summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Adam <obnox@samba.org>2010-12-07 15:47:52 +0100
committerMichael Adam <obnox@samba.org>2010-12-07 18:24:18 +0100
commit91d9cb48a5224c7dc443747505f9dd1071f822ed (patch)
treeb7d3954554e885550532f5d5df7554edad24d70c
parent15c33ada6b897ac46141aaae0f0333816b94448b (diff)
downloadsamba-91d9cb48a5224c7dc443747505f9dd1071f822ed.tar.gz
samba-91d9cb48a5224c7dc443747505f9dd1071f822ed.tar.bz2
samba-91d9cb48a5224c7dc443747505f9dd1071f822ed.zip
docs: clarify the idmap_ad manpage (bug #6322)
The idmap_ad module can not be used as a default backend.
-rw-r--r--docs-xml/manpages-3/idmap_ad.8.xml17
1 files changed, 17 insertions, 0 deletions
diff --git a/docs-xml/manpages-3/idmap_ad.8.xml b/docs-xml/manpages-3/idmap_ad.8.xml
index 9b445df8f7..3ecb07e590 100644
--- a/docs-xml/manpages-3/idmap_ad.8.xml
+++ b/docs-xml/manpages-3/idmap_ad.8.xml
@@ -25,6 +25,23 @@
by the administrator by adding the posixAccount/posixGroup
classes and relative attribute/value pairs to the user and
group objects in the AD.</para>
+
+ <para>
+ Note that the idmap_ad module has changed considerably since
+ Samba versions 3.0 and 3.2.
+ Currently, the <parameter>ad</parameter> backend
+ does not work as the the default idmap backend, but one has
+ to configure it separately for each domain for which one wants
+ to use it, using disjoint ranges. One usually needs to configure
+ a writeable default idmap range, using for example the
+ <parameter>tdb</parameter> or <parameter>ldap</parameter>)
+ backend, in order to be able to map the BUILTIN sids and
+ possibly other trusted domains. The writeable default config
+ is also needed in order to be able to create group mappings.
+ This catch-all default idmap configuration should have a range
+ that is disjoint from any explicitly configured domain with
+ idmap backend <parameter>ad</parameter>. See the example below.
+ </para>
</refsynopsisdiv>
<refsect1>