default: "false")
168 LDAP_ca_cert
170 Location of a trusted CA certificate used when SSL is enabled
171 (Required if LDAP_use_ssl is true and LDAP_tls_reqcert is not
172 set to never)
173 LDAP_tls_reqcert
175 Controls the LDAP server certificate validation behavior. It
176 can take the same values as ldap.conf(5)'s TLS_REQCERT tunable.
177 (Default: "hard")
178 LDAP_timeout_seconds
180 Number of seconds before timing out an LDAP request (Default: 4)
181 LDAP_sasl_mech
183 SASL mechanism to be used for sasl authentication. Required if
184 SASL auth is to be used (Default: None)
185 LDAP_realm
187 SASL realm to be used for sasl authentication. (Default: None)
188 LDAP_sasl_authcid
190 Authentication identity to be used for sasl authentication. (De‐
191 fault: None)
192 LDAP_sasl_authzid
194 Authorization identity to be used for sasl authentication. (De‐
195 fault: None)
196 LDAP_sasl_secprops
198 Cyrus SASL security properties. It can the same values as
199 ldap.conf(5)'s sasl_secprops.
200 LDAP_sasl_canonicalize
202 Specifies whether the LDAP server hostname should be canoni‐
203 calised. If set to yes LDAP lib with do a reverse hostname
204 lookup. If this is not set the LDAP library's default will be
205 used. (Default: None)
206 LDAP_sasl_krb5_ccname
208 Path to kerberos credential cache. If it is not set then the
209 value of environment variable KRB5CCNAME will be used. If the
210 environment variable is not set then the default mechanism of
211 kerberos library will be used.
212 NFSv4_person_objectclass
214 The object class name for people accounts in your local LDAP
215 schema (Default: NFSv4RemotePerson)
216 NFSv4_name_attr
218 Your local schema's attribute name to be used for NFSv4 user
219 names (Default: NFSv4Name)
220 NFSv4_uid_attr
222 Your local schema's attribute name to be used for uidNumber (De‐
223 fault: uidNumber)
224 GSS_principal_attr
226 Your local schema's attribute name for GSSAPI Principal names
227 (Default: GSSAuthName)
228 NFSv4_acctname_attr
230 Your local schema's attribute name to be used for account names
231 (Default: uid)
232 NFSv4_group_objectclass
234 The object class name for group accounts in your local LDAP
235 schema (Default: NFSv4RemoteGroup)
236 NFSv4_gid_attr
238 Your local schema's attribute name to be used for gidNumber (De‐
239 fault: gidNumber)
240 NFSv4_group_attr
242 Your local schema's attribute name to be used for NFSv4 group
243 names (Default: NFSv4Name)
244 LDAP_use_memberof_for_groups
246 Some LDAP servers do a better job with indexing where searching
247 through all the groups searching for the user in the memberuid
248 list. Others like SunOne directory that search can takes min‐
249 utes if there are thousands of groups. So setting LDAP_use_mem‐
250 berof_for_groups to true in the configuration file will use the
251 memberof lists of the account and search through only those
252 groups to obtain gids. (Default: false)
253 NFSv4_member_attr
255 If LDAP_use_memberof_for_groups is true, this is the attribute
256 to be searched for. (Default: memberUid)
257 NFSv4_grouplist_filter
259 An optional search filter for determining group membership. (No
260 Default)
261
263 An example /etc/idmapd.conf file:
264 [General]
267 Verbosity = 0
269 Domain = domain.org
270 Local-Realms = DOMAIN.ORG,MY.DOMAIN.ORG,YOUR.DOMAIN.ORG
271 [Mapping]
273 Nobody-User = nfsnobody
275 Nobody-Group = nfsnobody
276 [Translation]
278 Method = umich_ldap,regex,nsswitch
280 GSS-Methods = umich_ldap,regex,static
281 [Static]
283 johndoe@OTHER.DOMAIN.ORG = johnny
285 [Regex]
287 User-Regex = ^DOMAIN\([^@]+)@DOMAIN.ORG$
289 Group-Regex = ^([^@]+)@DOMAIN.ORG@DOMAIN.ORG$|^DOMAIN\([^@]+)@DOMAIN.ORG$
290 Prepend-Before-User = DOMAIN
291 Append-After-User = @DOMAIN.ORG
292 Append-After-Group = @domain.org@domain.org
293 Group-Name-Prefix = sales-
294 Group-Name-No-Prefix-Regex = -personal-group$
295 [UMICH_SCHEMA]
297 LDAP_server = ldap.domain.org
299 LDAP_base = dc=org,dc=domain
300
303 idmapd(8) svcgssd(8)
304
306 Report bugs to <nfsv4@linux-nfs.org>
307 19 Nov 2008 idmapd.conf(5)