1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<refentry id="idmap_ldap.8"> 4 5<refmeta> 6 <refentrytitle>idmap_ldap</refentrytitle> 7 <manvolnum>8</manvolnum> 8 <refmiscinfo class="source">Samba</refmiscinfo> 9 <refmiscinfo class="manual">System Administration tools</refmiscinfo> 10 <refmiscinfo class="version">3.5</refmiscinfo> 11</refmeta> 12 13 14<refnamediv> 15 <refname>idmap_ldap</refname> 16 <refpurpose>Samba's idmap_ldap Backend for Winbind</refpurpose> 17</refnamediv> 18 19<refsynopsisdiv> 20 <title>DESCRIPTION</title> 21 22 <para>The idmap_ldap plugin provides a means for Winbind to 23 store and retrieve SID/uid/gid mapping tables in an LDAP directory 24 service. 25 </para> 26 27 <para> 28 In contrast to read only backends like idmap_rid, it is an allocating 29 backend: This means that it needs to allocate new user and group IDs in 30 order to create new mappings. The allocator can be provided by the 31 idmap_ldap backend itself or by any other allocating backend like 32 idmap_tdb or idmap_tdb2. This is configured with the 33 parameter <parameter>idmap alloc backend</parameter>. 34 </para> 35 36 <para> 37 Note that in order for this (or any other allocating) backend to 38 function at all, the default backend needs to be writeable. 39 The ranges used for uid and gid allocation are the default ranges 40 configured by "idmap uid" and "idmap gid". 41 </para> 42 43 <para> 44 Furthermore, since there is only one global allocating backend 45 responsible for all domains using writeable idmap backends, 46 any explicitly configured domain with idmap backend ldap 47 should have the same range as the default range, since it needs 48 to use the global uid / gid allocator. See the example below. 49 </para> 50</refsynopsisdiv> 51 52<refsect1> 53 <title>IDMAP OPTIONS</title> 54 55 <variablelist> 56 <varlistentry> 57 <term>ldap_base_dn = DN</term> 58 <listitem><para> 59 Defines the directory base suffix to use when searching for 60 SID/uid/gid mapping entries. If not defined, idmap_ldap will default 61 to using the "ldap idmap suffix" option from smb.conf. 62 </para></listitem> 63 </varlistentry> 64 65 <varlistentry> 66 <term>ldap_user_dn = DN</term> 67 <listitem><para> 68 Defines the user DN to be used for authentication. If absent an 69 anonymous bind will be performed. 70 </para></listitem> 71 </varlistentry> 72 73 <varlistentry> 74 <term>ldap_url = ldap://server/</term> 75 <listitem><para> 76 Specifies the LDAP server to use when searching for existing 77 SID/uid/gid map entries. If not defined, idmap_ldap will 78 assume that ldap://localhost/ should be used. 79 </para></listitem> 80 </varlistentry> 81 82 <varlistentry> 83 <term>range = low - high</term> 84 <listitem><para> 85 Defines the available matching uid and gid range for which the 86 backend is authoritative. 87 If the parameter is absent, Winbind fails over to use the 88 "idmap uid" and "idmap gid" options 89 from smb.conf. 90 </para></listitem> 91 </varlistentry> 92 </variablelist> 93</refsect1> 94 95<refsect1> 96 <title>IDMAP ALLOC OPTIONS</title> 97 98 <variablelist> 99 <varlistentry> 100 <term>ldap_base_dn = DN</term> 101 <listitem><para> 102 Defines the directory base suffix under which new SID/uid/gid mapping 103 entries should be stored. If not defined, idmap_ldap will default 104 to using the "ldap idmap suffix" option from smb.conf. 105 </para></listitem> 106 </varlistentry> 107 108 <varlistentry> 109 <term>ldap_user_dn = DN</term> 110 <listitem><para> 111 Defines the user DN to be used for authentication. If absent an 112 anonymous bind will be performed. 113 </para></listitem> 114 </varlistentry> 115 116 <varlistentry> 117 <term>ldap_url = ldap://server/</term> 118 <listitem><para> 119 Specifies the LDAP server to which modify/add/delete requests should 120 be sent. If not defined, idmap_ldap will assume that ldap://localhost/ 121 should be used. 122 </para></listitem> 123 </varlistentry> 124 </variablelist> 125</refsect1> 126 127<refsect1> 128 <title>EXAMPLES</title> 129 130 <para> 131 The follow sets of a LDAP configuration which uses two LDAP 132 directories, one for storing the ID mappings and one for retrieving 133 new IDs. 134 </para> 135 136 <programlisting> 137 [global] 138 idmap backend = ldap:ldap://localhost/ 139 idmap uid = 1000000-1999999 140 idmap gid = 1000000-1999999 141 142 idmap alloc backend = ldap 143 idmap alloc config : ldap_url = ldap://id-master/ 144 idmap alloc config : ldap_base_dn = ou=idmap,dc=example,dc=com 145 </programlisting> 146</refsect1> 147 148<refsynopsisdiv> 149 <title>NOTE</title> 150 151 <para>In order to use authentication against ldap servers you may 152 need to provide a DN and a password. To avoid exposing the password 153 in plain text in the configuration file we store it into a security 154 store. The "net idmap " command is used to store a secret 155 for the DN specified in a specific idmap domain. 156 </para> 157</refsynopsisdiv> 158 159<refsect1> 160 <title>AUTHOR</title> 161 162 <para> 163 The original Samba software and related utilities 164 were created by Andrew Tridgell. Samba is now developed 165 by the Samba Team as an Open Source project similar 166 to the way the Linux kernel is developed. 167 </para> 168</refsect1> 169 170</refentry> 171