More edits.

(This used to be commit 5143216f7513938823dbeda3d9a4b7fc4cc1dfa7)

2 files changed, 182 insertions, 1 deletions

diff --git a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml
index adb1689017..61561cb55f 100644
--- a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml
+++ b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml
@@ -29,7 +29,36 @@
 <title>Features and Benefits</title>
 
 	<para>
-	Stuff goes here.
+	Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to
+	arbitrarily associate them with Unix/Linux group accounts.
+	</para>
+
+	<para>
+	Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools
+	so long as appropriate interface scripts have been provided to &smb.conf;
+	</para>
+
+	<para>
+	Administrators should be aware that where &smb.conf; group interface scripts make
+	direct calls to the Unix/Linux system tools (eg: the shadow utilities, <command>groupadd,
+	groupdel, groupmod</command>) then the resulting Unix/Linux group names will be subject
+	to any limits imposed by these tools. If the tool does NOT allow upper case characters
+	or space characters, then the creation of an MS Windows NT4 / 200x style group of
+	<parameter>Engineering Managers</parameter> will attempt to create an identically named
+	Unix/Linux group, an attempt that will of course fail!
+	</para>
+
+	<para>
+	There are several possible work-arounds for the operating system tools limitation. One
+	method is to use a script that generates a name for the Unix/Linux system group that
+	fits the operating system limits, and that then just passes the Unix/Linux group id (GID)
+	back to the calling samba interface. This will provide a dynamic work-around solution.
+	</para>
+
+	<para>
+	Another work-around is to manually create a Unix/Linux group, then manually create the
+	MS Windows NT4 / 200x group on the Samba server and then use the <command>net groupmap</command>
+	tool to connect the two to each other.
 	</para>
 
 </sect1>
@@ -150,6 +179,85 @@
 	(ie: prepared by someone else for general use). 
 	</para>
 
+	<sect2>
+	<title>Sample &smb.conf; <emphasis><parameter>add group script</parameter></emphasis></title>
+
+		<para>
+		A script to great complying group names for use by the samba group interfaces:
+		</para>
+
+<para>
+<screen>
+Script name: smbgrpadd.sh
+
+#!/bin/bash
+
+# Add the group using normal system groupadd tool.
+groupadd smbtmpgrp00
+
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+
+# Now change the name to what we want for the MS Windows networking end
+cat /etc/group | sed s/smbtmpgrp00/$1/g > /etc/group
+
+# Now return the GID as would normally happen.
+echo $thegid
+exit 0
+</screen>
+</para>
+
+		<para>
+		The &smb.conf; entry for the above script would look like:
+		<screen>
+		add group script = /path_to_tool/smbgrpadd.sh %g
+		</screen>
+		</para>
+
+	</sect2>
+	
+	<sect2>
+	<title>Script to configure Group Mapping</title>
+
+	<para>
+	In our example we have created a Unix/Linux group called <parameter>ntadmin</parameter>.
+	Our script will create the additional groups <parameter>Engineers, Marketoids, Gnomes</parameter>:
+	</para>
+
+<para>
+<screen>
+#!/bin/bash
+
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Administrators" unixgroup=root
+net groupmap modify ntgroup="Users" unixgroup=users
+net groupmap modify ntgroup="Guests" unixgroup=nobody
+net groupmap modify ntgroup="System Operators" unixgroup=sys
+net groupmap modify ntgroup="Account Operators" unixgroup=root
+net groupmap modify ntgroup="Backup Operators" unixgroup=bin
+net groupmap modify ntgroup="Print Operators" unixgroup=lp
+net groupmap modify ntgroup="Replicators" unixgroup=daemon
+net groupmap modify ntgroup="Power Users" unixgroup=sys
+
+#groupadd Engineers
+#groupadd Marketoids
+#groupadd Gnomes
+
+#net groupmap add ntgroup="Engineers"  unixgroup=Engineers    type=d
+#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids   type=d
+#net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
+</screen>
+</para>
+
+	<para>
+	Of course it is expected that the admininstrator will modify this to suit local needs.
+	For information regarding the use of the <command>net groupmap</command> tool please
+	refer to the man page.
+	</para>
+
+	</sect2>
+
 </sect1>
 
 <sect1>
diff --git a/docs/docbook/projdoc/passdb.xml b/docs/docbook/projdoc/passdb.xml
index 419dd51335..4152494d24 100644
--- a/docs/docbook/projdoc/passdb.xml
+++ b/docs/docbook/projdoc/passdb.xml
@@ -866,6 +866,79 @@ index   default               sub
 		</sect3>
 
 		<sect3>
+		<title>Initialise the LDAP database</title>
+
+		<para>
+		Before you can add accounts to the LDAP database you must create the account containers
+		that they will be stored in. The following LDIF file should be modified to match your
+		needs (ie: Your DNS entries, etc.).
+		</para>
+		
+<para>
+<screen>
+# Organization for Samba Base
+dn: dc=plainjoe,dc=org
+objectclass: dbObject
+objectclass: organization
+dc: plainjoe
+o: Terpstra Org Network
+description: The Samba-3 Network LDAP Example
+
+# Organizational Role for Directory Management
+db: cn=Manager,dc=plainjoe,dc=org
+objectclass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+# Setting up container for users
+dn: ou=People,dc=plainjoe,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for People OU
+dn: cn=admin,ou=People,dc=plainjoe,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+</screen>
+</para>
+
+		<para>
+		The userPassword shown above should be generated using <command>slappasswd</command>.
+		</para>
+
+		<para>
+		The following command will then load the contents of the LDIF file into the LDAP
+		database.
+		</para>
+
+<para>
+<screen>
+slapadd -v -l initldap.dif
+</screen>
+</para>
+
+		<para>
+		Do not forget to secure your LDAP server with an adequate access control list,
+		as well as an admin password.
+		</para>
+
+		<note>
+		<para>
+		Before Samba can access the LDAP server you need to stoe the LDAP admin password
+		into the Samba-3 <filename>secrets.tdb</filename> database by:
+		<screen>
+		&rootprompt; <command>smbpasswd -w secret</command>
+		</screen>
+		</para>
+		</note>
+
+		</sect3>
+
+		<sect3>
 		<title>Configuring Samba</title>
 
 			<para>