docs/manpages-3/idmap_ldap.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="idmap_ldap.8">
   4
   5 <refmeta>
   6         <refentrytitle>idmap_ldap</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">3.2</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>idmap_ldap</refname>
  16         <refpurpose>Samba's idmap_ldap Backend for Winbind</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <title>DESCRIPTION</title>
  21
  22         <para>The idmap_ldap plugin provides a means for Winbind to
  23         store and retrieve SID/uid/gid mapping tables in an LDAP directory
  24         service.  The module implements both the &quot;idmap&quot; and
  25         &quot;idmap alloc&quot; APIs.
  26         </para>
  27 </refsynopsisdiv>
  28
  29 <refsect1>
  30         <title>IDMAP OPTIONS</title>
  31
  32         <variablelist>
  33                 <varlistentry>
  34                 <term>ldap_base_dn = DN</term>
  35                 <listitem><para>
  36                         Defines the directory base suffix to use when searching for
  37                         SID/uid/gid mapping entries.  If not defined, idmap_ldap will default
  38                         to using the &quot;ldap idmap suffix&quot; option from smb.conf.
  39                 </para></listitem>
  40                 </varlistentry>
  41
  42                 <varlistentry>
  43                 <term>ldap_user_dn = DN</term>
  44                 <listitem><para>
  45                         Defines the user DN to be used for authentication. If absent an
  46                         anonymous bind will be performed.
  47                 </para></listitem>
  48                 </varlistentry>
  49
  50                 <varlistentry>
  51                 <term>ldap_url = ldap://server/</term>
  52                 <listitem><para>
  53                         Specifies the LDAP server to use when searching for existing
  54                         SID/uid/gid map entries. If not defined, idmap_ldap will
  55                         assume that ldap://localhost/ should be used.
  56                 </para></listitem>
  57                 </varlistentry>
  58
  59                 <varlistentry>
  60                 <term>range = low - high</term>
  61                 <listitem><para>
  62                         Defines the available matching uid and gid range for which the
  63                         backend is authoritative.  Note that the range commonly matches
  64                         the allocation range due to the fact that the same backend will
  65                         store and retrieve SID/uid/gid mapping entries.  If the parameter
  66                         is absent, Winbind fail over to use the &quot;idmap uid&quot; and
  67                         &quot;idmap gid&quot; options from smb.conf.
  68                 </para></listitem>
  69                 </varlistentry>
  70         </variablelist>
  71 </refsect1>
  72
  73 <refsect1>
  74         <title>IDMAP ALLOC OPTIONS</title>
  75
  76         <variablelist>
  77                 <varlistentry>
  78                 <term>ldap_base_dn = DN</term>
  79                 <listitem><para>
  80                         Defines the directory base suffix under which new SID/uid/gid mapping
  81                         entries should be stored.  If not defined, idmap_ldap will default
  82                         to using the &quot;ldap idmap suffix&quot; option from smb.conf.
  83                 </para></listitem>
  84                 </varlistentry>
  85
  86                 <varlistentry>
  87                 <term>ldap_user_dn = DN</term>
  88                 <listitem><para>
  89                         Defines the user DN to be used for authentication. If absent an
  90                         anonymous bind will be performed.
  91                 </para></listitem>
  92                 </varlistentry>
  93
  94                 <varlistentry>
  95                 <term>ldap_url = ldap://server/</term>
  96                 <listitem><para>
  97                         Specifies the LDAP server to which modify/add/delete requests should
  98                         be sent.  If not defined, idmap_ldap will assume that ldap://localhost/
  99                         should be used.
 100                 </para></listitem>
 101                 </varlistentry>
 102
 103                 <varlistentry>
 104                 <term>range = low - high</term>
 105                 <listitem><para>
 106                         Defines the available matching uid and gid range from which
 107                         winbindd can allocate for users and groups.  If the parameter
 108                         is absent, Winbind fail over to use the &quot;idmap uid&quot;
 109                         and &quot;idmap gid&quot; options from smb.conf.
 110                 </para></listitem>
 111                 </varlistentry>
 112         </variablelist>
 113 </refsect1>
 114
 115 <refsect1>
 116         <title>EXAMPLES</title>
 117
 118         <para>
 119         The follow sets of a LDAP configuration which uses a slave server
 120         running on localhost for fast fetching SID/gid/uid mappings, it
 121         implies correct configuration of referrals.
 122         The idmap alloc backend is pointed directly to the master to skip
 123         the referral (and consequent reconnection to the master) that the
 124         slave would return as allocation requires writing on the master.
 125         </para>
 126
 127         <programlisting>
 128         [global]
 129             idmap domains = ALLDOMAINS
 130             idmap config ALLDOMAINS:default      = yes
 131             idmap config ALLDOMAINS:backend      = ldap
 132             idmap config ALLDOMAINS:ldap_base_dn = ou=idmap,dc=example,dc=com
 133             idmap config ALLDOMAINS:ldap_url     = ldap://localhost/
 134             idmap config ALLDOMAINS:range        = 10000 - 50000
 135
 136             idmap alloc backend = ldap
 137             idmap alloc config:ldap_base_dn = ou=idmap,dc=example,dc=com
 138             idmap alloc config:ldap_url     = ldap://master.example.com/
 139             idmap alloc config:range        = 10000 - 50000
 140         </programlisting>
 141 </refsect1>
 142
 143 <refsynopsisdiv>
 144         <title>NOTE</title>
 145
 146         <para>In order to use authentication against ldap servers you may
 147         need to provide a DN and a password. To avoid exposing the password
 148         in plain text in the configuration file we store it into a security
 149         store. The &quot;net idmap &quot; command is used to store a secret
 150         for the DN specified in a specific idmap domain.
 151         </para>
 152 </refsynopsisdiv>
 153
 154 <refsect1>
 155         <title>AUTHOR</title>
 156
 157         <para>
 158         The original Samba software and related utilities
 159         were created by Andrew Tridgell. Samba is now developed
 160         by the Samba Team as an Open Source project similar
 161         to the way the Linux kernel is developed.
 162         </para>
 163 </refsect1>
 164
 165 </refentry>