1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<refentry id="idmap_tdb2.8"> 4 5<refmeta> 6 <refentrytitle>idmap_tdb2</refentrytitle> 7 <manvolnum>8</manvolnum> 8 <refmiscinfo class="source">Samba</refmiscinfo> 9 <refmiscinfo class="manual">System Administration tools</refmiscinfo> 10 <refmiscinfo class="version">3.5</refmiscinfo> 11</refmeta> 12 13 14<refnamediv> 15 <refname>idmap_tdb2</refname> 16 <refpurpose>Samba's idmap_tdb2 Backend for Winbind</refpurpose> 17</refnamediv> 18 19<refsynopsisdiv> 20 <title>DESCRIPTION</title> 21 22 <para> 23 The idmap_tdb2 plugin is a substitute for the default idmap_tdb 24 backend used by winbindd for storing SID/uid/gid mapping tables 25 in clustered environments with Samba and CTDB. 26 </para> 27 28 <para> 29 In contrast to read only backends like idmap_rid, it is an allocating 30 backend: This means that it needs to allocate new user and group IDs in 31 order to create new mappings. The allocator can be provided by the 32 idmap_tdb2 backend itself or by any other allocating backend like 33 idmap_tdb or idmap_ldap. This is configured with the 34 parameter <parameter>idmap alloc backend</parameter>. 35 </para> 36 37 <para> 38 Note that in order for this (or any other allocating) backend to 39 function at all, the default backend needs to be writeable. 40 The ranges used for uid and gid allocation are the default ranges 41 configured by "idmap uid" and "idmap gid". 42 </para> 43 44 <para> 45 Furthermore, since there is only one global allocating backend 46 responsible for all domains using writeable idmap backends, 47 any explicitly configured domain with idmap backend tdb2 48 should have the same range as the default range, since it needs 49 to use the global uid / gid allocator. See the example below. 50 </para> 51</refsynopsisdiv> 52 53<refsect1> 54 <title>IDMAP OPTIONS</title> 55 56 <variablelist> 57 <varlistentry> 58 <term>range = low - high</term> 59 <listitem><para> 60 Defines the available matching uid and gid range for which the 61 backend is authoritative. 62 If the parameter is absent, Winbind fails over to use 63 the "idmap uid" and "idmap gid" options 64 from smb.conf. 65 </para></listitem> 66 </varlistentry> 67 </variablelist> 68</refsect1> 69 70<refsect1> 71 <title>IDMAP SCRIPT</title> 72 73 <para> 74 The tdb2 idmap backend supports a script for performing id mappings 75 through the smb.conf option <parameter>idmap : script</parameter>. 76 The script should accept the following command line options. 77 </para> 78 79 <programlisting> 80 SIDTOID S-1-xxxx 81 IDTOSID UID xxxx 82 IDTOSID GID xxxx 83 </programlisting> 84 85 <para> 86 And it should return one of the following responses as a single line of 87 text. 88 </para> 89 90 <programlisting> 91 UID:yyyy 92 GID:yyyy 93 SID:yyyy 94 ERR:yyyy 95 </programlisting> 96 97 <para> 98 Note that the script should cover the complete range of SIDs 99 that can be passed in for SID to Unix ID mapping, since otherwise 100 SIDs unmapped by the script might get mapped to IDs that had 101 previously been mapped by the script. 102 </para> 103</refsect1> 104 105<refsect1> 106 <title>EXAMPLES</title> 107 108 <para> 109 This example shows how tdb2 is used as a the default idmap backend. 110 It configures the idmap range through the global options for all 111 domains encountered. This same range is used for uid/gid allocation. 112 </para> 113 114 <programlisting> 115 [global] 116 idmap backend = tdb2 117 idmap uid = 1000000-2000000 118 idmap gid = 1000000-2000000 119 </programlisting> 120</refsect1> 121 122<refsect1> 123 <title>AUTHOR</title> 124 125 <para> 126 The original Samba software and related utilities 127 were created by Andrew Tridgell. Samba is now developed 128 by the Samba Team as an Open Source project similar 129 to the way the Linux kernel is developed. 130 </para> 131</refsect1> 132 133</refentry> 134