+++ /dev/null
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<refentry id="idmap_autorid.8">
-
-<refmeta>
- <refentrytitle>idmap_autorid</refentrytitle>
- <manvolnum>8</manvolnum>
- <refmiscinfo class="source">Samba</refmiscinfo>
- <refmiscinfo class="manual">System Administration tools</refmiscinfo>
- <refmiscinfo class="version">3.6</refmiscinfo>
-</refmeta>
-
-
-<refnamediv>
- <refname>idmap_autorid</refname>
- <refpurpose>Samba's idmap_autorid Backend for Winbind</refpurpose>
-</refnamediv>
-
-<refsynopsisdiv>
- <title>DESCRIPTION</title>
- <para>The idmap_autorid backend provides a way to use an algorithmic
- mapping scheme to map UIDs/GIDs and SIDs that is more deterministic
- than idmap_tdb and easier to configure than idmap_rid.</para>
- <para>The module works similar to idmap_rid, but it automatically
- configures the range to be used for each domain, so there is no need
- to specify a specific range for each domain in the forest, the only
- configuration that is needed is the range of uid/gids that shall
- be used for user/group mappings and an optional size of the ranges
- to be used.</para>
- <para>The mappings of which domain is mapped to which range is stored
- in autorid.tdb, thus you should backup this database regularly.</para>
- <para>Due to the algorithm being used, it is the module that is
- most easy to use as it only requires a minimal configuration.</para>
-</refsynopsisdiv>
-
-<refsect1>
- <title>IDMAP OPTIONS</title>
-
- <variablelist>
- <varlistentry>
- <term>rangesize = numberofidsperdomain</term>
- <listitem><para>
- Defines the available number of uids/gids per domain. The
- minimum needed value is 2000. SIDs with RIDs larger than this
- value cannot be mapped, are ignored and the corresponding map
- is discarded. Choose this value carefully, as this should
- not be changed after the first ranges for domains have been
- defined, otherwise mappings between domains will get intermixed
- leading to unpredictable results. Please note that RIDs in Windows
- Domains usually start with 500 for builtin users and 1000
- for regular users. As the parameter cannot be changed later, please
- plan accordingly for your expected number of users in a domain
- with safety margins.
- </para>
- <para>One range will be used for local users and groups and for
- non-domain well-known SIDs like Everyone (S-1-1-0) or Creator Owner (S-1-3-0).
- A chosen list of well-known SIDs will be preallocated on first start
- to create deterministic mappings for those.</para>
- <para>
- Thus the number of local users and groups that can be created is
- limited by this option as well. If you plan to create a large amount
- of local users or groups, you will need set this parameter accordingly.
- </para>
- <para>The default value is 100000.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>read only = [ yes | no ]</term>
- <listitem><para>Turn the module into read-only mode. No new ranges will be allocated
- nor will new mappings be created in the idmap pool. Defaults to no.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>ignore builtin = [ yes | no ]</term>
- <listitem><para>Ignore any mapping requests for the BUILTIN domain.
- Defaults to no.</para>
- </listitem>
- </varlistentry>
- </variablelist>
-</refsect1>
-
-<refsect1>
- <title>THE MAPPING FORMULAS</title>
- <para>
- The Unix ID for a RID is calculated this way:
- <programlisting>
- ID = IDMAP UID LOW VALUE + DOMAINRANGENUMBER * RANGESIZE + RID
- </programlisting>
- </para>
- <para>
- Correspondingly, the formula for calculating the RID for a
- given Unix ID is this:
- <programlisting>
- RID = ID - IDMAP UID LOW VALUE - DOMAINRANGENUMBER * RANGESIZE
- </programlisting>
- </para>
-</refsect1>
-
-<refsect1>
- <title>EXAMPLES</title>
- <para>
- This example shows you the minimal configuration that will
- work for the principial domain and 19 trusted domains.
- </para>
-
- <programlisting>
- [global]
- security = ads
- workgroup = CUSTOMER
- realm = CUSTOMER.COM
-
- idmap config * : backend = autorid
- idmap config * : range = 1000000-1999999
-
- </programlisting>
-
- <para>
- This example shows how to configure idmap_autorid as default
- for all domains with a potentially large amount of users
- plus a specific configuration for a trusted domain
- that uses the SFU mapping scheme. Please note that idmap
- ranges and sfu ranges are not allowed to overlap.
- </para>
-
- <programlisting>
- [global]
- security = ads
- workgroup = CUSTOMER
- realm = CUSTOMER.COM
-
- idmap config * : backend = autorid
- idmap config * : range = 1000000-19999999
- idmap config * : rangesize = 1000000
-
- idmap config TRUSTED : backend = ad
- idmap config TRUSTED : range = 50000 - 99999
- idmap config TRUSTED : schema_mode = sfu
- </programlisting>
-
-</refsect1>
-
-<refsect1>
- <title>AUTHOR</title>
-
- <para>
- The original Samba software and related utilities
- were created by Andrew Tridgell. Samba is now developed
- by the Samba Team as an Open Source project similar
- to the way the Linux kernel is developed.
- </para>
-</refsect1>
-
-</refentry>
git.samba.org / kai / samba.git / blobdiff