From 75484f491140fb86eaee90dde1dc1c9d4ebe8a41 Mon Sep 17 00:00:00 2001 From: Karolin Seeger Date: Mon, 3 Sep 2012 21:49:25 +0200 Subject: docs: Rename manpages-3 -> manpages. This change was suggested by Andrew Bartlett on the samba-technical mailing list. Karolin Autobuild-User(master): Karolin Seeger Autobuild-Date(master): Mon Sep 3 23:35:38 CEST 2012 on sn-devel-104 --- docs-xml/manpages/idmap_autorid.8.xml | 153 ++++++++++++++++++++++++++++++++++ 1 file changed, 153 insertions(+) create mode 100644 docs-xml/manpages/idmap_autorid.8.xml (limited to 'docs-xml/manpages/idmap_autorid.8.xml') diff --git a/docs-xml/manpages/idmap_autorid.8.xml b/docs-xml/manpages/idmap_autorid.8.xml new file mode 100644 index 0000000000..498ef68fb3 --- /dev/null +++ b/docs-xml/manpages/idmap_autorid.8.xml @@ -0,0 +1,153 @@ + + + + + + idmap_autorid + 8 + Samba + System Administration tools + 3.6 + + + + + idmap_autorid + Samba's idmap_autorid Backend for Winbind + + + + DESCRIPTION + The idmap_autorid backend provides a way to use an algorithmic + mapping scheme to map UIDs/GIDs and SIDs that is more deterministic + than idmap_tdb and easier to configure than idmap_rid. + The module works similar to idmap_rid, but it automatically + configures the range to be used for each domain, so there is no need + to specify a specific range for each domain in the forest, the only + configuration that is needed is the range of uid/gids that shall + be used for user/group mappings and an optional size of the ranges + to be used. + The mappings of which domain is mapped to which range is stored + in autorid.tdb, thus you should backup this database regularly. + Due to the algorithm being used, it is the module that is + most easy to use as it only requires a minimal configuration. + + + + IDMAP OPTIONS + + + + rangesize = numberofidsperdomain + + Defines the available number of uids/gids per domain. The + minimum needed value is 2000. SIDs with RIDs larger than this + value cannot be mapped, are ignored and the corresponding map + is discarded. Choose this value carefully, as this should + not be changed after the first ranges for domains have been + defined, otherwise mappings between domains will get intermixed + leading to unpredictable results. Please note that RIDs in Windows + Domains usually start with 500 for builtin users and 1000 + for regular users. As the parameter cannot be changed later, please + plan accordingly for your expected number of users in a domain + with safety margins. + + One range will be used for local users and groups and for + non-domain well-known SIDs like Everyone (S-1-1-0) or Creator Owner (S-1-3-0). + A chosen list of well-known SIDs will be preallocated on first start + to create deterministic mappings for those. + + Thus the number of local users and groups that can be created is + limited by this option as well. If you plan to create a large amount + of local users or groups, you will need set this parameter accordingly. + + The default value is 100000. + + + + read only = [ yes | no ] + Turn the module into read-only mode. No new ranges will be allocated + nor will new mappings be created in the idmap pool. Defaults to no. + + + + ignore builtin = [ yes | no ] + Ignore any mapping requests for the BUILTIN domain. + Defaults to no. + + + + + + + THE MAPPING FORMULAS + + The Unix ID for a RID is calculated this way: + + ID = IDMAP UID LOW VALUE + DOMAINRANGENUMBER * RANGESIZE + RID + + + + Correspondingly, the formula for calculating the RID for a + given Unix ID is this: + + RID = ID - IDMAP UID LOW VALUE - DOMAINRANGENUMBER * RANGESIZE + + + + + + EXAMPLES + + This example shows you the minimal configuration that will + work for the principial domain and 19 trusted domains. + + + + [global] + security = ads + workgroup = CUSTOMER + realm = CUSTOMER.COM + + idmap config * : backend = autorid + idmap config * : range = 1000000-1999999 + + + + + This example shows how to configure idmap_autorid as default + for all domains with a potentially large amount of users + plus a specific configuration for a trusted domain + that uses the SFU mapping scheme. Please note that idmap + ranges and sfu ranges are not allowed to overlap. + + + + [global] + security = ads + workgroup = CUSTOMER + realm = CUSTOMER.COM + + idmap config * : backend = autorid + idmap config * : range = 1000000-19999999 + idmap config * : rangesize = 1000000 + + idmap config TRUSTED : backend = ad + idmap config TRUSTED : range = 50000 - 99999 + idmap config TRUSTED : schema_mode = sfu + + + + + + AUTHOR + + + The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed. + + + + -- cgit